EC-COUNCIL ECSA 412-79V10 Questions & Answers

• Question 61:

  Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit.

  Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

  

  Which agreement requires a signature from both the parties (the penetration tester and the company)?

  A. Non-disclosure agreement

  B. Client fees agreement

  C. Rules of engagement agreement

  D. Confidentiality agreement

  Correct Answer: C

• Question 62:

  Which of the following password cracking techniques is used when the attacker has some information about the password?

  A. Hybrid Attack

  B. Dictionary Attack

  C. Syllable Attack

  D. Rule-based Attack

  Correct Answer: D

  Reference:

  http://202.154.59.182/mfile/files/Information%20System/Computer%20Forensics%3B%20H ard%20Disk%

  20and%20Operating%20Systems/CHAPTER%207%20Application%20Pass word%20Crackers.pdf (page

  4, rule-based attack)

• Question 63:

  A wireless intrusion detection system (WIDS) monitors the radio spectrum for the presence of unauthorized, rogue access points and the use of wireless attack tools. The system monitors the radio spectrum used by wireless LANs, and immediately alerts a systems administrator whenever a rogue access point is detected.

  Conventionally it is achieved by comparing the MAC address of the participating wireless devices.

  Which of the following attacks can be detected with the help of wireless intrusion detection system (WIDS)?

  

  A. Social engineering

  B. SQL injection

  C. Parameter tampering

  D. Man-in-the-middle attack

  Correct Answer: D

  Reference: http://www.infosecwriters.com/text_resources/pdf/Wireless_IDS_JDixon.pdf (page 5)

• Question 64:

  Besides the policy implications of chat rooms, Internet Relay Chat (IRC) is frequented by attackers and used as a command and control mechanism. IRC normally uses which one of the following TCP ports?

  A. 6566 TCP port

  B. 6771 TCP port

  C. 6667 TCP port

  D. 6257 TCP port

  Correct Answer: C

• Question 65:

  Identify the policy that defines the standards for the organizational network connectivity and security standards for computers that are connected in the organizational network.

  A. Information-Protection Policy

  B. Special-Access Policy

  C. Remote-Access Policy

  D. Acceptable-Use Policy

  Correct Answer: C

• Question 66:

  In which of the following IDS evasion techniques does IDS reject the packets that an end system accepts?

  A. IPS evasion technique

  B. IDS evasion technique

  C. UDP evasion technique

  D. TTL evasion technique

  Correct Answer: D

  Reference: http://is.muni.cz/th/172999/fi_m/MT_Bukac.pdf (page 24)

• Question 67:

  What is the maximum value of a "tinyint" field in most database systems?

  A. 222

  B. 224 or more

  C. 240 or less

  D. 225 or more

  Correct Answer: D

  Reference: http://books.google.com.pk/books?id=JUcIAAAAQBAJandpg=SA3- PA3andlpg=SA3PA3anddq=maximum+value+of+a+%E2%80%9Ctinyint%E2%80%9D+field+in+most+databa se +systemsandsource=blandots=NscGk-R5randsig=1hMOYByxt7ebRJ4UEjbpxMijTQsandhl=enandsa=Xandei=pvgeVJnTCNDkaI_fgugOandv ed=0CDYQ6AEwAw#v=onepageandq=maximum%20value%20of%20a%20%E2%80%9Ctin yint%E2%80% 9D%20field%20in%20most%20database%20systemsandf=false

• Question 68:

  Which of the following attributes has a LM and NTLMv1 value as 64bit + 64bit + 64bit and NTLMv2 value as 128 bits?

  A. Hash Key Length

  B. C/R Value Length

  C. C/R Key Length

  D. Hash Value Length

  Correct Answer: B

  Reference: http://books.google.com.pk/books?id=QWQRSTnkFsQCandpg=SA4- PA5andlpg=SA4PA5anddq=attributes+has+a+LM+and+NTLMv1+value+as+64bit+%2B+64bit+%2B+64bit+an d+NTLMv2 +value+as+128+bitsandsource=blandots=wJPR32BaF6andsig=YEt9LNfQAbm2Mc6obVggKCkQ2sandhl=enandsa=Xandei=scMfVMfdC8u7ygP4xYGQDgandved=0CCkQ6AEwAg#v =onepageandq=attributes%20has%20a%20LM%20and%20NTLMv1%20value%20as%2064 bit%20%2B% 2064bit%20%2B%2064bit%20and%20NTLMv2%20value%20as%20128%20 bitsandf=false (see Table 4-1)

• Question 69:

  Which of the following policy forbids everything with strict restrictions on all usage of the company systems and network?

  A. Information-Protection Policy

  B. Paranoid Policy

  C. Promiscuous Policy

  D. Prudent Policy

  Correct Answer: B

• Question 70:

  NTP protocol is used to synchronize the system clocks of computers with a remote time server or time source over a network. Which one of the following ports is used by NTP as its transport layer?

  A. TCP port 152

  B. UDP port 177

  C. UDP port 123

  D. TCP port 113

  Correct Answer: C