EC-COUNCIL ECSA 412-79V10 Questions & Answers

• Question 11:

  Identify the injection attack represented in the diagram below: A. XPath Injection Attack

  

  B. XML Request Attack

  C. XML Injection Attack

  D. Frame Injection Attack

  Correct Answer: C

  Reference: http://projects.webappsec.org/w/page/13247004/XML%20Injection

• Question 12:

  Which of the following is not a characteristic of a firewall?

  A. Manages public access to private networked resources

  B. Routes packets between the networks

  C. Examines all traffic routed between the two networks to see if it meets certain criteria

  D. Filters only inbound traffic but not outbound traffic

  Correct Answer: D

• Question 13:

  What is the difference between penetration testing and vulnerability testing?

  

  A. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of `in-depth ethical hacking'

  B. Penetration testing is based on purely online vulnerability analysis while vulnerability testing engages ethical hackers to find vulnerabilities

  C. Vulnerability testing is more expensive than penetration testing

  D. Penetration testing is conducted purely for meeting compliance standards while vulnerability testing is focused on online scans

  Correct Answer: A

• Question 14:

  DNS information records provide important data about:

  A. Phone and Fax Numbers

  B. Location and Type of Servers

  C. Agents Providing Service to Company Staff

  D. New Customer

  Correct Answer: B

• Question 15:

  Identify the person who will lead the penetration-testing project and be the client point of contact.

  A. Database Penetration Tester

  B. Policy Penetration Tester

  C. Chief Penetration Tester

  D. Application Penetration Tester

  Correct Answer: C

  Reference: http://www.scribd.com/doc/133635286/LPTv4-Module-15-Pre-Penetration- Testing-Checklist-NoRestriction (page 15)

• Question 16:

  Variables are used to define parameters for detection, specifically those of your local network and/or specific servers or ports for inclusion or exclusion in rules. These are simple substitution variables set with the var keyword. Which one of the following operator is used to define meta-variables?

  A. "$"

  B. "#"

  C. "*"

  D. "?"

  Correct Answer: A

• Question 17:

  Attackers create secret accounts and gain illegal access to resources using backdoor while bypassing the authentication procedures. Creating a backdoor is a where an attacker obtains remote access to a computer on a network.

  

  Which of the following techniques do attackers use to create backdoors to covertly gather critical information about a target machine?

  A. Internal network mapping to map the internal network of the target machine

  B. Port scanning to determine what ports are open or in use on the target machine

  C. Sniffing to monitor all the incoming and outgoing network traffic

  D. Social engineering and spear phishing attacks to install malicious programs on the target machine

  Correct Answer: D

• Question 18:

  Which of the following protocol's traffic is captured by using the filter tcp.port==3389 in the Wireshark tool?

  A. Reverse Gossip Transport Protocol (RGTP)

  B. Real-time Transport Protocol (RTP)

  C. Remote Desktop Protocol (RDP)

  D. Session Initiation Protocol (SIP)

  Correct Answer: C

  Reference: http://wiki.wireshark.org/RDP

• Question 19:

  Which of the following information gathering techniques collects information from an organization's web-based calendar and email services?

  A. Anonymous Information Gathering

  B. Private Information Gathering

  C. Passive Information Gathering

  D. Active Information Gathering

  Correct Answer: D

  Reference: http://luizfirmino.blogspot.com/2011/09/footprinting-terminologies.html

• Question 20:

  John, a penetration tester, was asked for a document that defines the project, specifies goals, objectives, deadlines, the resources required, and the approach of the project. Which of the following includes all of these requirements?

  A. Penetration testing project plan

  B. Penetration testing software project management plan

  C. Penetration testing project scope report

  D. Penetration testing schedule plan

  Correct Answer: A

  Explanation: Rfere http://books.google.com.pk/books?id=7dwEAAAAQBAJandpg=SA4-PA14andlpg=SA4- PA14anddq=penetration +testing+document+that+defines+the+project,+specifies+goals,+obje ctives,+deadlines,+the+resources +required,+and+the+approach+of+the+projectandsource=b landots=SQCLHNtthNandsig=kRcccmtDtCdZgB7hASShxSRbfOMandhl=enandsa=Xandei=hyMfVOKz GYvmarvFgaALandved=0CB0Q6AEwAA#v=onepageandq=penetration%20testing%20docume nt%20that% 20defines%20the%20project%2C%20specifies%20goals%2C%20objectives% 2C%20deadlines%2C% 20the%20resources%20required%2C%20and%20the%20approac h%20of%20the%20projectandf=false