EC-COUNCIL ECSAV10 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAV10 Online Questions & Answers

• Question 11:

  In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing

  the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down.

  What will the other routers communicate between themselves?

  A. More RESET packets to the affected router to get it to power back up
  B. RESTART packets to the affected router to get it to power back up
  C. The change in the routing fabric to bypass the affected router
  D. STOP packets to all other routers warning of where the attack originated
  C. The change in the routing fabric to bypass the affected router

• Question 12:

  Which of the following is developed to address security concerns on time and reduce the misuse or threat of attacks in an organization?

  A. Vulnerabilities checklists
  B. Configuration checklists
  C. Action Plan
  D. Testing Plan
  A. Vulnerabilities checklists

• Question 13:

  The objective of social engineering pen testing is to test the strength of human factors in a security chain within the organization. It is often used to raise the level of security awareness among employees.

  

  The tester should demonstrate extreme care and professionalism during a social engineering pen test as it might involve legal issues such as violation of privacy and may result in an embarrassing situation for the organization. Which of the following methods of attempting social engineering is associated with bribing, handing out gifts, and becoming involved in a personal relationship to befriend someone inside the company?

  A. Accomplice social engineering technique
  B. Identity theft
  C. Dumpster diving
  D. Phishing social engineering technique
  A. Accomplice social engineering technique

• Question 14:

  Sam is auditing a web application for SQL injection vulnerabilities. During the testing, Sam discovered that the web application is vulnerable to SQL injection. He starts fuzzing the search field in the web application with UNION based SQL

  queries, however, he realized that the underlying WAF is blocking the requests. To avoid this, Sam is trying the following query:

  UNION/**/SELECT/**/'/**/OR/**/1/**/=/**/1

  Which of the following evasion techniques is Sam using?

  A. Sam is using char encoding to bypass WAF
  B. Sam is using obfuscated code to bypass WAF
  C. Sam is using inline comments to bypass WAF
  D. Sam is manipulating white spaces to bypass WAF
  C. Sam is using inline comments to bypass WAF

• Question 15:

  Which port does DHCP use for client connections?

  A. UDP port 67
  B. UDP port 68
  C. UDP port 69
  D. UDP port 66
  B. UDP port 68

• Question 16:

  Which one of the following is a supporting tool for 802.11 (wireless) packet injections, it spoofs 802.11 packets to verify whether the access point is valid or not?

  A. Airsnort
  B. Aircrack
  C. Airpwn
  D. WEPCrack
  C. Airpwn

• Question 17:

  TCP/IP provides a broad range of communication protocols for the various applications on the network. The TCP/IP model has four layers with major protocols included within each layer. Which one of the following protocols is used to collect information from all the network devices?

  A. Simple Network Management Protocol (SNMP)
  B. Network File system (NFS)
  C. Internet Control Message Protocol (ICMP)
  D. Transmission Control Protocol (TCP)
  A. Simple Network Management Protocol (SNMP)

• Question 18:

  You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?

  A. RaidSniff
  B. Snort
  C. Ettercap
  D. Airsnort
  C. Ettercap

• Question 19:

  Which of the following acts related to information security in the US establish that the management of an organization is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting?

  A. USA Patriot Act 2001
  B. Sarbanes-Oxley 2002
  C. Gramm-Leach-Bliley Act (GLBA)
  D. California SB 1386
  B. Sarbanes-Oxley 2002

• Question 20:

  Alisa is a Network Security Manager at Aidos Cyber Security. During a regular network audit, she sent specially crafted ICMP packet fragments with different offset values into the network, causing a system crash. Which attack Alisa is trying to perform?

  A. Ping-of-death attack
  B. Fraggle attack
  C. Session hijacking
  D. Smurf attack
  A. Ping-of-death attack