EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 91:

  Why is a legal agreement important to have before launching a penetration test?

  

  A. Guarantees your consultant fees
  B. Allows you to perform a penetration test without the knowledge and consent of the organization's upper management
  C. It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.
  D. It is important to ensure that the target organization has implemented mandatory security policies
  C. It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.

• Question 92:

  Which of the following is an application alert returned by a web application that helps an attacker guess a valid username?

  A. Invalid username or password
  B. Account username was not found
  C. Incorrect password
  D. Username or password incorrect
  C. Incorrect password

• Question 93:

  What is a goal of the penetration testing report?

  A. The penetration testing report helps you comply with local laws and regulations related to environmental conditions in the organization.
  B. The penetration testing report allows you to sleep better at night thinking your organization is protected
  C. The pen testing report helps executive management to make decisions on implementing security controls in the organization and helps the security team implement security controls and patch any flaws discovered during testing.
  D. The penetration testing report allows you to increase sales performance by effectively communicating with the internal security team.
  C. The pen testing report helps executive management to make decisions on implementing security controls in the organization and helps the security team implement security controls and patch any flaws discovered during testing.

• Question 94:

  Rule of Engagement (ROE) is the formal permission to conduct a pen-test. It provides top- level guidance for conducting the penetration testing. Various factors are considered while preparing the scope of ROE which clearly explain the limits associated with the security test.

  

  Which of the following factors is NOT considered while preparing the scope of the Rules of Engagment (ROE)?

  A. A list of employees in the client organization
  B. A list of acceptable testing techniques
  C. Specific IP addresses/ranges to be tested
  D. Points of contact for the penetration testing team
  A. A list of employees in the client organization

• Question 95:

  John, the penetration tester in a pen test firm, was asked to find whether NTP services are opened on the target network (10.0.0.7) using Nmap tool.

  

  Which one of the following Nmap commands will he use to find it?

  A. nmap -sU - 389 10.0.0.7
  B. nmap -sU - 123 10.0.0.7
  C. nmap -sU - 161 10.0.0.7
  D. nmap -sU - 135 10.0.0.7
  D. nmap -sU - 135 10.0.0.7

• Question 96:

  James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network. What type of DoS attack is James testing against his network?

  A. Smurf
  B. Trinoo
  C. Fraggle
  D. SYN flood
  A. Smurf

• Question 97:

  John, the penetration testing manager in a pen testing firm, needs to prepare a pen testing pricing report for a client. Which of the following factors does he need to consider while preparing the pen testing pricing report?

  

  A. Number of employees in the client organization
  B. Complete structure of the organization
  C. Number of client computers to be tested and resources required to perform a pen test
  D. Number of servers available in the client organization
  B. Complete structure of the organization

• Question 98:

  In a TCP packet filtering firewall, traffic is filtered based on specified session rules, such as when a session is initiated by a recognized computer.

  

  Identify the level up to which the unknown traffic is allowed into the network stack.

  A. Level 5 ?Application
  B. Level 2 ?Data Link
  C. Level 4 ?TCP
  D. Level 3 ?Internet Protocol (IP)
  D. Level 3 ?Internet Protocol (IP)

• Question 99:

  You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port

  389 using Idp.exe.

  What are you trying to accomplish here?

  A. Poison the DNS records with false records
  B. Enumerate MX and A records from DNS
  C. Establish a remote connection to the Domain Controller
  D. Enumerate domain user accounts and built-in groups
  D. Enumerate domain user accounts and built-in groups

• Question 100:

  Identify the injection attack represented in the diagram below:

  

  A. XPath Injection Attack
  B. XML Request Attack
  C. XML Injection Attack
  D. Frame Injection Attack
  C. XML Injection Attack