Summer Special Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

ECCouncil 412-79v10 EC-Council Certified Security Analyst (ECSA) V10 Exam Practice Test

Page: 1 / 20
Total 201 questions

EC-Council Certified Security Analyst (ECSA) V10 Questions and Answers

Question 1

Besides the policy implications of chat rooms, Internet Relay Chat (IRC) is frequented by attackers and used as a command and control mechanism. IRC normally uses which one of the following TCP ports?

Options:

A.

6566 TCP port

B.

6771 TCP port

C.

6667 TCP port

D.

6257 TCP port

Question 2

How many bits is Source Port Number in TCP Header packet?

Options:

A.

48

B.

32

C.

64

D.

16

Question 3

Information gathering is performed to:

i) Collect basic information about the target company and its network

ii) Determine the operating system used, platforms running, web server versions, etc.

iii) Find vulnerabilities and exploits

Question # 3

Which of the following pen testing tests yields information about a company’s technology infrastructure?

Options:

A.

Searching for web page posting patterns

B.

Analyzing the link popularity of the company’s website

C.

Searching for trade association directories

D.

Searching for a company’s job postings

Question 4

What are the scanning techniques that are used to bypass firewall rules and logging mechanisms and disguise themselves as usual network traffic?

Options:

A.

Connect Scanning Techniques

B.

SYN Scanning Techniques

C.

Stealth Scanning Techniques

D.

Port Scanning Techniques

Question 5

Which one of the following scans starts, but does not complete the TCP handshake sequence for each port selected, and it works well for direct scanning and often works well through firewalls?

Options:

A.

SYN Scan

B.

Connect() scan

C.

XMAS Scan

D.

Null Scan

Question 6

In Linux, what is the smallest possible shellcode?

Options:

A.

800 bytes

B.

8 bytes

C.

80 bytes

D.

24 bytes

Question 7

Security auditors determine the use of WAPs on their networks with Nessus vulnerability scanner which identifies the commonly used WAPs.

One of the plug-ins that the Nessus Vulnerability Scanner uses is ID #11026 and is named “Access Point Detection”. This plug-in uses four techniques to identify the presence of a WAP.

Which one of the following techniques is mostly used for uploading new firmware images while upgrading the WAP device?

Options:

A.

NMAP TCP/IP fingerprinting

B.

HTTP fingerprinting

C.

FTP fingerprinting

D.

SNMP fingerprinting

Question 8

The first phase of the penetration testing plan is to develop the scope of the project in consultation with the client. Pen testing test components depend on the client’s operating environment, threat perception, security and compliance requirements, ROE, and budget.

Various components need to be considered for testing while developing the scope of the project.

Question # 8

Which of the following is NOT a pen testing component to be tested?

Options:

A.

System Software Security

B.

Intrusion Detection

C.

Outside Accomplices

D.

Inside Accomplices

Question 9

Which of the following is the objective of Gramm-Leach-Bliley Act?

Options:

A.

To ease the transfer of financial information between institutions and banks

B.

To protect the confidentiality, integrity, and availability of data

C.

To set a new or enhanced standards for all U.S. public company boards, management and public accounting firms

D.

To certify the accuracy of the reported financial statement

Question 10

Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies.

A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces.

What could have prevented this information from being stolen from the laptops?

Options:

A.

SDW Encryption

B.

EFS Encryption

C.

DFS Encryption

D.

IPS Encryption

Question 11

You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:

http://172.168.4.131/level/99/exec/show/config

After typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

Options:

A.

URL Obfuscation Arbitrary Administrative Access Vulnerability

B.

Cisco IOS Arbitrary Administrative Access Online Vulnerability

C.

HTTP Configuration Arbitrary Administrative Access Vulnerability

D.

HTML Configuration Arbitrary Administrative Access Vulnerability

Question 12

An automated electronic mail message from a mail system which indicates that the user does not exist on that server is called as?

Options:

A.

SMTP Queue Bouncing

B.

SMTP Message Bouncing

C.

SMTP Server Bouncing

D.

SMTP Mail Bouncing

Question 13

The Internet is a giant database where people store some of their most private information on the cloud, trusting that the service provider can keep it all safe. Trojans, Viruses, DoS attacks, website defacement, lost computers, accidental publishing, and more have all been sources of major leaks over the last 15 years.

Question # 13

What is the biggest source of data leaks in organizations today?

Options:

A.

Weak passwords and lack of identity management

B.

Insufficient IT security budget

C.

Rogue employees and insider attacks

D.

Vulnerabilities, risks, and threats facing Web sites

Question 14

Which one of the following is a command line tool used for capturing data from the live network and copying those packets to a file?

Options:

A.

Wireshark: Capinfos

B.

Wireshark: Tcpdump

C.

Wireshark: Text2pcap

D.

Wireshark: Dumpcap

Question 15

To locate the firewall, SYN packet is crafted using Hping or any other packet crafter and sent to the firewall. If ICMP unreachable type 13 message (which is an admin prohibited packet) with a source IP address of the access control device is received, then it means which of the following type of firewall is in place?

Options:

A.

Circuit level gateway

B.

Stateful multilayer inspection firewall

C.

Packet filter

D.

Application level gateway

Question 16

A firewall’s decision to forward or reject traffic in network filtering is dependent upon which of the following?

Options:

A.

Destination address

B.

Port numbers

C.

Source address

D.

Protocol used

Question 17

Amazon, an IT based company, conducts a survey on the usage of the Internet. They found that company employees spend most of the time at work surfing the web for their personal use and for inappropriate web site viewing. Management decide to block all such web sites using URL filtering software.

Question # 17

How can employees continue to see the blocked websites?

Options:

A.

Using session hijacking

B.

Using proxy servers

C.

Using authentication

D.

Using encryption

Question 18

Transmission Control Protocol (TCP) is a connection-oriented four layer protocol. It is responsible for breaking messages into segments, re-assembling them at the destination station, and re-sending. Which one of the following protocols does not use the TCP?

Options:

A.

Reverse Address Resolution Protocol (RARP)

B.

HTTP (Hypertext Transfer Protocol)

C.

SMTP (Simple Mail Transfer Protocol)

D.

Telnet

Question 19

Which of the following statement holds true for TCP Operation?

Question # 19

Options:

A.

Port numbers are used to know which application the receiving host should pass the data to

B.

Sequence numbers are used to track the number of packets lost in transmission

C.

Flow control shows the trend of a transmitting host overflowing the buffers in the receiving host

D.

Data transfer begins even before the connection is established

Question 20

You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using Idp.exe.

What are you trying to accomplish here?

Options:

A.

Poison the DNS records with false records

B.

Enumerate MX and A records from DNS

C.

Establish a remote connection to the Domain Controller

D.

Enumerate domain user accounts and built-in groups

Question 21

Firewall and DMZ architectures are characterized according to its design. Which one of the following architectures is used when routers have better high-bandwidth data stream handling capacity?

Options:

A.

Weak Screened Subnet Architecture

B.

"Inside Versus Outside" Architecture

C.

"Three-Homed Firewall" DMZ Architecture

D.

Strong Screened-Subnet Architecture

Question 22

Which of the following equipment could a pen tester use to perform shoulder surfing?

Options:

A.

Binoculars

B.

Painted ultraviolet material

C.

Microphone

D.

All the above

Question 23

Which of the following will not handle routing protocols properly?

Options:

A.

“Internet-router-firewall-net architecture”

B.

“Internet-firewall-router-net architecture”

C.

“Internet-firewall -net architecture”

D.

“Internet-firewall/router(edge device)-net architecture”

Question 24

Which Wireshark filter displays all the packets where the IP address of the source host is 10.0.0.7?

Question # 24

Options:

A.

ip.dst==10.0.0.7

B.

ip.port==10.0.0.7

C.

ip.src==10.0.0.7

D.

ip.dstport==10.0.0.7

Question 25

A chipset is a group of integrated circuits that are designed to work together and are usually marketed as a single product.” It is generally the motherboard chips or the chips used on the expansion card.

Which one of the following is well supported in most wireless applications?

Options:

A.

Orinoco chipsets

B.

Prism II chipsets

C.

Atheros Chipset

D.

Cisco chipset

Question 26

Which of the following is not a characteristic of a firewall?

Options:

A.

Manages public access to private networked resources

B.

Routes packets between the networks

C.

Examines all traffic routed between the two networks to see if it meets certain criteria

D.

Filters only inbound traffic but not outbound traffic

Question 27

Identify the type of testing that is carried out without giving any information to the employees or administrative head of the organization.

Options:

A.

Unannounced Testing

B.

Double Blind Testing

C.

Announced Testing

D.

Blind Testing

Question 28

An antenna is a device that is designed to transmit and receive the electromagnetic waves that are generally called radio waves. Which one of the following types of antenna is developed from waveguide technology?

Options:

A.

Leaky Wave Antennas

B.

Aperture Antennas

C.

Reflector Antenna

D.

Directional Antenna

Question 29

Which one of the following log analysis tools is used for analyzing the server’s log files?

Options:

A.

Performance Analysis of Logs tool

B.

Network Sniffer Interface Test tool

C.

Ka Log Analyzer tool

D.

Event Log Tracker tool

Question 30

Before performing the penetration testing, there will be a pre-contract discussion with different pen-testers (the team of penetration testers) to gather a quotation to perform pen testing.

Question # 30

Which of the following factors is NOT considered while preparing a price quote to perform pen testing?

Options:

A.

Total number of employees in the client organization

B.

Type of testers involved

C.

The budget required

D.

Expected time required to finish the project

Page: 1 / 20
Total 201 questions