EC-COUNCIL ECSAV10 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAV10 Online Questions & Answers

• Question 21:

  Jason is a penetration tester, and after completing the initial penetration test, he wanted to create a final penetration test report that consists of all activities performed throughout the penetration testing process. Before creating the final penetration testing report, which of the following reports should Jason prepare in order to verify if any crucial information is missed from the report?

  A. Activity report
  B. Host report
  C. User report
  D. Draft report
  A. Activity report

• Question 22:

  A recent study from HyThech Technologies found that three of the most popular websites are having most commonly exploitable flaw in their web applications. Using this vulnerability, an attacker may inject malicious code that can be

  executed on a user's machine. Also, the study revealed that most sensitive target of this vulnerability is stealing session cookies. This helps attackers to duplicate the user session and access anything the user can perform on a website like

  manipulating personal information, creating fake social media posts, stealing credit card information and performing unauthorized financial transactions, etc.

  Identify the vulnerability revealed by HyThech Technologies?

  A. DoS vulnerability
  B. Buffer overflow vulnerability
  C. Insecure decentralization vulnerability
  D. XSS vulnerability
  D. XSS vulnerability

• Question 23:

  Ross performs security test on his company's network assets and creates a detailed report of all the findings. In his report, he clearly explains the methodological approach that he has followed in finding the loopholes in the network. However,

  his report does not mention about the security gaps that can be exploited or the amount of damage that may result from the successful exploitation of the loopholes. The report does not even mention about the remediation steps that are to be

  taken to secure the network.

  What is the type of test that Ross has performed?

  A. Penetration testing
  B. Vulnerability assessment
  C. Risk assessment
  D. Security audit
  B. Vulnerability assessment

• Question 24:

  What are the scanning techniques that are used to bypass firewall rules and logging mechanisms and disguise themselves as usual network traffic?

  A. Connect Scanning Techniques
  B. SYN Scanning Techniques
  C. Stealth Scanning Techniques
  D. Port Scanning Techniques
  C. Stealth Scanning Techniques

• Question 25:

  Today, most organizations would agree that their most valuable IT assets reside within applications and databases. Most would probably also agree that these are areas that have the weakest levels of security, thus making them the prime target for malicious activity from system administrators, DBAs, contractors, consultants, partners, and customers.

  

  Which of the following flaws refers to an application using poorly written encryption code to securely encrypt and store sensitive data in the database and allows an attacker to steal or modify weakly protected data such as credit card numbers, SSNs, and other authentication credentials?

  A. SSI injection attack
  B. Insecure cryptographic storage attack
  C. Hidden field manipulation attack
  D. Man-in-the-Middle attack
  B. Insecure cryptographic storage attack

• Question 26:

  ABC Technologies, a large financial company, hired a penetration tester to do physical penetration testing. On the first day of his assignment, the penetration tester goes to the company posing as a repairman and starts checking trash bins to

  collect the sensitive information.

  What is the penetration tester trying to do?

  A. Trying to attempt social Engineering using phishing
  B. Trying to attempt social engineering by shoulder surfing
  C. Trying to attempt social engineering by eavesdropping
  D. Trying to attempt social engineering by dumpster diving
  D. Trying to attempt social engineering by dumpster diving

• Question 27:

  Clark, a professional hacker, decided to bring down the services provided by the target organization. In the initial information-gathering stage, he detected some vulnerabilities in the TCP/IP protocol stack of the victim's system. He exploited

  these vulnerabilities to create multiple malformed packets in ample magnitude and has sent these unusually crafted packets to the victim's machine.

  Identify the type of attack being performed by Clark?

  A. Dictionary attack
  B. DoS attack
  C. SNMP brute-forcing attack
  D. ARP attack
  B. DoS attack

• Question 28:

  From where can clues about the underlying application environment can be collected?

  A. From source code
  B. From file types and directories
  C. From executable file
  D. From the extension of the file
  D. From the extension of the file

• Question 29:

  SQL injection attacks are becoming significantly more popular amongst hackers and there has been an estimated 69 percent increase of this attack type.

  This exploit is used to great effect by the hacking community since it is the primary way to steal sensitive data from web applications. It takes advantage of non-validated input vulnerabilities to pass SQL commands through a web application

  for execution by a back-end database.

  The below diagram shows how attackers launched SQL injection attacks on web applications.

  

  Which of the following can the attacker use to launch an SQL injection attack?

  A. Blah' "2=2 -"
  B. Blah' and 2=2 -
  C. Blah' and 1=1 -
  D. Blah' or 1=1 -
  D. Blah' or 1=1 -

• Question 30:

  How many bits is Source Port Number in TCP Header packet?

  A. 48
  B. 32
  C. 64
  D. 16
  D. 16