EC-COUNCIL 412-79V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79V10 Online Questions & Answers

• Question 181:

  HTTP protocol specifies that arbitrary binary characters can be passed within the URL by using %xx notation, where 'xx' is the

  A. ASCII value of the character
  B. Binary value of the character
  C. Decimal value of the character
  D. Hex value of the character
  D. Hex value of the character

• Question 182:

  ARP spoofing is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

  ARP spoofing attack is used as an opening for other attacks.

  

  What type of attack would you launch after successfully deploying ARP spoofing?

  A. Parameter Filtering
  B. Social Engineering
  C. Input Validation
  D. Session Hijacking
  D. Session Hijacking

• Question 183:

  What sort of vulnerability assessment approach starts by building an inventory of protocols found on the machine?

  A. Inference-based Assessment
  B. Service-based Assessment Solutions
  C. Product-based Assessment Solutions
  D. Tree-based Assessment
  A. Inference-based Assessment

• Question 184:

  Which of the following policies helps secure data and protects the privacy of organizational information?

  A. Special-Access Policy
  B. Document retention Policy
  C. Cryptography Policy
  D. Personal Security Policy
  C. Cryptography Policy

• Question 185:

  Identify the injection attack represented in the diagram below:

  

  A. XPath Injection Attack
  B. XML Request Attack
  C. XML Injection Attack
  D. Frame Injection Attack
  C. XML Injection Attack

• Question 186:

  Rule of Engagement (ROE) is the formal permission to conduct a pen-test. It provides top- level guidance for conducting the penetration testing. Various factors are considered while preparing the scope of ROE which clearly explain the limits associated with the security test.

  

  Which of the following factors is NOT considered while preparing the scope of the Rules of Engagment (ROE)?

  A. A list of employees in the client organization B. A list of acceptable testing techniques
  C. Specific IP addresses/ranges to be tested
  D. Points of contact for the penetration testing team
  A. A list of employees in the client organization B. A list of acceptable testing techniques

• Question 187:

  Which of the following policy forbids everything with strict restrictions on all usage of the company systems and network?

  A. Information-Protection Policy
  B. Paranoid Policy
  C. Promiscuous Policy
  D. Prudent Policy
  B. Paranoid Policy

• Question 188:

  Many security and compliance projects begin with a simple idea: assess the organization's risk, vulnerabilities, and breaches. Implementing an IT security risk assessment is critical to the overall security posture of any organization. An effective security risk assessment can prevent breaches and reduce the impact of realized breaches.

  

  What is the formula to calculate risk?

  A. Risk = Budget x Time
  B. Risk = Goodwill x Reputation
  C. Risk = Loss x Exposure factor
  D. Risk = Threats x Attacks
  C. Risk = Loss x Exposure factor

• Question 189:

  An external intrusion test and analysis identify security weaknesses and strengths of the client's systems and networks as they appear from outside the client's security perimeter, usually from the Internet. The goal of an external intrusion test and analysis is to demonstrate the existence of known vulnerabilities that could be exploited by an external attacker.

  

  During external penetration testing, which of the following scanning techniques allow you to determine a port's state without making a full connection to the host?

  A. XMAS Scan
  B. SYN scan
  C. FIN Scan
  D. NULL Scan
  B. SYN scan

• Question 190:

  One needs to run "Scan Server Configuration" tool to allow a remote connection to Nessus from the remote Nessus clients. This tool allows the port and bound interface of the Nessus daemon to be configured. By default, the Nessus daemon listens to connections on which one of the following?

  A. Localhost (127.0.0.1) and port 1241
  B. Localhost (127.0.0.1) and port 1240
  C. Localhost (127.0.0.1) and port 1246
  D. Localhost (127.0.0.0) and port 1243
  A. Localhost (127.0.0.1) and port 1241