EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 101:

  Rules of Engagement (ROE) document provides certain rights and restriction to the test team for performing the test and helps testers to overcome legal, federal, and policy-related restrictions to use different penetration testing tools and techniques.

  

  What is the last step in preparing a Rules of Engagement (ROE) document?

  A. Conduct a brainstorming session with top management and technical teams
  B. Decide the desired depth for penetration testing
  C. Conduct a brainstorming session with top management and technical teams
  D. Have pre-contract discussions with different pen-testers
  B. Decide the desired depth for penetration testing

• Question 102:

  Which of the following password cracking techniques is used when the attacker has some information about the password?

  A. Hybrid Attack
  B. Dictionary Attack
  C. Syllable Attack
  D. Rule-based Attack
  D. Rule-based Attack

• Question 103:

  In the context of penetration testing, what does blue teaming mean?

  

  A. A penetration test performed with the knowledge and consent of the organization's IT staff
  B. It is the most expensive and most widely used
  C. It may be conducted with or without warning
  D. A penetration test performed without the knowledge of the organization's IT staff but with permission from upper management
  A. A penetration test performed with the knowledge and consent of the organization's IT staff

• Question 104:

  Which of the following is NOT generally included in a quote for penetration testing services?

  A. Type of testing carried out
  B. Type of testers involved
  C. Budget required
  D. Expected timescale required to finish the project
  B. Type of testers involved

• Question 105:

  John, a penetration tester, was asked for a document that defines the project, specifies goals, objectives, deadlines, the resources required, and the approach of the project. Which of the following includes all of these requirements?

  A. Penetration testing project plan
  B. Penetration testing software project management plan
  C. Penetration testing project scope report
  D. Penetration testing schedule plan
  A. Penetration testing project plan

• Question 106:

  A Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

  

  It is performed when an error message is not received from application while trying to exploit SQL vulnerabilities. The developer's specific message is displayed instead of an error message. So it is quite difficult to find SQL vulnerability in such cases. A pen tester is trying to extract the database name by using a blind SQL injection. He tests the database using the below query and finally finds the database name. http://juggyboy.com/page.aspx?id=1; IF (LEN(DB_NAME())=4) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),1,1)))=97) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),2,1)))=98) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),3,1)))=99) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),4,1)))=100) WAITFOR DELAY '00:00:10'-

  What is the database name?

  A. WXYZ
  B. PQRS
  C. EFGH
  D. ABCD
  D. ABCD

• Question 107:

  What is the maximum value of a "tinyint" field in most database systems?

  A. 222
  B. 224 or more
  C. 240 or less
  D. 225 or more
  D. 225 or more

• Question 108:

  Vulnerability assessment is an examination of the ability of a system or application, including current security procedures and controls, to withstand assault. It recognizes, measures, and classifies security vulnerabilities in a computer system, network, and communication channels.

  A vulnerability assessment is used to identify weaknesses that could be exploited and predict the effectiveness of additional security measures in protecting information resources from attack.

  

  Which of the following vulnerability assessment technique is used to test the web server infrastructure for any misconfiguration and outdated content?

  A. Passive Assessment
  B. Host-based Assessment
  C. External Assessment
  D. Application Assessment
  B. Host-based Assessment

• Question 109:

  In which of the following IDS evasion techniques does IDS reject the packets that an end system accepts?

  A. IPS evasion technique
  B. IDS evasion technique
  C. UDP evasion technique
  D. TTL evasion technique
  B. IDS evasion technique

• Question 110:

  What threat categories should you use to prioritize vulnerabilities detected in the pen testing report?

  A. 1, 2, 3, 4, 5
  B. Low, medium, high, serious, critical
  C. Urgent, dispute, action, zero, low
  D. A, b, c, d, e
  B. Low, medium, high, serious, critical