EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 41:

  Identify the type of testing that is carried out without giving any information to the employees or administrative head of the organization.

  A. Unannounced Testing
  B. Double Blind Testing
  C. Announced Testing
  D. Blind Testing
  A. Unannounced Testing

• Question 42:

  Information gathering is performed to:

  i) Collect basic information about the target company and its network

  ii) Determine the operating system used, platforms running, web server versions, etc.

  iii) Find vulnerabilities and exploits

  

  Which of the following pen testing tests yields information about a company's technology infrastructure?

  A. Searching for web page posting patterns
  B. Analyzing the link popularity of the company's website
  C. Searching for trade association directories
  D. Searching for a company's job postings
  A. Searching for web page posting patterns

• Question 43:

  Identify the data security measure which defines a principle or state that ensures that an action or transaction cannot be denied.

  A. Availability
  B. Integrity
  C. Authorization
  D. Non-Repudiation
  D. Non-Repudiation

• Question 44:

  In the process of hacking a web application, attackers manipulate the HTTP requests to subvert the application authorization schemes by modifying input fields that relate to the user ID, username, access group, cost, file names, file identifiers, etc. They first access the web application using a low privileged account and then escalate privileges to access protected resources. What attack has been carried out?

  A. XPath Injection Attack
  B. Authorization Attack
  C. Authentication Attack
  D. Frame Injection Attack
  B. Authorization Attack

• Question 45:

  The first phase of the penetration testing plan is to develop the scope of the project in consultation with the client. Pen testing test components depend on the client's operating environment, threat perception, security and compliance requirements, ROE, and budget. Various components need to be considered for testing while developing the scope of the project.

  

  Which of the following is NOT a pen testing component to be tested?

  A. System Software Security
  B. Intrusion Detection
  C. Outside Accomplices
  D. Inside Accomplices
  C. Outside Accomplices

• Question 46:

  A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML) statement should only affect rows that meet specified criteria. The criteria are expressed in the form of predicates. WHERE clauses are not mandatory clauses of SQL DML statements, but can be used to limit the number of rows affected by a SQL DML statement or returned by a query.

  

  A pen tester is trying to gain access to a database by inserting exploited query statements with a WHERE clause. The pen tester wants to retrieve all the entries from the database using the WHERE clause from a particular table (e.g. StudentTable).

  What query does he need to write to retrieve the information?

  A. EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000
  B. DUMP * FROM StudentTable WHERE roll_number = 1 AND 1=1-
  C. SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1`
  D. RETRIVE * FROM StudentTable WHERE roll_number = 1'#
  C. SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1`

• Question 47:

  The term social engineering is used to describe the various tricks used to fool people (employees, business partners, or customers) into voluntarily giving away information that would not normally be known to the general public.

  

  What is the criminal practice of social engineering where an attacker uses the telephone system in an attempt to scam the user into surrendering private information?

  A. Phishing
  B. Spoofing C. Tapping
  D. Vishing
  A. Phishing

• Question 48:

  Which of the following password hashing algorithms is used in the NTLMv2 authentication mechanism?

  A. AES
  B. DES (ECB mode)
  C. MD5
  D. RC5
  C. MD5

• Question 49:

  The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.

  This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.

  

  What is the best way to protect web applications from parameter tampering attacks?

  A. Validating some parameters of the web application
  B. Minimizing the allowable length of parameters
  C. Using an easily guessable hashing algorithm
  D. Applying effective input field filtering parameters
  B. Minimizing the allowable length of parameters

• Question 50:

  Choose the correct option to define the Prefix Length.

  

  A. Prefix Length = Subnet + Host portions
  B. Prefix Length = Network + Host portions
  C. Prefix Length = Network + Subnet portions
  D. Prefix Length = Network + Subnet + Host portions
  D. Prefix Length = Network + Subnet + Host portions