EC-COUNCIL 412-79V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79V10 Online Questions & Answers

• Question 121:

  Which of the following is not a condition specified by Hamel and Prahalad (1990)?

  A. Core competency should be aimed at protecting company interests
  B. Core competency is hard for competitors to imitate
  C. Core competency provides customer benefits
  D. Core competency can be leveraged widely to many products and markets
  A. Core competency should be aimed at protecting company interests

• Question 122:

  Choose the correct option to define the Prefix Length.

  

  A. Prefix Length = Subnet + Host portions
  B. Prefix Length = Network + Host portions
  C. Prefix Length = Network + Subnet portions
  D. Prefix Length = Network + Subnet + Host portions
  C. Prefix Length = Network + Subnet portions

• Question 123:

  Why is a legal agreement important to have before launching a penetration test?

  

  A. Guarantees your consultant fees
  B. Allows you to perform a penetration test without the knowledge and consent of the organization's upper management
  C. It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.
  D. It is important to ensure that the target organization has implemented mandatory security policies
  C. It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.

• Question 124:

  Which of the following is a framework of open standards developed by the Internet Engineering Task Force (IETF) that provides secure transmission of the sensitive data over an unprotected medium, such as the Internet?

  A. DNSSEC
  B. Netsec
  C. IKE
  D. IPsec
  D. IPsec

• Question 125:

  Fuzz testing or fuzzing is a software/application testing technique used to discover coding errors and security loopholes in software, operating systems, or networks by inputting massive amounts of random data, called fuzz, to the system in

  an attempt to make it crash. Fuzzers work best for problems that can cause a program to crash, such as buffer overflow, cross-site scripting, denial of service attacks, format bugs, and SQL injection.

  Fuzzer helps to generate and submit a large number of inputs supplied to the application for testing it against the inputs. This will help us to identify the SQL inputs that generate malicious output.

  Suppose a pen tester knows the underlying structure of the database used by the application (i.e., name, number of columns, etc.) that she is testing.

  Which of the following fuzz testing she will perform where she can supply specific data to the application to discover vulnerabilities?

  A. Clever Fuzz Testing
  B. Dumb Fuzz Testing
  C. Complete Fuzz Testing
  D. Smart Fuzz Testing
  D. Smart Fuzz Testing

• Question 126:

  Port numbers are used to keep track of different conversations crossing the network at the same time. Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers have the assigned ranges. The port numbers above 1024 are considered as which one of the following? (Select all that apply)

  A. Well-known port numbers
  B. Dynamically assigned port numbers
  C. Unregistered port numbers
  D. Statically assigned port numbers
  B. Dynamically assigned port numbers

• Question 127:

  If a web application sends HTTP cookies as its method for transmitting session tokens, it may be vulnerable which of the following attacks?

  A. Parameter tampering Attack
  B. Sql injection attack
  C. Session Hijacking
  D. Cross-site request attack
  D. Cross-site request attack

• Question 128:

  The IP protocol was designed for use on a wide variety of transmission links. Although the maximum length of an IP datagram is 64K, most transmission links enforce a smaller maximum packet length limit, called a MTU.

  The value of the MTU depends on the type of the transmission link. The design of IP accommodates MTU differences by allowing routers to fragment IP datagrams as necessary. The receiving station is responsible for reassembling the fragments back into the original full size IP datagram.

  IP fragmentation involves breaking a datagram into a number of pieces that can be reassembled later. The IP source, destination, identification, total length, and fragment offset fields in the IP header, are used for IP fragmentation and reassembly.

  

  The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a:

  A. Multiple of four bytes
  B. Multiple of two bytes
  C. Multiple of eight bytes
  D. Multiple of six bytes
  C. Multiple of eight bytes

• Question 129:

  During the process of fingerprinting a web application environment, what do you need to do in order to analyze HTTP and HTTPS request headers and the HTML source code?

  A. Examine Source of the Available Pages
  B. Perform Web Spidering
  C. Perform Banner Grabbing
  D. Check the HTTP and HTML Processing by the Browser
  D. Check the HTTP and HTML Processing by the Browser

• Question 130:

  Which of the following approaches to vulnerability assessment relies on the administrator providing baseline of system configuration and then scanning continuously without incorporating any information found at the time of scanning?

  

  A. Service-based Assessment Solutions
  B. Product-based Assessment Solutions
  C. Tree-based Assessment
  D. Inference-based Assessment
  C. Tree-based Assessment