[2026年03月24日]312-50v13テスト準備できるトレーニング練習テスト試験問題 [Q38-Q58]

[2026年03月24日]312-50v13テスト準備できるトレーニング練習テスト試験問題

試験問題解答ブレーン問題集で312-50v13試験問題集PDFを使おう

質問 # 38
in this form of encryption algorithm, every Individual block contains 64-bit data, and three keys are used, where each key consists of 56 bits. Which is this encryption algorithm?

• A. Triple Data Encryption standard
• B. AES
• C. IDEA
• D. MDS encryption algorithm

正解：A

解説：
Triple DES is another mode of DES operation. It takes three 64-bit keys, for an overall key length of 192 bits.
In Stealth, you merely type within the entire 192-bit (24 character) key instead of entering each of the three keys individually. The Triple DES DLL then breaks the user-provided key into three subkeys, padding the keys if necessary in order that they are each 64 bits long. The procedure for encryption is strictly an equivalent as regular DES, but it's repeated 3 times , hence the name Triple DES. the info is encrypted with the primary key, decrypted with the second key, and eventually encrypted again with the third key.Triple DES runs 3 times slower than DES, but is far safer if used properly. The procedure for decrypting something is that the same because the procedure for encryption, except it's executed in reverse. Like DES, data is encrypted and decrypted in 64-bit chunks. Although the input key for DES is 64 bits long, the particular key employed by DES is merely 56 bits long . the smallest amount significant (right-most) bit in each byte may be a parity , and will be set in order that there are always an odd number of 1s in every byte. These parity bits are ignored, so only the seven most vital bits of every byte are used, leading to a key length of 56 bits. this suggests that the effective key strength for Triple DES is really 168 bits because each of the three keys contains 8 parity bits that aren't used during the encryption process.Triple DES ModesTriple ECB (Electronic Code Book)* This variant of Triple DES works precisely the same way because the ECB mode of DES.* this is often the foremost commonly used mode of operation.Triple CBC (Cipher Block Chaining)* This method is extremely almost like the quality DES CBC mode.* like Triple ECB, the effective key length is 168 bits and keys are utilized in an equivalent manner, as described above, but the chaining features of CBC mode also are employed.* the primary 64-bit key acts because the Initialization Vector to DES.* Triple ECB is then executed for one 64-bit block of plaintext.* The resulting ciphertext is then XORed with subsequent plaintext block to be encrypted, and therefore the procedure is repeated.* This method adds an additional layer of security to Triple DES and is therefore safer than Triple ECB, although it's not used as widely as Triple ECB.

質問 # 39
What does the following command in netcat do?
nc -l -u -p55555 < /etc/passwd

• A. grabs the /etc/passwd file when connected to UDP port 55555
• B. loads the /etc/passwd file to the UDP port 55555
• C. deletes the /etc/passwd file when connected to the UDP port 55555
• D. logs the incoming connections to /etc/passwd file

正解：A

質問 # 40
This form of encryption algorithm is asymmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm?

• A. HMAC encryption algorithm
• B. IDEA
• C. Blowfish encryption algorithm
• D. Twofish encryption algorithm

正解：D

解説：
Twofish is an encryption algorithm designed by Bruce Schneier. It's a symmetric key block cipher with a block size of 128 bits, with keys up to 256 bits. it's associated with AES (Advanced Encryption Standard) and an earlier block cipher called Blowfish. Twofish was actually a finalist to become the industry standard for encryption, but was ultimately beaten out by the present AES.Twofish has some distinctive features that set it aside from most other cryptographic protocols. For one, it uses pre-computed, key-dependent S-boxes. An S- box (substitution-box) may be a basic component of any symmetric key algorithm which performs substitution. within the context of Twofish's block cipher, the S-box works to obscure the connection of the key to the ciphertext. Twofish uses a pre-computed, key-dependent S-box which suggests that the S-box is already provided, but depends on the cipher key to decrypt the knowledge .
How Secure is Twofish?Twofish is seen as a really secure option as far as encryption protocols go. one among the explanations that it wasn't selected because the advanced encryption standard is thanks to its slower speed. Any encryption standard that uses a 128-bit or higher key, is theoretically safe from brute force attacks. Twofish is during this category.Because Twofish uses "pre-computed key-dependent S-boxes", it are often susceptible to side channel attacks. this is often thanks to the tables being pre-computed. However, making these tables key-dependent helps mitigate that risk. There are a couple of attacks on Twofish, but consistent with its creator, Bruce Schneier, it didn't constitute a real cryptanalysis. These attacks didn't constitue a practical break within the cipher.
Products That Use TwofishGnuPG: GnuPG may be a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also referred to as PGP). GnuPG allows you to encrypt and sign your data and communications; it features a flexible key management system, along side access modules for all types of public key directories.KeePass: KeePass may be a password management tool that generates passwords with top-notch security. It's a free, open source, lightweight and easy-to-use password manager with many extensions and plugins.Password Safe: Password Safe uses one master password to stay all of your passwords protected, almost like the functionality of most of the password managers on this list. It allows you to store all of your passwords during a single password database, or multiple databases for various purposes. Creating a database is straightforward , just create the database, set your master password.PGP (Pretty Good Privacy):
PGP is employed mostly for email encryption, it encrypts the content of the e-mail . However, Pretty Good Privacy doesn't encrypt the topic and sender of the e-mail , so make certain to never put sensitive information in these fields when using PGP.TrueCrypt: TrueCrypt may be a software program that encrypts and protects files on your devices. With TrueCrypt the encryption is transparent to the user and is completed locally at the user's computer. this suggests you'll store a TrueCrypt file on a server and TrueCrypt will encrypt that file before it's sent over the network.

質問 # 41
To determine if a software program properly handles a wide range of invalid input, a form of automated testing can be used to randomly generate invalid input in an attempt to crash the program.
What term is commonly used when referring to this type of testing?

• A. Mutating
• B. Fuzzing
• C. Bounding
• D. Randomizing

正解：B

解説：
This form of testing is known as Fuzzing. Fuzzing (or fuzz testing) is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks.
In the CEH v13 courseware and study guide:
Module 6: Malware Threats
Subsection: Malware Analysis and Reverse Engineering Techniques
CEH v13 Official Study Guide and iLabs Practical
The CEH v13 guide states:
"Fuzzing is used as a software testing technique that involves sending malformed or unexpected inputs to an application in order to detect vulnerabilities such as buffer overflows, crashes, or unexpected behavior. It is particularly useful during vulnerability assessments and exploit development." Thus, Fuzzing helps identify vulnerabilities due to improper input validation and is widely used in vulnerability discovery and exploit testing.
Incorrect Options:
A). Randomizing: Not a recognized security testing method.
B). Bounding: Refers to setting limits or constraints; not relevant here.
C). Mutating: Can be part of fuzzing (mutation-based fuzzing), but not the umbrella term.
Reference:CEH v13 Study Guide - Module 6, Malware Threats, Page on "Fuzz Testing"CEH v13 iLabs - Malware Threats Lab # Section on Vulnerability Discovery Using Fuzzers

質問 # 42
You are a cybersecurity consultant for a global organization. The organization has adopted a Bring Your Own Device (BYOD)policy, but they have recently experienced a phishing incident where an employee's device was compromised. In the investigation, you discovered that the phishing attack occurred through a third-party email app that the employee had installed. Given the need to balance security and user autonomy under the BYOD policy, how should the organization mitigate the risk of such incidents? Moreover, consider a measure that would prevent similar attacks without overly restricting the use of personal devices.

• A. Provide employees with corporate-owned devices for work-related tasks.
• B. Implement a mobile device management solution that restricts the installation of non-approved applications.
• C. Conduct regular cybersecurity awareness training, focusing on phishing attacks.
• D. Require all employee devices to use a company-provided VPN for internet access.

正解：C

解説：
The best measure to prevent similar attacks without overly restricting the use of personal devices is to conduct regular cybersecurity awareness training, focusing on phishing attacks. Cybersecurity awareness training is a process of educating and empowering employees on the best practices and behaviors to protect themselves and the organization from cyber threats, such as phishing, malware, ransomware, or data breaches. Cybersecurity awareness training can help the organization mitigate the risk of phishing incidents by providing the following benefits12:
* It can increase the knowledge and skills of employees on how to identify and avoid phishing emails, messages, or links, such as by checking the sender, the subject, the content, the attachments, and the URL of the message, and by verifying the legitimacy and authenticity of the message before responding or clicking.
* It can enhance the attitude and culture of employees on the importance and responsibility of cybersecurity, such as by encouraging them to report any suspicious or malicious activity, to follow the security policies and guidelines, and to seek help or guidance when in doubt or trouble.
* It can reduce the human error and negligence that are often the main causes of phishing incidents, such as by reminding employees to update their devices and applications, to use strong and unique passwords, to enable multi-factor authentication, and to backup their data regularly.
The other options are not as optimal as option D for the following reasons:
* A. Provide employees with corporate-owned devices for work-related tasks: This option is not feasible because it contradicts the BYOD policy, which allows employees to use their personal devices for work- related tasks. Providing employees with corporate-owned devices would require the organization to incur additional costs and resources, such as purchasing, maintaining, and securing the devices, as well as training and supporting the employees on how to use them. Moreover, providing employees with corporate-owned devices would not necessarily prevent phishing incidents, as the devices could still be compromised by phishing emails, messages, or links, unless the organization implements strict security controls and policies on the devices, which may limit the user autonomy and productivity3.
* B. Implement a mobile device management solution that restricts the installation of non-approved applications: This option is not desirable because it violates the user autonomy and privacy under the BYOD policy, which allows employees to use their personal devices for both personal and professional purposes. Implementing a mobile device management solution that restricts the installation of non- approved applications would require the organization to monitor and control the devices of the employees, which may raise legal and ethical issues, such as data ownership, consent, and compliance. Furthermore, implementing a mobile device management solution that restricts the installation of non-approved applications would not completely prevent phishing incidents, as the employees could still receive phishing emails, messages, or links through the approved applications, unless the organization implements strict security controls and policies on the applications, which may affect the user experience and functionality4.
* C. Require all employee devices to use a company-provided VPN for internet access: This option is not sufficient because it does not address the root cause of phishing incidents, which is the human factor.
Requiring all employee devices to use a company-provided VPN for internet access would provide the organization with some benefits, such as encrypting the network traffic, hiding the IP address, and bypassing geo-restrictions. However, requiring all employee devices to use a company-provided VPN for internet access would not prevent phishing incidents, as the employees could still fall victim to phishing emails, messages, or links that lure them to malicious websites or applications, unless the organization implements strict security controls and policies on the VPN, which may affect the network performance and reliability.
References:
* 1: What is Cybersecurity Awareness Training? | Definition, Benefits & Best Practices | Kaspersky
* 2: How to Prevent Phishing Attacks with Security Awareness Training | Infosec
* 3: BYOD vs. Corporate-Owned Devices: Pros and Cons | Bitglass
* 4: Mobile Device Management (MDM) | OWASP Foundation
* : What is a VPN and why do you need one? Everything you need to know | ZDNet

質問 # 43
Which type of malware spreads from one system to another or from one network to another and causes similar types of damage as viruses do to the infected system?

• A. Rootkit
• B. Adware
• C. Worm
• D. Trojan

正解：C

質問 # 44
Joseph was the Web site administrator for the Mason Insurance in New York, who's main Web site was located at www.masonins.com. Joseph uses his laptop computer regularly to administer the Web site. One night, Joseph received an urgent phone call from his friend, Smith. According to Smith, the main Mason Insurance web site had been vandalized! All of its normal content was removed and replaced with an attacker's message ''Hacker Message: You are dead! Freaks!" From his office, which was directly connected to Mason Insurance's internal network, Joseph surfed to the Web site using his laptop. In his browser, the Web site looked completely intact.
No changes were apparent. Joseph called a friend of his at his home to help troubleshoot the problem. The Web site appeared defaced when his friend visited using his DSL connection. So, while Smith and his friend could see the defaced page, Joseph saw the intact Mason Insurance web site. To help make sense of this problem, Joseph decided to access the Web site using hisdial-up ISP. He disconnected his laptop from the corporate internal network and used his modem to dial up the same ISP used by Smith. After his modem connected, he quickly typed www.masonins.com in his browser to reveal the following web page:

After seeing the defaced Web site, he disconnected his dial-up line, reconnected to the internal network, and used Secure Shell (SSH) to log in directly to the Web server. He ran Tripwire against the entire Web site, and determined that every system file and all the Web content on the server were intact. How did the attacker accomplish this hack?

• A. DNS poisoning
• B. SQL injection
• C. ARP spoofing
• D. Routing table injection

正解：A

質問 # 45
Samuel, a professional hacker, monitored and Intercepted already established traffic between Bob and a host machine to predict Bob's ISN. Using this ISN, Samuel sent spoofed packets with Bob's IP address to the host machine. The host machine responded with <| packet having an Incremented ISN. Consequently. Bob's connection got hung, and Samuel was able to communicate with the host machine on behalf of Bob. What is the type of attack performed by Samuel in the above scenario?

• A. TCP/IP hacking
• B. Blind hijacking
• C. Forbidden attack
• D. UDP hijacking

正解：A

解説：
A TCP/IP hijack is an attack that spoofs a server into thinking it's talking with a sound client, once actually it' s communication with an assaulter that has condemned (or hijacked) the tcp session. Assume that the client has administrator-level privileges, which the attacker needs to steal that authority so as to form a brand new account with root-level access of the server to be used afterward. A tcp Hijacking is sort of a two-phased man- in-the-middle attack. The man-in-the-middle assaulter lurks within the circuit between a shopper and a server so as to work out what port and sequence numbers are being employed for the conversation.
First, the attacker knocks out the client with an attack, like Ping of Death, or ties it up with some reasonably ICMP storm. This renders the client unable to transmit any packets to the server. Then, with the client crashed, the attacker assumes the client's identity so as to talk with the server. By this suggests, the attacker gains administrator-level access to the server.
One of the most effective means of preventing a hijack attack is to want a secret, that's a shared secret between the shopper and also the server. looking on the strength of security desired, the key may be used for random exchanges. this is often once a client and server periodically challenge each other, or it will occur with each exchange, like Kerberos.

質問 # 46
A "Server-Side Includes" attack refers to the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary code remotely.
Which web-page file type, if it exists on the web server, is a strong indication that the server is vulnerable to this kind of attack?

• A. .html
• B. .rss
• C. .stm
• D. .cms

正解：C

解説：
In CEH v13 Module 13: Hacking Web Applications, Server-Side Includes (SSI) is defined as a method for dynamically generating web content through directives embedded in HTML files.
stm File Extension:
Associated with Server Side Includes (SSI).
Files like .stm, .shtml, and .shtm can embed server-side directives.
Vulnerable if user input is improperly handled, allowing command injection or arbitrary file access.
Option Clarification:
A: .stm: Correct - indicates SSI is enabled.
B: .html: Static file, not associated with SSI.
C: .rss: XML feed; irrelevant to SSI.
D: .cms: Generic; doesn't indicate SSI functionality.
Reference:
Module 13 - Server-Side Vulnerabilities
CEH iLabs: Exploiting SSI with .stm files

質問 # 47
Morris, an attacker, wanted to check whether the target AP is in a locked state. He attempted using different utilities to identify WPS-enabled APs in the target wireless network. Ultimately, he succeeded with one special command-line utility. Which of the following command-line utilities allowed Morris to discover the WPS-enabled APs?

• A. macof
• B. wash
• C. ntptrace
• D. net View

正解：B

質問 # 48
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks.
What is the type of threat intelligence collected by Arnold in the above scenario?

• A. Strategic threat intelligence
• B. Technical threat intelligence
• C. Tactical threat intelligence
• D. Operational threat intelligence

正解：D

質問 # 49
SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may Bypass authentication and allow attackers to access and/or modify data attached to a web application.
Which of the following SQLI types leverages a database server's ability to make DNS requests to pass data to an attacker?

• A. Union-based SQLI
• B. ln-band SQLI
• C. Time-based blind SQLI
• D. Out-of-band SQLI

正解：D

解説：
Out-of-band SQL injection occurs when an attacker is unable to use an equivalent channel to launch the attack and gather results. ... Out-of-band SQLi techniques would believe the database server's ability to form DNS or HTTP requests to deliver data to an attacker. Out-of-band SQL injection is not very common, mostly because it depends on features being enabled on the database server being used by the web application. Out- of-band SQL injection occurs when an attacker is unable to use the same channel to launch the attack and gather results.
Out-of-band techniques, offer an attacker an alternative to inferential time-based techniques, especially if the server responses are not very stable (making an inferential time-based attack unreliable).
Out-of-band SQLi techniques would rely on the database server's ability to make DNS or HTTP requests to deliver data to an attacker. Such is the case with Microsoft SQL Server's xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database's UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.

質問 # 50
Session splicing is an IDS evasion technique in which an attacker delivers data in multiple, small sized packets to the target computer, making it very difficult for an IDS to detect the attack signatures. Which tool can be used to perform session splicing attacks?

• A. tcpsplice
• B. Whisker
• C. Burp
• D. Hydra

正解：B

解説：
Many IDS reassemble communication streams; hence, if a packet is not received within a reasonable period, many IDS stop reassembling and handling that stream. If the application under attack keeps a session active for a longer time than that spent by the IDS on reassembling it, the IDS will stop. As a result, any session after the IDS stops reassembling the sessions will be susceptible to malicious data theft by attackers. The IDS will not log any attack attempt after a successful splicing attack. Attackers can use tools such as Nessus for session splicing attacks. Did you know that the EC-Council exam shows how well you know their official book? So, there is no
"Whisker" in it. In the chapter "Evading IDS" -> "Session Splicing", the recommended tool for performing a session-splicing attack is Nessus. Where Wisker came from is not entirely clear, but I will assume the author of the question found it while copying Wikipedia.
https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques One basic technique is to split the attack payload into multiple small packets so that the IDS must reassemble the packet stream to detect the attack. A simple way of splitting packets is by fragmenting them, but an adversary can also simply craft packets with small payloads. The 'whisker' evasion tool calls crafting packets with small payloads 'session splicing'.
By itself, small packets will not evade any IDS that reassembles packet streams. However, small packets can be further modified in order to complicate reassembly and detection. One evasion technique is to pause between sending parts of the attack, hoping that the IDS will time out before the target computer does. A second evasion technique is to send the packets out of order, confusing simple packet re-assemblers but not the target computer.
NOTE: Yes, I found scraps of information about the tool that existed in 2012, but I can not give you unverified information. According to the official tutorials, the correct answer is Nessus, but if you know anything about Wisker, please write in the QA section. Maybe this question will be updated soon, but I'm not sure about that.

質問 # 51
An Intrusion Detection System (IDS) has alerted the network administrator to a possibly malicious sequence of packets sent to a Web server in the network's external DMZ. The packet traffic was captured by the IDS and saved to a PCAP file. What type of network tool can be used to determine if these packets are genuinely malicious or simply a false positive?

• A. Protocol analyzer
• B. Vulnerability scanner
• C. Intrusion Prevention System (IPS)
• D. Network sniffer

正解：A

質問 # 52
Gavin owns a white-hat firm and is performing a website security audit. He begins with a scan looking for misconfigurations and outdated software versions. Which tool is he most likely using?

• A. Metasploit
• B. Armitage
• C. Nikto
• D. Nmap

正解：C

解説：
Comprehensive and Detailed Explanation:
Nikto is an open-source web server scanner that:
* Checks for common vulnerabilities
* Detects outdated software versions
* Flags insecure configurations and files
It is widely used for quick and comprehensive web vulnerability assessments.
From CEH v13 Courseware:
* Module 10: Web Application Hacking # Web Vulnerability Scanning Tools Reference:Nikto Project Page - https://cirt.net/Nikto2

質問 # 53
A company's security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

• A. Attempts by attackers to access password stored on the user's computer without the user's knowledge.
• B. Attempts by attackers to access the user and password information stored in the company's SQL database.
• C. Attempts by attackers to access Web sites that trust the Web browser user by stealing the user's authentication credentials.
• D. Attempts by attackers to determine the user's Web browser usage patterns, including when sites were visited and for how long.

正解：C

質問 # 54
During an Xmas scan, what indicates a port is closed?

• A. RST
• B. No return response
• C. ACK
• D. SYN

正解：A

解説：
Comprehensive and Detailed Explanation:
An Xmas scan is a type of stealth TCP scan that sets the FIN, PSH, and URG flags. According to RFC 793:
* If the port is closed, the target responds with a TCP RST (Reset) packet.
* If the port is open or filtered, there is no response.
Thus, receiving a RST response indicates a closed port.
From CEH v13 Courseware:
* Module 3: Scanning Networks # TCP Flag Scanning Techniques
Reference:CEH v13 Study Guide - Module 3: Xmas, Null, and FIN ScansRFC 793 - Transmission Control Protocol Specification

質問 # 55
Yancey is a network security administrator for a large electric company. This company provides power for over 100, 000 people in Las Vegas. Yancey has worked for his company for over 15 years and has become very successful. One day, Yancey comes in to work and finds out that the company will be downsizing and he will be out of a job in two weeks. Yancey is very angry and decides to place logic bombs, viruses, Trojans, and backdoors all over the network to take down the company once he has left. Yancey does not care if his actions land him in jail for 30 or more years, he just wants the company to pay for what they are doing to him.
What would Yancey be considered?

• A. Since he does not care about going to jail, he would be considered a Black Hat
• B. Yancey would be considered a Suicide Hacker
• C. Because Yancey works for the company currently; he would be a White Hat
• D. Yancey is a Hacktivist Hacker since he is standing up to a company that is downsizing

正解：B

質問 # 56
Which of the following allows attackers to draw a map or outline the target organization's network infrastructure to know about the actual environment that they are going to hack.

• A. Enumeration
• B. Scanning networks
• C. Malware analysis
• D. Vulnerability analysis

正解：B

解説：
Objectives of Footprinting Draw Network Map - Combining footprinting techniques with tools such as Tracert allows the attacker to create diagrammatic representations of the target organization's network presence. Specficially, it allows attackers to draw a map or outline of the target organization's network infrastructure to know about the actual environment that they are going to break into. These network diagrams can guide the attacker in performing an attack. (P.114/98)

質問 # 57
You are a cybersecurity specialist at CloudTech Inc., a company providing cloud-based services. You are managing a project for a client who wants to migrate their sensitive data to a public cloud service. To comply with regulatory requirements, the client insists on maintaining full control over the encryption keys even when the data is at rest on the cloud. Which of the following practices should you implement to meet this requirement?

• A. Rely on Secure Sockets Layer (SSL) encryption for data at rest.
• B. Use the cloud service provider's default encryption and key management services.
• C. Use the cloud service provider's encryption services but store keys on-premises.
• D. Encrypt data client-side before uploading to the cloud and retain control of the encryption keys.

正解：D

解説：
The best practice to meet the client's requirement is to encrypt data client-side before uploading to the cloud and retain control of the encryption keys. This practice is also known as client-side encryption or end-to-end encryption, and it involves encrypting the data on the client's device using a software or hardware tool that generates and manages the encryption keys. The encrypted data is then uploaded to the cloud service, where it remains encrypted at rest. The encryption keys are never shared with the cloud service provider or any third party, and they are only used by the client to decrypt the data when needed. This way, the client can maintain full control over the encryption keys and the security of the data, even when the data is stored on a public cloud service12.
The other options are not as optimal as option D for the following reasons:
* A. Use the cloud service provider's encryption services but store keys on-premises: This option is not feasible because it contradicts the client's requirement of maintaining full control over the encryption keys. Using the cloud service provider's encryption services means that the client has to rely on the cloud service provider to generate and manage the encryption keys, even if the keys are stored on- premises. The cloud service provider may have access to the keys or the ability to decrypt the data, which may compromise the security and privacy of the data. Moreover, storing the keys on-premises may introduce additional challenges, such as key distribution, synchronization, backup, and recovery3.
* B. Use the cloud service provider's default encryption and key management services: This option is not desirable because it violates the client's requirement of maintaining full control over the encryption keys. Using the cloud service provider's default encryption and key management services means that the client has to trust the cloud service provider to encrypt and decrypt the data on the server-side, using the cloud service provider's own encryption keys and mechanisms. The cloud service provider may have access to the keys or the ability to decrypt the data, which may compromise the security and privacy of the data. Furthermore, the cloud service provider's default encryption and key management services may not meet the regulatory requirements or the security standards of the client4.
* C. Rely on Secure Sockets Layer (SSL) encryption for data at rest: This option is not sufficient because SSL encryption is not designed for data at rest, but for data in transit. SSL encryption is a protocol that encrypts the data as it travels over the internet between the client and the server, using certificates and keys that are exchanged and verified by both parties. SSL encryption can protect the data from being intercepted or modified by unauthorized parties, but it does not protect the data from being accessed or decrypted by the cloud service provider or any third party who has access to the server. Moreover, SSL encryption does not provide the client with any control over the encryption keys or the security of the data.
References:
* 1: Client-side encryption - Wikipedia
* 2: What is Client-Side Encryption? | Definition, Benefits & Best Practices | Kaspersky
* 3: Cloud Encryption Key Management: What You Need to Know | Thales
* 4: Cloud Encryption: How It Works and How to Use It | Comparitech
* : What is SSL Encryption and How Does it Work? | Norton

質問 # 58
......

無料ダウンロードECCouncil 312-50v13リアルな試験問題で合格しよう：https://www.goshiken.com/ECCouncil/312-50v13-mondaishu.html

312-50v13試験問題集、312-50v13練習テスト問題：https://drive.google.com/open?id=1YuZjkcNY9vgH6iujm6qPk17NgOCRP0Xj