Free 312-50V12 Practice Test Questions and Answers (2026) Practice Questions

The Advanced Persistent Threat (APT) lifecycle describes the stages of a sophisticated, long-term attack. The phase where an attacker successfully breaches the network perimeter and establishes a foothold is known as "Initial Intrusion" or "Initial Compromise." Harry's actions of using spear-phishing and exploiting vulnerabilities to deploy malware and establish an outbound connection are the classic execution of this phase. He has moved beyond planning and is actively gaining access to the target environment for the first time.

A. The Preparation phase involves reconnaissance and weaponization, which occurs before the attack is launched. Harry is actively launching the attack and gaining entry.

B. Cleanup is the final phase, where the attacker removes evidence of their presence. This happens much later in the attack lifecycle.

C. Persistence is the phase after initial intrusion, where the attacker ensures they maintain long-term access to the compromised network, which is not yet described.

1. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation. (This paper, which defines the "Cyber Kill Chain," identifies "Delivery" and "Exploitation" as the steps for initial intrusion, matching the scenario).

2. The MITRE Corporation. (2023). MITRE ATT&CK - Initial Access. Retrieved from https://attack.mitre.org/tactics/TA0001/ (The "Initial Access" tactic consists of techniques used to get an initial foothold within a network, including "Phishing: Spearphishing Attachment" and "Exploit Public-Facing Application").

3. National Institute of Standards and Technology. (2021). Cybersecurity Framework Profile for Ransomware Risk Management (NISTIR 8374). Section 2.2.1, "Initial Access," describes this phase as how adversaries get into the network, citing phishing and exploitation of public-facing applications.

Gray-box testing is a software and security testing methodology that combines elements of both white-box and black-box testing. In this approach, the tester has limited or partial knowledge of the internal structure, architecture, or code of the system under test. For example, the tester might have access to design documents, database schemas, or understand the algorithms being used, but they do not have access to the complete source code. This partial knowledge allows them to design more focused and efficient test cases than in black-box testing, without the full bias of a developer as in white-box testing.

A. Only the external operation of a system is accessible to the tester: This defines black-box testing, where the internal workings are completely unknown.

C. Only the internal operation of a system is known to the tester: This is an illogical premise and does not align with any standard testing methodology.

D. The internal operation of a system is completely known to thetester: This defines white-box testing, where the tester has full access to source code and internal logic.

1. National Institute of Standards and Technology (NIST). (2008). SP 800-115: Technical Guide to Information Security Testing and Assessment. Section 5.3, "Assessment Methodologies," describes gray box testing as a scenario where "the testing team has some knowledge of the target system, but not the extensive knowledge of a system developer."

2. Badresia, A., & Gupta, P. (2012). A Review on Gray Box Testing Approach. International Journal of Engineering Research & Technology (IJERT), 1(5). The paper defines gray-box testing as having "partial knowledge of the internal structure." DOI: 10.17577/IJERTV1IS5189

3. Ammann, P., & Offutt, J. (2016). Introduction to Software Testing (2nd ed.). Cambridge University Press. Chapter 1, Section 1.4, "Testing & Verification," distinguishes between black-box (no knowledge), white-box (full knowledge), and gray-box (some knowledge) testing criteria.

The TCP three-way handshake is the process used to establish a connection between a client and a server. The process begins when the client sends a TCP segment with the Synchronize (SYN) flag set to the server. This initial packet acts as a request to open a connection and synchronizes the sequence numbers between the two devices. The server then responds, and the client acknowledges, completing the handshake.

A. ACK: The Acknowledge (ACK) message is sent by the client in the third and final step of the handshake, not the first.

C. RST: The Reset (RST) flag is used to immediately terminate a connection, not to establish one.

D. SYN-ACK: The Synchronize-Acknowledge (SYN-ACK) message is sent by the server in response to the client's initial SYN packet.

1. Postel, J. (1981). RFC 793: Transmission Control Protocol. Internet Engineering Task Force (IETF). Section 3.3, "Sequence Numbers," and Figure 6, "Basic 3-Way Handshake for Connection Synchronization."

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 3, Section 3.5.2, "Connection-oriented transport: TCP," describes the three-way handshake, stating the client sends a special TCP segment containing no application-layer data but with the SYN bit in the header set to 1.

Open-source intelligence (OSINT) is the term for intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement. The sources are "overt," meaning they are not secret or classified, and can include news, social media, public records, and academic papers. It is a foundational activity in cybersecurity for understanding threat actors, vulnerabilities, and potential targets.

B. Real intelligence

This is a colloquial and non-standard term; it is not a formal classification of intelligence gathering.

C. Social intelligence

This is a subset of OSINT that focuses specifically on information gathered from social media and human social interactions.

D. Human intelligence

Human intelligence (HUMINT) is derived from human sources through methods like interviews and espionage, which are not necessarily "publicly available."

- NIST Special Publication 800-150, "Guide to Cyber Threat Information Sharing," Section 2.3.1, identifies open-source intelligence (OSINT) as a key source of threat information derived from publicly available data.

- The U.S. Director of National Intelligence, Intelligence Community Directive (ICD) 203, "Analytic Standards," defines open-source intelligence as being derived from publicly and commercially available information.

The Presentation Layer (Layer 6) of the OSI model is responsible for the formatting and translation of data, which includes encryption and decryption. When Public Key Infrastructure (PKI) is used to secure an email, this layer handles the cryptographic processes (like with S/MIME) to transform the application data into a secure, encrypted format before transmission and reverses the process upon receipt. The application layer initiates the request, but the presentation layer performs the function.

A. Application: The application layer (e.g., an email client) uses encryption services but does not perform the actual data transformation itself; that is the role of the presentation layer.

B. Transport: The transport layer is responsible for end-to-end data transfer and flow control (e.g., TCP/UDP), not for data encryption in this context.

C. Session: The session layer manages the dialogue between computers, establishing and terminating connections, but it does not handle the encryption of message content.

- International Telecommunication Union. (1994). Recommendation ITU-T X.200: Information technology - Open Systems Interconnection - Basic Reference Model: The Basic Model. Section 7.2.3.2, "Presentation-services," describes the function of transforming data, including the use of encryption.

- Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 1, Section 1.7.1, "The OSI Model," describes the Presentation Layer's role in data encryption.

In DNS Mail Exchanger (MX) records, the priority is determined by a preference number. Contrary to the statement, a lower preference number indicates a higher priority. Mail Transfer Agents (MTAs) attempting to deliver email to a domain will try the mail server with the lowest preference number first. If that server is unavailable, they will proceed to the server with the next lowest number, and so on. Therefore, priority increases as the number decreases.

True: This is incorrect. A higher number in an MX record signifies a lower priority, making it a backup mail server.

- Klensin, J. (2008). RFC 5321: Simple Mail Transfer Protocol. IETF. Section 5.1, "Locating the Target Host," states, "The MX RRs contain a preference value that indicates the order in which to try the hosts... The lower the number, the higher the preference."

- Partridge, C. (1986). RFC 974: Mail Routing and the Domain System. IETF. This earlier RFC established the principle that lower preference values are tried first.

- Liu, C., & Albitz, P. (2006). DNS and BIND (5th ed.). O'Reilly Media. Chapter 5, "DNS and Electronic Mail," provides a detailed explanation and examples of MX record preference values. (Note: While a commercial publisher, this text is considered a foundational academic and professional reference in the field).

Cryptographic hash functions are, by design, one-way functions. This means that it is computationally infeasible to reverse the process—that is, to derive the original input (the password) from its output (the hash). Password cracking programs do not reverse the hash. Instead, they work by taking a candidate password (a guess), applying the same hashing algorithm to it, and comparing the resulting hash with the target hash. If the hashes match, the guessed password is correct. This process is repeated with many guesses.

True: This option is incorrect because it misrepresents how both hashing algorithms and password cracking tools function. Reversing a secure hash is considered computationally impossible.

- National Institute of Standards and Technology (NIST). (2015). FIPS PUB 180-4, Secure Hash Standard (SHS). Section 4, "Properties of Secure Hash Algorithms," describes the one-way (preimage resistance) property, which makes it infeasible to find the message from the hash.

- Katz, J., & Lindell, Y. (2014). Introduction to Modern Cryptography (2nd ed.). CRC Press. Chapter 5, "Hash Functions and Applications," formally defines the preimage resistance property of cryptographic hash functions.

- Paar, C., & Pelzl, J. (2010). Understanding Cryptography: A Textbook for Students and Practitioners. Springer. Chapter 11, "Hash Functions," explains that a core security property is preimage resistance, preventing reversal.

The attacker's goals are high disruption, resource exhaustion, identity concealment, and resistance to simple IP blocking. A SYN flood attack perfectly aligns with these objectives. It exhausts server resources by consuming entries in the connection state table, leaving the server unable to accept new legitimate connections. When launched from a well-resourced botnet (as implied), the attack originates from thousands of different, often spoofed, IP addresses. This distribution makes the attacker's identity difficult to trace and renders simple IP-based blocking ineffective, as there are too many sources to block individually.

B. An ICMP flood from a single IP is trivial to defend against by blocking the single source IP address, failing the concealment and resistance requirements.

C. A Pulse Wave attack is a traffic delivery strategy, not a specific attack type. While effective, a SYN flood is a more precise answer describing the protocol-level mechanism for resource exhaustion.

D. A volumetric attack from a single machine is not "well-resourced" in the context of modern DDoS and is easily mitigated by blocking the single source.

1. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-95: Guide to Secure Web Services. Section 4.2.1, "Denial of Service," describes SYN flooding as a common DoS attack that consumes server resources.

2. Douligeris, C., & Mitrokotsa, A. (2004). DDoS attacks and defense mechanisms: classification and state-of-the-art. Computer Networks, 44(5), 643-666. Section 3.1.1, "TCP SYN Attack," details how the attack exhausts memory by leaving half-open connections, and its distributed nature makes it hard to trace. (https://doi.org/10.1016/j.comnet.2003.10.003)

3. CERT Coordination Center. (1996). IP Spoofing Attacks and Hijacked Terminal Connections. Carnegie Mellon University. CA-1996-21. This advisory provides an early, foundational description of SYN flooding attacks using spoofed source IP addresses.

The mechanism for DNS zone replication is governed by the Start of Authority (SOA) record's serial number. The secondary server periodically polls the primary server, checking its SOA record. If the serial number on the primary server's SOA record is arithmetically higher than the serial number on the secondary server's cached SOA record, it signifies that the zone file has been updated. This condition triggers the secondary server to initiate a zone transfer request (AXFR or IXFR) to synchronize its records with the more recent data from the primary server.

B. If the secondary SOA is higher, it indicates a misconfiguration or that the secondary is somehow ahead, which is an error state.

C. A service restart on the primary server does not, by itself, trigger a transfer; the SOA serial number must have been incremented first.

D. A secondary server restart will cause it to check the primary's SOA, but a transfer only occurs if the primary's serial number is higher.

E. The SOA record contains refresh, retry, and expire timers, not a single TTL that triggers a transfer upon reaching zero.

1. Mockapetris, P. (1987). RFC 1034: Domain Names - Concepts and Facilities. IETF. (Section 4.3.5, "Replication," describes the role of the SOA serial number in prompting zone transfers).

2. Mockapetris, P. (1987). RFC 1035: Domain Names - Implementation and Specification. IETF. (Section 5.2.2, "SOA RDATA format," defines the SERIAL field as the version number of the zone).

3. Comer, D. E. (2018). Internetworking with TCP/IP Volume 1: Principles, Protocols, and Architecture (6th ed.). Pearson. (Chapter 26, "The Domain Name System," explains the master-slave replication model based on the SOA serial number).

The command net use \\target\ipc$ "" /u:"" is used to establish a null session with a target Windows machine. The net use command connects to a network resource. ipc$ is the Inter-Process Communication share, a hidden administrative share. The parameters /u:"" (blank username) and "" (blank password) specify an anonymous logon attempt. A successful connection creates a null session, which can be used by an attacker for enumeration of system information like users, shares, and policies.

A. The etc/passwd file is specific to Linux/Unix systems; net use is a Windows command for connecting to network shares.

B. This command only establishes the connection; it does not directly grab the SAM (Security Account Manager) file, although it can be a preliminary step.

C. While net use can connect to Samba shares, the specific syntax with a blank user/pass to IPC$ is the classic signature for a Windows null session attempt.

E. This command is for connecting to Windows SMB/CIFS shares and is not used for enumerating Cisco routers, which use different protocols (e.g., SNMP).

1. Microsoft. (2023). Net use. Microsoft Learn Documentation. This official documentation details the syntax for the net use command, showing how /user is used to specify credentials for the connection.

2. SANS Institute. (2002). Windows Null Session. SANS Reading Room. This paper details the mechanism of a null session, stating, "The connection is made by connecting to the IPC$ share on the remote machine... using a null username and password." It explicitly mentions the net use \\ip\ipc$ "" /u:"" command.

3. Georgia Institute of Technology. (n.d.). CS 6265: Information Security Lab - Lab 1: System and Network Reconnaissance. Course materials for this lab often include exercises on Windows enumeration, demonstrating the use of the net use command to establish a null session for reconnaissance purposes.