EC-COUNCIL ECSA ECSAv8 Questions & Answers

• Question 121:

  This is a group of people hired to give details of the vulnerabilities present in the system found after a penetration test. They are elite and extremely competent penetration testers and intrusion analysts. This team prepares a report on the vulnerabilities in the system, attack methods, and how to defend against them.

  

  What is this team called?

  A. Blue team

  B. Tiger team

  C. Gorilla team

  D. Lion team

  Correct Answer: B

• Question 122:

  ARP spoofing is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

  ARP spoofing attack is used as an opening for other attacks.

  

  What type of attack would you launch after successfully deploying ARP spoofing?

  A. Parameter Filtering

  B. Social Engineering

  C. Input Validation

  D. Session Hijacking

  Correct Answer: D

  Reference: http://en.wikipedia.org/wiki/ARP_spoofing

• Question 123:

  Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit. Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

  

  Which agreement requires a signature from both the parties (the penetration tester and the company)?

  A. Non-disclosure agreement

  B. Client fees agreement

  C. Rules of engagement agreement

  D. Confidentiality agreement

  Correct Answer: D

• Question 124:

  John, the penetration testing manager in a pen testing firm, needs to prepare a pen testing pricing report

  for a client.

  Which of the following factors does he need to consider while preparing the pen testing pricing report?

  

  A. Number of employees in the client organization

  B. Complete structure of the organization

  C. Number of client computers to be tested and resources required to perform a pen test

  D. Number of servers available in the client organization

  Correct Answer: B

• Question 125:

  A wireless intrusion detection system (WIDS) monitors the radio spectrum for the presence of unauthorized, rogue access points and the use of wireless attack tools. The system monitors the radio spectrum used by wireless LANs, and immediately alerts a systems administrator whenever a rogue access point is detected.

  Conventionally it is achieved by comparing the MAC address of the participating wireless devices.

  Which of the following attacks can be detected with the help of wireless intrusion detection system (WIDS)?

  

  A. Social engineering

  B. SQL injection

  C. Parameter tampering

  D. Man-in-the-middle attack

  Correct Answer: D

  Reference: http://www.infosecwriters.com/text_resources/pdf/Wireless_IDS_JDixon.pdf (page 5)

• Question 126:

  Which of the following approaches to vulnerability assessment relies on the administrator providing baseline of system configuration and then scanning continuously without incorporating any information found at the time of scanning?

  

  A. Service-based Assessment Solutions

  B. Product-based Assessment Solutions

  C. Tree-based Assessment

  D. Inference-based Assessment

  Correct Answer: C

  Reference: http://www.netsense.info/downloads/security_wp_mva.pdf (page 12, tree-based assessment technology, second para)

• Question 127:

  The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.

  This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.

  

  What is the best way to protect web applications from parameter tampering attacks?

  A. Validating some parameters of the web application

  B. Minimizing the allowable length of parameters

  C. Using an easily guessable hashing algorithm

  D. Applying effective input field filtering parameters

  Correct Answer: B

• Question 128:

  Identify the injection attack represented in the diagram below:

  

  A. XPath Injection Attack

  B. XML Request Attack

  C. XML Injection Attack

  D. Frame Injection Attack

  Correct Answer: C

  Reference: http://projects.webappsec.org/w/page/13247004/XML%20Injection

• Question 129:

  Which Wireshark filter displays all the packets where the IP address of the source host is 10.0.0.7?

  

  A. ip.dst==10.0.0.7

  B. ip.port==10.0.0.7

  C. ip.src==10.0.0.7

  D. ip.dstport==10.0.0.7

  Correct Answer: C

• Question 130:

  Which of the following statements is true about the LM hash?

  A. Disabled in Windows Vista and 7 OSs

  B. Separated into two 8-character strings

  C. Letters are converted to the lowercase

  D. Padded with NULL to 16 characters

  Correct Answer: A

  Reference: http://www.onlinehashcrack.com/how_to_crack_windows_passwords.php (first paragraph of the page)