EC-COUNCIL ECSAV10 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAV10 Online Questions & Answers

• Question 341:

  Before performing the penetration testing, there will be a pre-contract discussion with different pen-testers (the team of penetration testers) to gather a quotation to perform pen testing. Which of the following factors is NOT considered while preparing a price quote to perform pen testing?

  

  A. Total number of employees in the client organization
  B. Type of testers involved
  C. The budget required
  D. Expected time required to finish the project
  A. Total number of employees in the client organization

• Question 342:

  A penetration test will show you the vulnerabilities in the target system and the risks associated with it. An educated valuation of the risk will be performed so that the vulnerabilities can be reported as High/Medium/Low risk issues.

  

  What are the two types of `white-box' penetration testing?

  A. Announced testing and blind testing
  B. Blind testing and double blind testing
  C. Blind testing and unannounced testing
  D. Announced testing and unannounced testing
  D. Announced testing and unannounced testing

• Question 343:

  An attacker targeted to attack network switches of an organization to steal confidential information such as network subscriber information, passwords, etc. He started transmitting data through one switch to another by creating and sending

  two 802.1Q tags, one for the attacking switch and the other for victim switch. By sending these frames. The attacker is fooling the victim switch into thinking that the frame is intended for it. The target switch then forwards the frame to the

  victim port.

  Identify the type of attack being performed by the attacker?

  A. SNMP brute forcing
  B. MAC flooding
  C. IP spoofing
  D. VLAN hopping
  D. VLAN hopping

• Question 344:

  A team of cyber criminals in Germany has sent malware-based emails to workers of a fast-food center which is having multiple outlets spread geographically. When any of the employees click on the malicious email, it will give backdoor

  access to the point of sale (POS) systems located at various outlets. After gaining access to the POS systems, the criminals will be able to obtain credit card details of the fast-food center's customers.

  In the above scenario, identify the type of attack being performed on the fast-food center?

  A. Phishing
  B. Vishing
  C. Tailgating
  D. Dumpster diving
  A. Phishing

• Question 345:

  Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a

  competing company was found to have just developed products that almost exactly duplicated products that Meyer produces.

  What could have prevented this information from being stolen from the laptops?

  A. SDW Encryption
  B. EFS Encryption
  C. DFS Encryption
  D. IPS Encryption
  B. EFS Encryption

• Question 346:

  A chipset is a group of integrated circuits that are designed to work together and are usually marketed as a single product." It is generally the motherboard chips or the chips used on the expansion card. Which one of the following is well supported in most wireless applications?

  A. Orinoco chipsets
  B. Prism II chipsets
  C. Atheros Chipset
  D. Cisco chipset
  B. Prism II chipsets

• Question 347:

  John, a security analyst working for LeoTech organization, was asked to perform penetration testing on the client organizational network. In this process, he used a method that involves threatening or convincing a person from the client

  organization to obtain sensitive information.

  Identify the type of penetration testing performed by John on the client organization?

  A. Wireless network penetration testing
  B. Social engineering penetration testing
  C. Mobile device penetration testing
  D. Web application penetration testing
  B. Social engineering penetration testing

• Question 348:

  A company identified critical vulnerability in its hyperconverged infrastructure that provides services such as computing, networking, and storage resources in a single system. Also, the company identified that this vulnerability may lead to

  various injection attacks that allow the attackers to execute malicious commands as the root users. The company decided to immediately implement appropriate countermeasure to defend against such attacks.

  Which of the following defensive mechanisms should the company employ?

  A. Data correlation
  B. Patch management
  C. Input validation
  D. Session management
  C. Input validation

• Question 349:

  You are working on a pen testing assignment. Your client has asked for a document that shows them the detailed progress of the pen testing. Which document is the client asking for?

  A. Scope of work (SOW) document
  B. Rule of engagement with signatures of both the parties
  C. Project plan with work breakdown structure
  D. Engagement log
  D. Engagement log

• Question 350:

  Snort, an open source network-based intrusion detection sensor, is the most widely installed NIDS in the world. It can be configured to run in the four modes. Which one of the following modes reads the packets off the network and displays them in a continuous stream on the console (screen)?

  A. Packet Sniffer Mode
  B. Packet Logger Mode
  C. Network Intrusion Detection System Mode
  D. Inline Mode
  A. Packet Sniffer Mode