312-50v12 Free Practice Test

- (Exam Topic 2)
Sam, a professional hacker. targeted an organization with intention of compromising AWS IAM credentials. He attempted to lure one of the employees of the organization by initiating fake calls while posing as a legitimate employee. Moreover, he sent phishing emails to steal the AWS 1AM credentials and further compromise the employee's account. What is the technique used by Sam to compromise the AWS IAM credentials?

1. A. Social engineering
2. B. insider threat
3. C. Password reuse
4. D. Reverse engineering

Correct Answer: A
Just like any other service that accepts usernames and passwords for logging in, AWS users are vulnerable to social engineering attacks from attackers. fake emails, calls, or any other method of social engineering, may find yourself with an AWS users’ credentials within the hands of an attacker.
If a user only uses API keys for accessing AWS, general phishing techniques could still use to gain access to other accounts or their pc itself, where the attacker may then pull the API keys for aforementioned AWS user.
With basic opensource intelligence (OSINT), it’s usually simple to collect a list of workers of an organization that use AWS on a regular basis. This list will then be targeted with spear phishing to do and gather credentials. an easy technique may include an email that says your bill has spiked 500th within the past 24 hours, “click here for additional information”, and when they click the link, they’re forwarded to a malicious copy of the AWS login page designed to steal their credentials.
An example of such an email will be seen within the screenshot below. it’s exactly like an email that AWS would send to you if you were to exceed the free tier limits, except for a few little changes. If you clicked on any of the highlighted regions within the screenshot, you’d not be taken to the official AWS web site and you’d instead be forwarded to a pretend login page setup to steal your credentials.
These emails will get even more specific by playing a touch bit additional OSINT before causing them out. If an attacker was ready to discover your AWS account ID on-line somewhere, they could use methods we at rhino have free previously to enumerate what users and roles exist in your account with none logs contact on your side. they could use this list to more refine their target list, further as their emails to reference services they will know that you often use.
For reference, the journal post for using AWS account IDs for role enumeration will be found here and the journal post for using AWS account IDs for user enumeration will be found here.
During engagements at rhino, we find that phishing is one in all the fastest ways for us to achieve access to an AWS environment.

- (Exam Topic 1)
A large mobile telephony and data network operator has a data center that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems.
What is the best security policy concerning this setup?

1. A. Network elements must be hardened with user ids and strong password
2. B. Regular security tests and audits should be performed.
3. C. As long as the physical access to the network elements is restricted, there is no need for additional measures.
4. D. There is no need for specific security measures on the network elements as long as firewalls and IPS systems exist.
5. E. The operator knows that attacks and down time are inevitable and should have a backup site.

Correct Answer: A

- (Exam Topic 2)
Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security breach to his company's email server based on analysis of a suspicious connection from the email server to an unknown IP Address.
What is the first thing that Nedved needs to do before contacting the incident response team?

1. A. Leave it as it Is and contact the incident response te3m right away
2. B. Block the connection to the suspicious IP Address from the firewall
3. C. Disconnect the email server from the network
4. D. Migrate the connection to the backup email server

Correct Answer: C

- (Exam Topic 2)
The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the firewall configuration, you notice a recently implemented rule but cannot locate manager approval for it. What would be a good step to have in the procedures for a situation like this?

1. A. Have the network team document the reason why the rule was implemented without prior manager approval.
2. B. Monitor all traffic using the firewall rule until a manager can approve it.
3. C. Do not roll back the firewall rule as the business may be relying upon it, but try to get manager approval as soon as possible.
4. D. Immediately roll back the firewall rule until a manager can approve it

Correct Answer: D

- (Exam Topic 3)
BitLocker encryption has been implemented for all the Windows-based computers in an organization. You are concerned that someone might lose their cryptographic key. Therefore, a mechanism was implemented to recover the keys from Active Directory. What is this mechanism called in cryptography?

1. A. Key archival
2. B. Key escrow.
3. C. Certificate rollover
4. D. Key renewal

Correct Answer: B