Free 312-50v13 sample questions

Correct answers: Setting up a rogue access point with the same SSID and attempting to downgrade the EAP authentication protocol.; Targeting the RADIUS server with credential stuffing or password spraying attacks to compromise user accounts.

Correct answer: #

In the MQTT protocol, wildcards are used to subscribe to multiple topics at once. The single-level wildcard is `+`, which matches a single topic level. The multi-level wildcard is `#`, which matches any number of topic levels. To subscribe to all topics and eavesdrop on all communications passing through the broker, the `#` wildcard must be used. It must be placed as the last character in the topic string.

Correct answer: False

This statement is false. A Kubernetes service account token is a bearer token. If an attacker exfiltrates this token from a compromised pod, they can use it from anywhere (e.g., their own machine) to authenticate to the Kubernetes API server, provided the API server is accessible. The token's permissions are determined by the Roles and ClusterRoles bound to the service account, not by the location from which it is used.

Correct answer: shellgpt Generate an nmap command to perform an aggressive scan on acmecorp.com and save the output in all formats to a file named 'acmescan'

ShellGPT is designed to interpret natural language to generate commands. The most effective query is a clear, descriptive sentence that specifies the tool (`nmap`), the action (`perform an aggressive scan`), the target (`acmecorp.com`), and the desired output options (`save the output in all formats to a file named 'acmescan'`). This level of detail allows the AI to correctly map the request to the appropriate nmap flags (`-A` for aggressive, `-oA acmescan` for output in all formats). The other options are either too vague or use incorrect syntax for a natural language query tool.

Correct answer: Iodine

Iodine is a well-known tool used for tunneling IPv4 data through a DNS server. It is a popular choice for attackers to exfiltrate data or establish a command-and-control (C2) channel in highly restricted networks where only DNS traffic is allowed. It works by encapsulating data within DNS queries and responses, often using TXT or NULL record types. Dnsrecon is for DNS enumeration, Wireshark is a packet analyzer, and Netcat is a versatile networking utility but does not create DNS tunnels natively.

Correct answer: An introspection query to ask the API for its own schema.

GraphQL has a built-in feature called introspection, which allows a client to query the server for information about the API's schema, including all available types, fields, queries, and mutations. If introspection is enabled on a production server (a common misconfiguration), an attacker can send an introspection query to get a complete map of the API's capabilities. This can reveal hidden or sensitive data fields that they can then attempt to query directly.

Correct answer: Fileless Malware

Fileless malware is a type of malicious software that exists only as in-memory artifacts. It does not write any part of its activity to the computer's hard drive, making it very difficult for traditional signature-based antivirus solutions to detect. 'Living off the land' techniques, which abuse legitimate, pre-installed tools like PowerShell, WMI, or registry entries, are a hallmark of fileless malware attacks.

Correct answer: Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy (PFS) is a property of secure communication protocols where a compromise of long-term keys does not compromise past session keys. PFS is achieved by generating a unique, ephemeral session key for each session. Key exchange protocols like Diffie-Hellman Ephemeral (DHE) or Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provide PFS. If the server's static private key (used for signing the key exchange) is stolen, it cannot be used to decrypt previously recorded sessions because each session used a different, temporary key that was discarded.

Correct answer: A firewall or packet filtering device is dropping the probe packets without sending any response.

Nmap reports a port as 'filtered' when its probe packets are sent but no response is received. This usually indicates that a firewall, router ACL, or other packet filtering device is silently dropping the packets. An 'open' port would respond with a SYN/ACK, and a 'closed' port would respond with a RST packet. The lack of any response for all scanned ports strongly suggests a firewall is blocking the scan.

Correct answer: High-interaction honeypot

High-interaction honeypots provide a real, non-emulated environment for attackers to interact with. They run actual operating systems and services, which allows for deep analysis of an attacker's behavior, including capturing their keystrokes, uploaded tools, and TTPs. This is in contrast to low-interaction honeypots, which only emulate services and offer limited engagement, or medium-interaction honeypots, which offer more functionality than low-interaction but still fall short of a real OS.