Eccouncil 312-96 Exam Questions Instant Access

Question 1

Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?

Asession-fixation-protection ='newSessionlD'

Bsession-fixation-protection ='.

Csession-fixation-protection ='enabled'

Dsession-fixation-protection ='.

Answer : B

Question 2

The software developer has implemented encryption in the code as shown in the following screenshot.

However, using the DES algorithm for encryption is considered to be an insecure coding practice as DES is a weak encryption algorithm. Which of the following symmetric encryption algorithms will you suggest for strong encryption?

AMD5

BSHA-1

CTriple DES

DAES

Answer : D

Question 3

Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?

A< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1 < /load-on-startup > < servlet >

B< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >

C< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 < /load-on-startup > < /servlet >

D< servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l < /load-on-startup > < /servlet >

Answer : B

Question 4

Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed 'false' parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.

ADenial-of-Service attack

BClient-Side Scripts Attack

CSQL Injection Attack

DDirectory Traversal Attack

Answer : B

Question 5

Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?

A< connector... maxFileLimit='file size' / >

B< connector... maxPostSize='0'/>

C< connector... maxFileSize='file size' / >

D< connector... maxPostSize='file size' / >

Answer : D

Question 6

Which of the following configurations can help you avoid displaying server names in server response header?

A< Connector port='8080' protocol='HTTP/1.1' connectionTimeout='20000' redirectPort= '8443' / >

B< Connector port='8080' protocol='HTTP/1.1' connectionTimeout='20000' ServerName=' disable' redirectPort='8443' / >

C< Connector port='8080' protocol='HTTP/1.1' connectionTimeout='20000' Server = ' ' redirectPort='8443' / >

D< Connector port='8080' protocol='HTTP/1.1' connectionTimeout='20000' ServerName ='null ' redirectPort='8443'' / >

Answer : B

Question 7

The threat modeling phase where applications are decomposed and their entry points are reviewed from an attacker's perspective is known as ________

AAttack Surface Evaluation

BThreat Classification

CThreat Identification

DImpact Analysis

Answer : A

Eccouncil Certified Application Security Engineer (CASE) JAVA 312-96 Exam Questions