최신EC-COUNCIL EC-Council Certified Security Analyst (ECSA) - 412-79무료샘플문제
문제1
A penetration test will show you the vulnerabilities in the target system and the risks associated with it. An educated valuation of the risk will be performed so that the vulnerabilities can be reported as High/Medium/Low risk issues.
What are the two types of 'white-box' penetration testing?
A penetration test will show you the vulnerabilities in the target system and the risks associated with it. An educated valuation of the risk will be performed so that the vulnerabilities can be reported as High/Medium/Low risk issues.
What are the two types of 'white-box' penetration testing?
정답: A
문제2
Which of the following is a framework of open standards developed by the Internet Engineering Task Force (IETF) that provides secure transmission of the sensitive data over an unprotected medium, such as the Internet?
Which of the following is a framework of open standards developed by the Internet Engineering Task Force (IETF) that provides secure transmission of the sensitive data over an unprotected medium, such as the Internet?
정답: B
문제3
Which of the following is not the SQL injection attack character?
Which of the following is not the SQL injection attack character?
정답: B
문제4
Which of the following is an ARP cache poisoning technique aimed at network switches?
Which of the following is an ARP cache poisoning technique aimed at network switches?
정답: D
문제5
Which of the following information gathering techniques collects information from an organization's web-based calendar and email services?
Which of the following information gathering techniques collects information from an organization's web-based calendar and email services?
정답: D
문제6
Which of the following is the range for assigned ports managed by the Internet Assigned Numbers Authority (IANA)?
Which of the following is the range for assigned ports managed by the Internet Assigned Numbers Authority (IANA)?
정답: D
문제7
In which of the following firewalls are the incoming or outgoing packets blocked from accessing services for which there is no proxy?
In which of the following firewalls are the incoming or outgoing packets blocked from accessing services for which there is no proxy?
정답: B
문제8
John, the penetration tester in a pen test firm, was asked to find whether NTP services are opened on the target network (10.0.0.7) using Nmap tool.
Which one of the following Nmap commands will he use to find it?
John, the penetration tester in a pen test firm, was asked to find whether NTP services are opened on the target network (10.0.0.7) using Nmap tool.
Which one of the following Nmap commands will he use to find it?
정답: B
문제9
SQL injection attacks are becoming significantly more popular amongst hackers and there has been an estimated 69 percent increase of this attack type.
This exploit is used to great effect by the hacking community since it is the primary way to steal sensitive data from web applications. It takes advantage of non-validated input vulnerabilities to pass SQL commands through a web application for execution by a back-end database.
The below diagram shows how attackers launched SQL injection attacks on web applications.
Which of the following can the attacker use to launch an SQL injection attack?
SQL injection attacks are becoming significantly more popular amongst hackers and there has been an estimated 69 percent increase of this attack type.
This exploit is used to great effect by the hacking community since it is the primary way to steal sensitive data from web applications. It takes advantage of non-validated input vulnerabilities to pass SQL commands through a web application for execution by a back-end database.
The below diagram shows how attackers launched SQL injection attacks on web applications.
Which of the following can the attacker use to launch an SQL injection attack?
정답: A
문제10
Which of the following is not a characteristic of a firewall?
Which of the following is not a characteristic of a firewall?
정답: A
문제11
In a TCP packet filtering firewall, traffic is filtered based on specified session rules, such as when a session is initiated by a recognized computer.
Identify the level up to which the unknown traffic is allowed into the network stack.
In a TCP packet filtering firewall, traffic is filtered based on specified session rules, such as when a session is initiated by a recognized computer.
Identify the level up to which the unknown traffic is allowed into the network stack.
정답: B
문제12
Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.
Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes.
Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?
Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.
Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes.
Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?
정답: C
문제13
Which vulnerability assessment phase describes the scope of the assessment, identifies and ranks the critical assets, and creates proper information protection procedures such as effective planning, scheduling, coordination, and logistics?
Which vulnerability assessment phase describes the scope of the assessment, identifies and ranks the critical assets, and creates proper information protection procedures such as effective planning, scheduling, coordination, and logistics?
정답: D