EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 11:

  Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit. Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

  

  Which agreement requires a signature from both the parties (the penetration tester and the company)?

  A. Non-disclosure agreement
  B. Client fees agreement
  C. Rules of engagement agreement
  D. Confidentiality agreement
  D. Confidentiality agreement

• Question 12:

  Which of the following are the default ports used by NetBIOS service?

  A. 135, 136, 139, 445
  B. 134, 135, 136, 137
  C. 137, 138, 139, 140
  D. 133, 134, 139, 142
  C. 137, 138, 139, 140

• Question 13:

  What is the difference between penetration testing and vulnerability testing?

  

  A. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of `in-depth ethical hacking'
  B. Penetration testing is based on purely online vulnerability analysis while vulnerability testing engages ethical hackers to find vulnerabilities
  C. Vulnerability testing is more expensive than penetration testing
  D. Penetration testing is conducted purely for meeting compliance standards while vulnerability testing is focused on online scans
  A. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of `in-depth ethical hacking'

• Question 14:

  A pen tester has extracted a database name by using a blind SQL injection. Now he begins to test the table inside the database using the below query and finds the table: http://juggyboy.com/page.aspx?id=1; IF (LEN(SELECT TOP 1 NAME from sysobjects where xtype='U')=3) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=101) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),2,1)))=109) WAITFOR DELAY '00:00:10'-http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),3,1)))=112) WAITFOR DELAY '00:00:10'-What is the table name?

  A. CTS
  B. QRT
  C. EMP
  D. ABC
  C. EMP

• Question 15:

  By default, the TFTP server listens on UDP port 69. Which of the following utility reports the port status of target TCP and UDP ports on a local or a remote computer and is used to troubleshoot TCP/IP connectivity issues?

  A. PortQry
  B. Netstat
  C. Telnet
  D. Tracert
  A. PortQry

• Question 16:

  Many security and compliance projects begin with a simple idea: assess the organization's risk, vulnerabilities, and breaches. Implementing an IT security risk assessment is critical to the overall security posture of any organization. An effective security risk assessment can prevent breaches and reduce the impact of realized breaches.

  

  What is the formula to calculate risk?

  A. Risk = Budget x Time
  B. Risk = Goodwill x Reputation
  C. Risk = Loss x Exposure factor
  D. Risk = Threats x Attacks
  C. Risk = Loss x Exposure factor

• Question 17:

  Which of the following appendices gives detailed lists of all the technical terms used in the report?

  A. Required Work Efforts
  B. References
  C. Research
  D. Glossary
  D. Glossary

• Question 18:

  A directory traversal (or path traversal) consists in exploiting insufficient security validation/sanitization of user-supplied input file names, so that characters representing "traverse to parent directory" are passed through to the file APIs.

  The goal of this attack is to order an application to access a computer file that is not intended to be accessible. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code.

  

  To perform a directory traversal attack, which sequence does a pen tester need to follow to manipulate variables of reference files?

  A. dot-dot-slash (../) sequence B. Denial-of-Service sequence
  C. Brute force sequence
  D. SQL Injection sequence
  A. dot-dot-slash (../) sequence B. Denial-of-Service sequence

• Question 19:

  Which of the following is the range for assigned ports managed by the Internet Assigned Numbers Authority (IANA)?

  A. 3001-3100
  B. 5000-5099
  C. 6666-6674
  D. 0 ?1023
  D. 0 ?1023

• Question 20:

  Attackers create secret accounts and gain illegal access to resources using backdoor while bypassing the authentication procedures. Creating a backdoor is a where an attacker obtains remote access to a computer on a network.

  

  Which of the following techniques do attackers use to create backdoors to covertly gather critical information about a target machine?

  A. Internal network mapping to map the internal network of the target machine
  B. Port scanning to determine what ports are open or in use on the target machine
  C. Sniffing to monitor all the incoming and outgoing network traffic
  D. Social engineering and spear phishing attacks to install malicious programs on the target machine
  D. Social engineering and spear phishing attacks to install malicious programs on the target machine