412-79 Exam Details

  • Exam Code
    :412-79
  • Exam Name
    :EC-Council Certified Security Analyst (ECSA)
  • Certification
    :EC-COUNCIL Certifications
  • Vendor
    :EC-COUNCIL
  • Total Questions
    :232 Q&As
  • Last Updated
    :Jul 10, 2026

EC-COUNCIL 412-79 Online Questions & Answers

  • Question 201:

    What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

    A. mcopy
    B. image
    C. MD5
    D. dd

  • Question 202:

    When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

    A. A Capital X
    B. A Blank Space
    C. The Underscore Symbol
    D. The lowercase Greek Letter Sigma (s)

  • Question 203:

    Paula works as the primary help desk contact for her company.Paula has just received a call from a user reporting that his computer just displayed a Blue Screen of Death screen and he can no longer work.Paula walks over to the user s computer and sees the Blue Screen of Death screen.The user s computer is running Windows XP, but the Blue Screen looks like a familiar one that Paula had seen on Windows 2000 computers periodically. The user said he stepped away from his computer for only 15 minutes and when he got back, the Blue Screen was there.Paula also noticed that the hard drive activity light was flashing, meaning that the computer was processing something.Paula knew this should not be the case since the computer should be completely frozen during a Blue Screen. She checks the network IDS live log entries and notices numerous nmap scan alerts.

    What is Paula seeing happen on this computer?

    A. Paula s network was scanned using Floppyscan
    B. There was IRQ conflict in Paula s PC
    C. Paula s network was scanned using Dumpsec
    D. Tools like Nessus will cause BSOD

  • Question 204:

    On Linux/Unix based Web servers, what privilege should the daemon service be run under?

    A. You cannot determine what privilege runs the daemon service
    B. Guest
    C. Root
    D. Something other than root

  • Question 205:

    During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complain with Police?

    A. Yes, and all evidence can be turned over to the police
    B. Yes, but only if you turn the evidence over to a federal law enforcement agency
    C. No, because the investigation was conducted without following standard police procedures
    D. No, because the investigation was conducted without warrant

  • Question 206:

    Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?

    A. Enumerate all the users in the domain
    B. Perform DNS poisoning
    C. Send DOS commands to crash the DNS servers
    D. Perform a zone transfer

  • Question 207:

    Printing under a Windows Computer normally requires which one of the following files types to be created?

    A. EME
    B. MEM
    C. EMF
    D. CME

  • Question 208:

    Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

    A. Windows computers will not respond to idle scans
    B. Linux/Unix computers are constantly talking
    C. Linux/Unix computers are easier to compromise
    D. Windows computers are constantly talking

  • Question 209:

    When monitoring for both intrusion and security events between multiple computers, it is essential that the computers clocks are synchronize D. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

    A. Universal Time Set
    B. Network Time Protocol
    C. SyncTime Service
    D. Time-Sync Protocol

  • Question 210:

    George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity.

    George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

    A. net port 22
    B. udp port 22 and host 172.16.28.1/24
    C. src port 22 and dst port 22
    D. src port 23 and dst port 23

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only EC-COUNCIL exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your 412-79 exam preparations and EC-COUNCIL certification application, do not hesitate to visit our Vcedump.com to find your solutions here.