EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 121:

  Today, most organizations would agree that their most valuable IT assets reside within applications and databases. Most would probably also agree that these are areas that have the weakest levels of security, thus making them the prime target for malicious activity from system administrators, DBAs, contractors, consultants, partners, and customers.

  

  Which of the following flaws refers to an application using poorly written encryption code to securely encrypt and store sensitive data in the database and allows an attacker to steal or modify weakly protected data such as credit card numbers, SSNs, and other authentication credentials?

  A. SSI injection attack
  B. Insecure cryptographic storage attack
  C. Hidden field manipulation attack
  D. Man-in-the-Middle attack
  B. Insecure cryptographic storage attack

• Question 122:

  An automated electronic mail message from a mail system which indicates that the user does not exist on that server is called as?

  A. SMTP Queue Bouncing
  B. SMTP Message Bouncing
  C. SMTP Server Bouncing
  D. SMTP Mail Bouncing
  B. SMTP Message Bouncing

• Question 123:

  Which of the following attacks does a hacker perform in order to obtain UDDI information such as businessEntity, businesService, bindingTemplate, and tModel?

  A. Web Services Footprinting Attack
  B. Service Level Configuration Attacks
  C. URL Tampering Attacks
  D. Inside Attacks
  A. Web Services Footprinting Attack

• Question 124:

  Fuzz testing or fuzzing is a software/application testing technique used to discover coding errors and security loopholes in software, operating systems, or networks by inputting massive amounts of random data, called fuzz, to the system in

  an attempt to make it crash.

  Fuzzers work best for problems that can cause a program to crash, such as buffer overflow, cross-site scripting, denial of service attacks, format bugs, and SQL injection.

  Fuzzer helps to generate and submit a large number of inputs supplied to the application for testing it against the inputs. This will help us to identify the SQL inputs that generate malicious output.

  Suppose a pen tester knows the underlying structure of the database used by the application (i.e., name, number of columns, etc.) that she is testing.

  Which of the following fuzz testing she will perform where she can supply specific data to the application to discover vulnerabilities?

  A. Clever Fuzz Testing
  B. Dumb Fuzz Testing
  C. Complete Fuzz Testing
  D. Smart Fuzz Testing
  C. Complete Fuzz Testing

• Question 125:

  What are the 6 core concepts in IT security?

  

  A. Server management, website domains, firewalls, IDS, IPS, and auditing
  B. Authentication, authorization, confidentiality, integrity, availability, and non-repudiation
  C. Passwords, logins, access controls, restricted domains, configurations, and tunnels
  D. Biometrics, cloud security, social engineering, DoS attack, viruses, and Trojans
  B. Authentication, authorization, confidentiality, integrity, availability, and non-repudiation

• Question 126:

  Which of the following pen testing reports provides detailed information about all the tasks performed during penetration testing?

  

  A. Client-Side Test Report
  B. Activity Report
  C. Host Report
  D. Vulnerability Report
  B. Activity Report

• Question 127:

  TCP/IP model is a framework for the Internet Protocol suite of computer network protocols that defines the communication in an IP-based network. It provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination. This functionality has been organized into four abstraction layers which are used to sort all related protocols according to the scope of networking involved.

  

  Which of the following TCP/IP layers selects the best path through the network for packets to travel?

  A. Transport layer
  B. Network Access layer
  C. Internet layer
  D. Application layer
  B. Network Access layer

• Question 128:

  Which of the following policy forbids everything with strict restrictions on all usage of the company systems and network?

  A. Information-Protection Policy
  B. Paranoid Policy
  C. Promiscuous Policy
  D. Prudent Policy
  B. Paranoid Policy

• Question 129:

  From where can clues about the underlying application environment can be collected?

  A. From the extension of the file
  B. From executable file
  C. From file types and directories
  D. From source code
  D. From source code

• Question 130:

  Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

  

  Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes.

  Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.

  What can a pen tester do to detect input sanitization issues?

  A. Send single quotes as the input data to catch instances where the user input is not sanitized
  B. Send double quotes as the input data to catch instances where the user input is not sanitized
  C. Send long strings of junk data, just as you would send strings to detect buffer overruns
  D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization
  D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization