2024年最新のPassTest ECCouncil 312-96問題集と試験テストエンジン
ECCouncil 312-96問題集にはリアル試験問題解答
質問 # 16
James is a Java developer working INFR INC. He has written Java code to open a file, read it line by line and display its content in the text editor. He wants to ensure that any unhandled exception raised by the code should automatically close the opened file stream. Which of the following exception handling block should he use for the above purpose?
- A. Try-With-Resources block
- B. Try-Catch block
- C. Try-Catch-Resources block
- D. Try-Catch-Finally block
正解：A
解説：
James should use the Try-With-Resources block to ensure that any unhandled exception raised by the code will automatically close the opened file stream. The Try-With-Resources block is a feature introduced in Java
7 that allows for more efficient management of resources, such as files, that need to be closed after operations on them are completed.
Here's how it works:
* The resource declared within the try parentheses is initialized.
* The try block executes with the resource.
* If an exception occurs, it's caught by an optional catch block.
* After the try (and optionally catch) block execution, the resource is automatically closed.
This approach eliminates the need for a finally block to explicitly close the resource, reducing the risk of resource leaks and making the code cleaner and more readable.
References: The Try-With-Resources block is a well-documented feature in Java and is recommended for managing resources in Java applications as per the EC-Council's Application Security Engineer (CASE) JAVA certification guidelines1. It is also a part of best practices in exception handling in Java, as noted in various Java programming resources2.
質問 # 17
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
- A. He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
- B. He should write code like out-Write ("You Searched for:" +ESAPI.encoder().encodeForHTML(search));
- C. He should write code like out.write (("You Searched for:" +(search));
- D. He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
正解：B
解説：
To mitigate the XSS vulnerability on the search page, Stephen should encode the user input before it is output to the browser. This can be done using the ESAPI (Enterprise Security API) encoder, which is a collection of utilities designed to help developers defend against security vulnerabilities such as XSS.
The correct code snippet would be:
Java
out.Write("You Searched for: " + ESAPI.encoder().encodeForHTML(request.getParameter("txt_Search"))); AI-generated code. Review and use carefully. More info on FAQ.
This code ensures that any HTML special characters in the user input are properly encoded, preventing them from being executed as part of the HTML markup. For example, if a user enters a script tag, it will be encoded and displayed as plain text rather than executed.
References:For further details, please refer to the EC-Council's Certified Application Security Engineer (CASE) JAVA courses and study guides, which provide guidelines on secure coding practices, including input validation and output encoding strategies12. Additionally, the OWASP XSS Prevention Cheat Sheet offers comprehensive steps to prevent XSS vulnerabilities2.
質問 # 18
Which of the following relationship is used to describe security use case scenario?
- A. Extend Relationship
- B. Threatens Relationship
- C. Mitigates Relationship
- D. Include Relationship
正解：A
質問 # 19
James is a Java developer working INFR INC. He has written Java code to open a file, read it line by line and display its content in the text editor. He wants to ensure that any unhandled exception raised by the code should automatically close the opened file stream. Which of the following exception handling block should he use for the above purpose?
- A. Try-With-Resources block
- B. Try-Catch block
- C. Try-Catch-Resources block
- D. Try-Catch-Finally block
正解：A
質問 # 20
A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
- A. SQL Injection attack
- B. Session Hijacking attack
- C. Brute force attack
- D. Cross Site Request Forgery attack
正解：A
質問 # 21
Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?
- A. < connector... maxFileSize="file size" / >
- B. < connector... maxPostSize="file size" / >
- C. < connector... maxFileLimit="file size" / >
- D. < connector... maxPostSize="0"/>
正解：B
解説：
In Tomcat's server.xml configuration file, the maxPostSize attribute on a <Connector> element is used to specify the maximum size of a POST request that can be accepted by the server. Setting this attribute to a specific byte size will limit the size of uploads based on that size. If set to 0, it indicates that there is no limit on the size of the POST request1.
References: The EC-Council's Certified Application Security Engineer (CASE) JAVA course includes server configuration and security settings as part of its curriculum, which would cover aspects such as setting upload limits in server configuration files like server.xml for Tomcat1.
質問 # 22
Identify the type of encryption depicted in the following figure.
- A. Symmetric Encryption
- B. Hashing
- C. Asymmetric Encryption
- D. Digital Signature
正解：A
解説：
The image depicts a process where a single key is used for both encryption and decryption, which is characteristic of symmetric encryption. In symmetric encryption, the same key is applied to encrypt plaintext into ciphertext and then used again to decrypt the ciphertext back into the original plaintext. This method is efficient for scenarios where secure channels exist for key exchange.
References:For precise references, please consult the EC-Council Application Security Engineer (CASE) JAVA related courses and study guides, as my capabilities are designed to provide information based on general knowledge and do not include real-time access to external databases or documents.
質問 # 23
Identify the type of attack depicted in the following figure.
- A. Denial-of-service attack
- B. Directory Traversal Attack
- C. SQL Injection attack
- D. Form Tampering Attack
正解：B
質問 # 24
Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of users depicted in the use cases of the project under inception. Based on the use case in hand, he started depicting the scenarios where attacker could misuse the application. Can you identify the activity on which Ted is working?
- A. Ted was depicting abstract use cases
- B. Ted was depicting security use cases
- C. Ted was depicting abuse cases
- D. Ted was depicting lower-level use cases
正解：C
解説：
Ted is engaged in the activity of depicting abuse cases. Abuse cases are a form of negative use cases that describe how an application can be misused or attacked. They are used to identify potential security vulnerabilities and to design countermeasures that can prevent or mitigate these attacks. By analyzing the interactions of users as depicted in the use cases, Ted is able to envision scenarios where an attacker could exploit the application, which is essential for strengthening the application's security posture.
References:For specific references, please consult the EC-Council Application Security Engineer (CASE) JAVA related courses and study guides. These resources will provide detailed information on abuse cases and their role in application security. My response is based on the general knowledge of application security practices up to the year 2021. Please note that I do not have real-time access to external databases or the internet for document retrieval.
質問 # 25
Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities.
Which type of security assessment activity Jacob is currently performing?
- A. SAST
- B. CAST
- C. ISCST
- D. CAST
正解：A
解説：
Jacob is performing a Static Application Security Testing (SAST). SAST involves inspecting the source code to find security vulnerabilities that could be exploited by attackers. It is a white-box testing method where the tester has knowledge of the system architecture and source code. SAST tools analyze the code for patterns that may indicate security issues, such as input validation errors, insecure dependencies, and more.
References:For specific references, please consult the EC-Council Application Security Engineer (CASE) JAVA related courses and study guides. These resources will provide detailed information on SAST and its methodologies as per the EC-Council's standards and guidelines. My response is based on the general knowledge of application security practices up to the year 2021.
質問 # 26
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
- A. He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
- B. He should write code like out-Write ("You Searched for:" +ESAPI.encoder().encodeForHTML(search));
- C. He should write code like out.write (("You Searched for:" +(search));
- D. He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
正解：B
質問 # 27
Which of the following method will help you check if DEBUG level is enabled?
- A. DebugEnabled()
- B. isDebugEnabled()
- C. EnableDebug ()
- D. IsEnableDebug ()
正解：B
質問 # 28
Which of the following DFD component is used to represent the change in privilege levels?
- A. 0
- B. 1
- C. 2
- D. 3
正解：D
質問 # 29
In which phase of secure development lifecycle the threat modeling is performed?
- A. Deployment phase
- B. Design phase
- C. Testing phase
- D. Coding phase
正解：B
質問 # 30
Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?
- A. session-fixation-protection =".
- B. session-fixation-protection ="newSessionlD"
- C. session-fixation-protection ="enabled"
- D. session-fixation-protection =".
正解：A
質問 # 31
......
2024年最新のPassTest 312-96のPDFで最近更新された問題です：https://www.passtest.jp/ECCouncil/312-96-shiken.html
312-96試験には保証が付きます。更新されたのは49問があります：https://drive.google.com/open?id=1psS1Q6nEpBssjg2irIv2dSBxih6N2P-9