EC-COUNCIL 412-79V8 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79V8 Online Questions & Answers

• Question 141:

  Which of the following is not the SQL injection attack character?

  A. $
  B. PRINT
  C. #
  D. @@variable
  B. PRINT

• Question 142:

  Port numbers are used to keep track of different conversations crossing the network at the same time. Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers have the assigned ranges.

  

  Port numbers above 1024 are considered which one of the following?

  A. Dynamically assigned port numbers
  B. Statically assigned port numbers
  C. Well-known port numbers
  D. Unregistered port numbers
  A. Dynamically assigned port numbers

• Question 143:

  A chipset is a group of integrated circuits that are designed to work together and are usually marketed as a single product." It is generally the motherboard chips or the chips used on the expansion card. Which one of the following is well supported in most wireless applications?

  A. Orinoco chipsets
  B. Prism II chipsets
  C. Atheros Chipset
  D. Cisco chipset
  B. Prism II chipsets

• Question 144:

  Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

  

  Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability. What can a pen tester do to detect input sanitization issues?

  A. Send single quotes as the input data to catch instances where the user input is not sanitized
  B. Send double quotes as the input data to catch instances where the user input is not sanitized
  C. Send long strings of junk data, just as you would send strings to detect buffer overruns
  D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization
  D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

• Question 145:

  What is the maximum value of a "tinyint" field in most database systems?

  A. 222
  B. 224 or more
  C. 240 or less
  D. 225 or more
  D. 225 or more

• Question 146:

  Which among the following information is not furnished by the Rules of Engagement (ROE) document?

  A. Techniques for data collection from systems upon termination of the test
  B. Techniques for data exclusion from systems upon termination of the test
  C. Details on how data should be transmitted during and after the test
  D. Details on how organizational data is treated throughout and after the test
  D. Details on how organizational data is treated throughout and after the test

• Question 147:

  Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit. Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

  

  Which agreement requires a signature from both the parties (the penetration tester and the company)?

  A. Non-disclosure agreement
  B. Client fees agreement
  C. Rules of engagement agreement
  D. Confidentiality agreement
  D. Confidentiality agreement

• Question 148:

  Which of the following is not a condition specified by Hamel and Prahalad (1990)?

  A. Core competency should be aimed at protecting company interests
  B. Core competency is hard for competitors to imitate
  C. Core competency provides customer benefits
  D. Core competency can be leveraged widely to many products and markets
  A. Core competency should be aimed at protecting company interests

• Question 149:

  Which of the following acts is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards and applies to all entities involved in payment card processing?

  A. PIPEDA
  B. PCI DSS
  C. Human Rights Act 1998
  D. Data Protection Act 1998
  B. PCI DSS

• Question 150:

  Which of the following reports provides a summary of the complete pen testing process, its outcomes, and recommendations?

  A. Vulnerability Report
  B. Executive Report
  C. Client-side test Report
  D. Host Report
  B. Executive Report