EC-COUNCIL ECSAV10 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAV10 Online Questions & Answers

• Question 331:

  Adam is a senior penetration tester at XYZsecurity Inc. He is auditing a wireless network for vulnerabilities. Before starting the audit, he wants to ensure that the wireless card in his machine supports injection. He decided to use the latest

  version of aircrack-ng tool.

  Which of the following commands will help Adam check his wireless card for injection?

  A. aireplay-ng -9 wlan0
  B. airodump-ng wlan0
  C. airdecap-ng -3 wlan0
  D. aireplay-ng -5 –b wlan0
  B. airodump-ng wlan0

• Question 332:

  John is a newly appointed penetration testing manager in ABC Ltd. He is assigned a task to build a penetration testing team and asked to justify the return on investment (ROI). To assess and predict the ROI of the team by considering the parameters like expected returns from the team and cost of investment, how can John calculate the ROI?

  A. ROI = (Cost of investment
  B. ROI = (Expected returns
  C. ROI = (Expected returns + Cost of investment)/Cost of investment
  D. ROI = (Cost of investment + Expected returns)/Expected returns
  B. ROI = (Expected returns

• Question 333:

  During the reconnaissance phase of a penetration test, you discovered that the client has deployed a firewall that only checks the TCP header information. Which of the following techniques would you use to bypass the firewall?

  A. Bypassing the firewall using tiny fragments
  B. Bypassing the firewall by manipulating the IPID sequence number
  C. Bypassing the firewall source routing
  D. Bypassing the firewall using the IP address in place of an URL
  A. Bypassing the firewall using tiny fragments

• Question 334:

  A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML) statement should only affect rows that meet specified criteria; The criteria are expressed in the form of predicates. WHERE clauses are not mandatory clauses of SQL DML statements, but can be used to limit the number of rows affected by a SQL DML statement or returned by a query.

  

  A pen tester is trying to gain access to a database by inserting exploited query statements with a WHERE clause. The pen tester wants to retrieve all the entries from the database using the WHERE clause from a particular table (e.g.

  StudentTable).

  What query does he need to write to retrieve the information?

  A. EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000
  B. DUMP * FROM StudentTable WHERE roll_number = 1 AND 1=1-
  C. SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1`
  D. RETRIVE * FROM StudentTable WHERE roll_number = 1'#
  C. SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1`

• Question 335:

  Adam found a pen drive in his company's parking lot. He connected it to his system to check the content. On the next day, he found that someone has logged into his company email account and sent some emails. What type of social engineering attack has Adam encountered?

  A. Media Dropping
  B. Phishing
  C. Eaves Dropping
  D. Dumpster Diving
  A. Media Dropping

• Question 336:

  A firewall's decision to forward or reject traffic in network filtering is dependent upon which of the following?

  A. Destination address
  B. Port numbers
  C. Source address
  D. Protocol used
  D. Protocol used

• Question 337:

  Identify the framework that comprises of five levels to guide agency assessment of their security programs and assist in prioritizing efforts for improvement:

  A. Information System Security Assessment Framework (ISSAF)
  B. Microsoft Internet Security Framework
  C. Nortells Unified Security Framework
  D. Federal Information Technology Security Assessment Framework
  D. Federal Information Technology Security Assessment Framework

• Question 338:

  What is the purpose of a Get-Out-of-Jail-Free card in a pen testing engagement?

  A. It indemnifies the tester against any loss or damage that may result from the testing
  B. It details standards and penalties imposed by federal, state, or local governments
  C. It is a formal approval to start pen test engagement
  D. It gives an understanding of the limitations, constraints, liabilities, and indemnification considerations
  A. It indemnifies the tester against any loss or damage that may result from the testing

• Question 339:

  In delivering penetration testing report, which of the following steps should NOT be followed?

  A. Always send the report by email or CD-ROM
  B. Always deliver the report to approved stakeholders in the company in person
  C. Always ask for a signed acknowledgment after submitting the report
  D. Report must be presented in a PDF format, unless requested otherwise
  A. Always send the report by email or CD-ROM

• Question 340:

  The Rhythm Networks Pvt Ltd firm is a group of ethical hackers. Rhythm Networks was asked by their client Zombie to identify how the attacker penetrated their firewall. Rhythm discovered the attacker modified the addressing information of

  the IP packet header and the source address bits field to bypass the firewall.

  What type of firewall bypassing technique was used by the attacker?

  A. Source routing
  B. Proxy Server
  C. HTTP Tunneling
  D. Anonymous Website Surfing Sites
  C. HTTP Tunneling