EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 111:

  Mason is footprinting an organization to gather competitive intelligence. He visits the company's website for contact information and telephone numbers but does not find any. He knows the entire staff directory was listed on their website 12 months. How can he find the directory?

  A. Visit Google's search engine and view the cached copy
  B. Crawl and download the entire website using the Surfoffline tool and save them to his computer
  C. Visit the company's partners' and customers' website for this information
  D. Use WayBackMachine in Archive.org web site to retrieve the Internet archive
  D. Use WayBackMachine in Archive.org web site to retrieve the Internet archive

• Question 112:

  Which type of security policy applies to the below configuration? i)Provides maximum security while allowing known, but necessary, dangers ii)All services are blocked; nothing is allowed iii)Safe and necessary services are enabled individually iv)Non-essential services and procedures that cannot be made safe are NOT allowed v)Everything is logged

  

  A. Paranoid Policy
  B. Prudent Policy
  C. Permissive Policy
  D. Promiscuous Policy
  B. Prudent Policy

• Question 113:

  Which of the following protocols cannot be used to filter VoIP traffic?

  A. Media Gateway Control Protocol (MGCP)
  B. Real-time Transport Control Protocol (RTCP)
  C. Session Description Protocol (SDP)
  D. Real-Time Publish Subscribe (RTPS)
  D. Real-Time Publish Subscribe (RTPS)

• Question 114:

  A penetration test will show you the vulnerabilities in the target system and the risks associated with it. An educated valuation of the risk will be performed so that the vulnerabilities can be reported as High/Medium/Low risk issues.

  

  What are the two types of `white-box' penetration testing?

  A. Announced testing and blind testing
  B. Blind testing and double blind testing
  C. Blind testing and unannounced testing
  D. Announced testing and unannounced testing
  B. Blind testing and double blind testing

• Question 115:

  Hackers today have an ever-increasing list of weaknesses in the web application structure at their disposal, which they can exploit to accomplish a wide variety of malicious tasks.

  

  New flaws in web application security measures are constantly being researched, both by hackers and by security professionals. Most of these flaws affect all dynamic web applications whilst others are dependent on specific application technologies. In both cases, one may observe how the evolution and refinement of web technologies also brings about new exploits which compromise sensitive databases, provide access to theoretically secure networks, and pose a threat to the daily operation of online businesses.

  What is the biggest threat to Web 2.0 technologies?

  A. SQL Injection Attacks
  B. Service Level Configuration Attacks
  C. Inside Attacks
  D. URL Tampering Attacks
  D. URL Tampering Attacks

• Question 116:

  An external intrusion test and analysis identify security weaknesses and strengths of the client's systems and networks as they appear from outside the client's security perimeter, usually from the Internet. The goal of an external intrusion test and analysis is to demonstrate the existence of known vulnerabilities that could be exploited by an external attacker.

  

  During external penetration testing, which of the following scanning techniques allow you to determine a port's state without making a full connection to the host?

  A. XMAS Scan
  B. SYN scan
  C. FIN Scan
  D. NULL Scan
  B. SYN scan

• Question 117:

  Passwords protect computer resources and files from unauthorized access by malicious users. Using passwords is the most capable and effective way to protect information and to increase the security level of a company. Password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system to gain unauthorized access to a system.

  

  Which of the following password cracking attacks tries every combination of characters until the password is broken?

  A. Brute-force attack
  B. Rule-based attack C. Hybrid attack
  D. Dictionary attack
  A. Brute-force attack

• Question 118:

  Before performing the penetration testing, there will be a pre-contract discussion with different pen-testers (the team of penetration testers) to gather a quotation to perform pen testing.

  

  Which of the following factors is NOT considered while preparing a price quote to perform pen testing?

  A. Total number of employees in the client organization
  B. Type of testers involved
  C. The budget required
  D. Expected time required to finish the project
  A. Total number of employees in the client organization

• Question 119:

  Port numbers are used to keep track of different conversations crossing the network at the same time. Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers have the assigned ranges.

  

  Port numbers above 1024 are considered which one of the following?

  A. Dynamically assigned port numbers
  B. Statically assigned port numbers
  C. Well-known port numbers
  D. Unregistered port numbers
  C. Well-known port numbers

• Question 120:

  The objective of social engineering pen testing is to test the strength of human factors in a security chain within the organization. It is often used to raise the level of security awareness among employees.

  

  The tester should demonstrate extreme care and professionalism during a social engineering pen test as it might involve legal issues such as violation of privacy and may result in an embarrassing situation for the organization. Which of the following methods of attempting social engineering is associated with bribing, handing out gifts, and becoming involved in a personal relationship to befriend someone inside the company?

  A. Accomplice social engineering technique
  B. Identity theft
  C. Dumpster diving
  D. Phishing social engineering technique
  A. Accomplice social engineering technique