EC-COUNCIL ECSAV10 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAV10 Online Questions & Answers

• Question 171:

  Which of the following password hashing algorithms is used in the NTLMv2 authentication mechanism?

  A. AES
  B. DES (ECB mode)
  C. MD5
  D. RC5
  C. MD5

• Question 172:

  An attacker with a malicious intention decided to hack confidential data from the target organization. For acquiring such information, he started testing IoT devices that are connected to the target network. He started monitoring the network

  traffic passing between the IoT devices and the network to verify whether credentials are being transmitted in clear text. Further, he also tried to crack the passwords using well-known keywords across all the interfaces.

  Which of the following IoT threats the attacker is trying to exploit?

  A. Poor physical security
  B. Poor authentication
  C. Privacy concerns
  D. Insecure firmware
  B. Poor authentication

• Question 173:

  Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida; They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good. Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa; She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, requested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for. What principal of social engineering did Julia use?

  A. Reciprocation
  B. Friendship/Liking
  C. Social Validation
  D. Scarcity
  A. Reciprocation

• Question 174:

  How many possible sequence number combinations are there in TCP/IP protocol?

  A. 320 billion
  B. 32 million
  C. 4 billion
  D. 1 billion
  C. 4 billion

• Question 175:

  You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by

  internal computers.

  What type of firewall must you implement to abide by this policy?

  A. Circuit-level proxy firewall
  B. Packet filtering firewall
  C. Application-level proxy firewall
  D. Statefull firewall
  D. Statefull firewall

• Question 176:

  Cedric, who is a software support executive working for Panacx Tech. Inc., was asked to install Ubuntu operating system in the computers present in the organization. After installing the OS, he came to know that there are many unnecessary

  services and packages in the OS that were automatically installed without his knowledge. Since these services or packages can be potentially harmful and can create various security threats to the host machine, he was asked to disable all

  the unwanted services.

  In order to stop or disable these unnecessary services or packages from the Ubuntu distributions, which of the following commands should Cedric employ?

  A. # update-rc.d -f [service name] remove
  B. # chkconfig [service name] –del
  C. # chkconfig [service name] off
  D. # service [service name] stop
  C. # chkconfig [service name] off

• Question 177:

  George, a reputed ethical hacker and penetration testing consultant, was hired by FNB Services, a startup financial services company, to audit the security of their web applications. During his investigation, George discovered that the

  company's website is vulnerable to blind SQL injection attacks. George entered a custom SQL query in a form located on the vulnerable page which resulted in a back-end SQL query similar to the one given below:

  http://fnb.com/forms/?id=1+AND+555=if(ord(mid((select+pass from+users+limit+0,1),1,2))= 97,555,777)

  What is George trying to achieve with this custom SQL query?

  A. George is searching for the first character of all the table entries
  B. George is searching for the second character of the first table entry
  C. George is searching for the first character of the second table entry
  D. George is searching for the first character of the first table entry
  C. George is searching for the first character of the second table entry

• Question 178:

  Fred, who owns a company called Skyfeit Ltd., wants to test the enterprise network for presence of any vulnerabilities and loopholes. He employed a third-party penetration testing team and asked them to perform the penetration testing over his organizational infrastructure. Fred briefed the team about his network infrastructure and provided them with a set of IP addresses on which they can perform tests. He gave them strict instruction not to perform DDoS attacks or access the domain servers in the company. He also instructed them that they can carry out the penetration tests even when the regular employees are on duty since they lack the clue about the happenings. However, he asked the team to take care that no interruption in business continuity should be caused. He also informed the penetration testing team that they get only 1 month to carry out the test and submit the report. What kind of penetration test did Fred ask the third-party penetration testing team to perform?

  A. Announced testing
  B. Blind testing
  C. Grey-Box testing
  D. Unannounced testing
  D. Unannounced testing

• Question 179:

  The penetration testing team of MirTech Inc. identified the presence of various vulnerabilities in the web application coding. They prepared a detailed report addressing to the web developers regarding the findings. In the report, the

  penetration testing team advised the web developers to avoid the use of dangerous standard library functions. They also informed the web developers that the web application copies the data without checking whether it fits into the target

  destination memory and is susceptible in supplying the application with large amount of data.

  According to the findings by the penetration testing team, which type of attack was possible on the web application?

  A. Buffer overflow
  B. SQL injection
  C. Cross-site scripting
  D. Denial-of-service
  A. Buffer overflow

• Question 180:

  Sam was asked to conduct penetration tests on one of the client's internal networks. As part of the testing process, Sam performed enumeration to gain information about computers belonging to a domain, list of shares on the individual hosts

  in the network, policies and passwords.

  Identify the enumeration technique.

  A. NTP Enumeration
  B. NetBIOS Enumeration
  C. DNS Enumeration
  D. SMTP Enumeration
  B. NetBIOS Enumeration