312-96 Practice Exam — 49 Free ECCouncil Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

49Practice Questions

3Study Modes

Free

TopicSort

Question 1

Secure Coding Practices for Session Management

Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?

A session-fixation-protection ="newSessionID"
B session-fixation-protection ="migrateSession"
C session-fixation-protection ="enabled"
D session-fixation-protection ="protectSession"

Question 2

Secure Deployment and Maintenance

Question 3

Secure Deployment and Maintenance

Question 4

Secure Deployment and Maintenance

Question 5

Secure Coding Practices for Authentication and Authorization

Question 6

Secure Deployment and Maintenance

Question 7

Security Requirements Gathering

Question 8

Secure Deployment and Maintenance

Question 9

Secure Coding Practices for Error Handling

Question 10

Secure Coding Practices for Error Handling

Question 11

Security Requirements Gathering

Question 12

Secure Application Design and Architecture

Question 13

Secure Deployment and Maintenance

Question 14

Understanding Application Security, Threats, and Attacks

Question 15

Secure Coding Practices for Session Management

Question 16

Secure Coding Practices for Error Handling

Question 17

Secure Deployment and Maintenance

Question 18

Secure Application Design and Architecture

Question 19

Understanding Application Security, Threats, and Attacks

Question 20

Secure Coding Practices for Input Validation

That's the end of the Preview

This exam has 49 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

Understanding Application Security, Threats, and AttacksSecurity Requirements GatheringSecure Application Design and ArchitectureSecure Coding Practices for Input ValidationSecure Coding Practices for Authentication and AuthorizationSecure Coding Practices for CryptographySecure Coding Practices for Session ManagementSecure Coding Practices for Error HandlingStatic and Dynamic Application Security Testing (SAST & DAST)Secure Deployment and Maintenance

Log In / Sign Up

Page 1 of 2 • Questions 1-25 of 49

1 2

→

Know a question that should be here? Contribute to this exam

Which of the following configurations can help you avoid displaying server names in server response header?

A < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort= "8443" / >
B < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName=" disable" redirectPort="8443" / >
C < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" Server = " " redirectPort="8443" / >
D < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName ="null " redirectPort="8443'' / >

Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?

A < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1 < /load-on-startup > < servlet >
B < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >
C < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 < /load-on-startup > < /servlet >
D < servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l < /load-on-startup > < /servlet >

Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?

A < connector... maxFileLimit="file size" / >
B < connector... maxPostSize="0" / >
C < connector... maxFileSize="file size" / >
D < connector... maxPostSize="file size" / >

Which of the following authentication mechanism does J2EE support?

A Windows, Form based, Role Based, Client/Server Mutual Authentication
B Role Based, Http Basic, Windows, Http Digest Authentication
C Http Basic, Form Based, Client/Server Mutual, Role Based Authentication
D Http Basic, Form Based, Client/Server Mutual, HTTP Digest Authentication

Question 6

Secure Deployment and Maintenance

Question 7

Security Requirements Gathering

Question 8

Secure Deployment and Maintenance

Question 9

Secure Coding Practices for Error Handling

Question 10

Secure Coding Practices for Error Handling

Question 11

Security Requirements Gathering

Question 12

Secure Application Design and Architecture

Question 13

Secure Deployment and Maintenance

Question 14

Understanding Application Security, Threats, and Attacks

Question 15

Secure Coding Practices for Session Management

Question 16

Secure Coding Practices for Error Handling

Question 17

Secure Deployment and Maintenance

Question 18

Secure Application Design and Architecture

Question 19

Understanding Application Security, Threats, and Attacks

Question 20

Secure Coding Practices for Input Validation

To enable the struts validator on an application, which configuration setting should be applied in the struts validator configuration file?

Question Image

A validate="true''
B IsNotvalidate="disabled"
C IsNotvalidate="false"
D validate="enabled"

Which of the following can be derived from abuse cases to elicit security requirements for software system?

A Misuse cases
B Data flow diagram
C Use cases
D Security use cases

Alice, a Server Administrator (Tomcat), wants to ensure that Tomcat can be shut down only by the user who owns the Tomcat process. Select the appropriate setting of the CATALINA_HOME/conf in server.xml that will enable him to do so.

A < server port="" shutdown="" >
B < server port="-1" shutdown="" >
C < server port="-1" shutdown="SHUTDOWN" >
D < server port="8080" shutdown="SHUTDOWN" >

James is a Java developer working INFR INC. He has written Java code to open a file, read it line by line and display its content in the text editor. He wants to ensure that any unhandled exception raised by the code should automatically close the opened file stream. Which of the following exception handling block should he use for the above purpose?

A Try-Catch-Finally block
B Try-Catch block
C Try-With-Resources block
D Try-Catch-Resources block

Identify what should NOT be catched while handling exceptions.

A EOFException
B SecurityException
C IllegalAccessException
D NullPointerException

Which of the following relationship is used to describe security use case scenario?

A Threatens Relationship
B Extend Relationship
C Mitigates Relationship
D Include Relationship

Which of the following DFD component is used to represent the change in privilege levels?

Question Image

A 3
B 4
C 1
D 2

Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can pose a serious security risk as attackers can access hidden script files in your directory. Which of the following will mitigate the above security risk?

A < int-param > < param-name>directory-listings < param-value>true < /init-param >
B < int param > < param-name>directory-listings < param-value>false < /init-param >
C < int-param > < param-name>listings < param-value>true < /init-param >
D < int-param > < param-name>listings < param-value>false < /init-param >

Which of the risk assessment model is used to rate the threats-based risk to the application during threat modeling process?

A DREAD
B SMART
C STRIDE
D RED

Which line of the following example of Java Code can make application vulnerable to a session attack?

Question Image

A Line No. 1
B Line No. 3
C Line No. 4
D Line No. 5

Which of the following method will help you check if DEBUG level is enabled?

A isDebugEnabled()
B EnableDebug ()
C IsEnableDebug ()
D DebugEnabled()

Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?

A < connector IsSSLEnabled="Yes" / >
B < connector EnableSSL="true" / >
C < connector SSLEnabled="false" / >
D < connector SSLEnabled="true" / >

In which phase of secure development lifecycle the threat modeling is performed?

A Coding phase
B Testing phase
C Deployment phase
D Design phase

Identify the type of attack depicted in the figure below:

Question Image

A XSS
B Cross-Site Request Forgery (CSRF) attack
C SQL injection attack
D Denial-of-Service attack

Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

A He should write code like out.Write ("You Searched for: " +ESAPI.encoder().encodeForHTML(search));
B He should write code like out.write ("You Searched for: " + request.getParameter("search").toString());
C He should write code like out.write ("You Searched for: " + request.getParameter("txt_Search"));
D He should write code like out.write (("You Searched for: " +(search));

Join Us Among the Stars

312-96Preview

About the 312-96 Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Join Us Among the Stars

312-96Preview

About the 312-96 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20