312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ125

VerifiedUnderstanding Cyber Threats, IoCs, and Attack Methodology

Wesley is an incident handler at a company named Maddison Tech. One day, he was learning techniques to eradicate insecure-deserialization attacks. Which of the following should Wesley avoid considering?

Explanation

Serialization should not be enabled for security-sensitive classes because it can expose or transfer privileged or sensitive state. Secure-deserialization guidance instead restricts permitted classes and prevents sensitive fields from being serialized, such as by marking them transient in Java.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!