EC-COUNCIL ECSA 412-79V10 Questions & Answers

• Question 151:

  Which type of vulnerability assessment tool provides security to the IT system by testing for vulnerabilities in the applications and operation system?

  A. Active/Passive Tools

  B. Application-layer Vulnerability Assessment Tools

  C. Location/Data Examined Tools

  D. Scope Assessment Tools

  Correct Answer: D

  Reference: http://books.google.com.pk/books?id=7dwEAAAAQBAJandpg=SA7- PA11andlpg=SA7PA11anddq=vulnerability+assessment+tool+provides+security+to+the+IT+system+by+testing +for +vulnerabilities+in+the+applications+and+operation+systemandsource=blandots=SQCLHR nnjIandsig=HpenOheCU4GBOnkA4EurHCMfND4andhl=enandsa=Xandei=DqYfVJCLHMTnyQODn 4C4Cwandved=0CDQQ6AEwAw#v=onepageandq=vulnerability%20assessment%20tool%20pr ovides% 20security%20to%20the%20IT%20system%20by%20testing%20for%20vulnerabili ties%20in%20the% 20applications%20and%20operation%20systemandf=false

• Question 152:

  Hackers today have an ever-increasing list of weaknesses in the web application structure at their

  disposal, which they can exploit to accomplish a wide variety of malicious tasks.

  

  New flaws in web application security measures are constantly being researched, both by hackers and by security professionals. Most of these flaws affect all dynamic web applications whilst others are dependent on specific application technologies. In both cases, one may observe how the evolution and refinement of web technologies also brings about new exploits which compromise sensitive databases, provide access to theoretically secure networks, and pose a threat to the daily operation of online businesses.

  What is the biggest threat to Web 2.0 technologies?

  A. SQL Injection Attacks

  B. Service Level Configuration Attacks

  C. Inside Attacks

  D. URL Tampering Attacks

  Correct Answer: A

• Question 153:

  A framework is a fundamental structure used to support and resolve complex issues. The framework that delivers an efficient set of technologies in order to develop applications which are more secure in using Internet and Intranet is:

  A. Microsoft Internet Security Framework

  B. Information System Security Assessment Framework (ISSAF)

  C. Bell Labs Network Security Framework

  D. The IBM Security Framework

  Correct Answer: A

• Question 154:

  In the context of penetration testing, what does blue teaming mean?

  

  A. A penetration test performed with the knowledge and consent of the organization's IT staff

  B. It is the most expensive and most widely used

  C. It may be conducted with or without warning

  D. A penetration test performed without the knowledge of the organization's IT staff but with permission from upper management

  Correct Answer: A

  Reference: https://www.sypriselectronics.com/information-security/cyber-security- solutions/computernetwork-defense/

• Question 155:

  Fuzz testing or fuzzing is a software/application testing technique used to discover coding errors and security loopholes in software, operating systems, or networks by inputting massive amounts of random data, called fuzz, to the system in an attempt to make it crash. Fuzzers work best for problems that can cause a program to crash, such as buffer overflow, cross-site scripting, denial of service attacks, format bugs, and SQL injection.

  Fuzzer helps to generate and submit a large number of inputs supplied to the application for testing it against the inputs. This will help us to identify the SQL inputs that generate malicious output.

  Suppose a pen tester knows the underlying structure of the database used by the application (i.e., name, number of columns, etc.) that she is testing.

  Which of the following fuzz testing she will perform where she can supply specific data to the application to discover vulnerabilities?

  A. Clever Fuzz Testing

  B. Dumb Fuzz Testing

  C. Complete Fuzz Testing

  D. Smart Fuzz Testing

  Correct Answer: D

• Question 156:

  Which one of the following log analysis tools is a Cisco Router Log Format log analyzer and it parses logs, imports them into a SQL database (or its own built-in database), aggregates them, and generates the dynamically filtered reports, all through a web interface?

  A. Event Log Tracker

  B. Sawmill

  C. Syslog Manager

  D. Event Log Explorer

  Correct Answer: B

• Question 157:

  In which of the following firewalls are the incoming or outgoing packets blocked from accessing services for which there is no proxy?

  A. Circuit level firewalls

  B. Packet filters firewalls

  C. Stateful multilayer inspection firewalls

  D. Application level firewalls

  Correct Answer: D

  Reference: http://www.vicomsoft.com/learning-center/firewalls/

• Question 158:

  Which vulnerability assessment phase describes the scope of the assessment, identifies and ranks the critical assets, and creates proper information protection procedures such as effective planning, scheduling, coordination, and logistics?

  A. Threat-Assessment Phase

  B. Pre-Assessment Phase

  C. Assessment Phase

  D. Post-Assessment Phase

  Correct Answer: B

• Question 159:

  Identify the attack represented in the diagram below:

  

  A. Input Validation

  B. Session Hijacking

  C. SQL Injection

  D. Denial-of-Service

  Correct Answer: B

  Reference: http://en.wikipedia.org/wiki/Session_hijacking

• Question 160:

  The IP protocol was designed for use on a wide variety of transmission links. Although the maximum length of an IP datagram is 64K, most transmission links enforce a smaller maximum packet length limit, called a MTU.

  The value of the MTU depends on the type of the transmission link. The design of IP accommodates MTU differences by allowing routers to fragment IP datagrams as necessary. The receiving station is responsible for reassembling the fragments back into the original full size IP datagram.

  IP fragmentation involves breaking a datagram into a number of pieces that can be reassembled later. The IP source, destination, identification, total length, and fragment offset fields in the IP header, are used for IP fragmentation and reassembly.

  

  The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a:

  A. Multiple of four bytes

  B. Multiple of two bytes

  C. Multiple of eight bytes

  D. Multiple of six bytes

  Correct Answer: C

  Reference: http://www.freesoft.org/CIE/Course/Section3/7.htm (fragment offset: 13 bits)