EC-COUNCIL EC-COUNCIL Certifications 412-79V10 Questions & Answers

• Question 71:

  A security policy is a document or set of documents that describes, at a high level, the security controls that will be implemented by the company. Which one of the following policies forbids everything and restricts usage of company computers, whether it is system usage or network usage?

  A. Paranoid Policy

  B. Prudent Policy

  C. Promiscuous Policy

  D. Information-Protection Policy

  Correct Answer: A

• Question 72:

  Identify the type of testing that is carried out without giving any information to the employees or administrative head of the organization.

  A. Unannounced Testing

  B. Double Blind Testing

  C. Announced Testing

  D. Blind Testing

  Correct Answer: B

• Question 73:

  Traffic on which port is unusual for both the TCP and UDP ports?

  A. Port 81

  B. Port 443

  C. Port 0

  D. Port21

  Correct Answer: C

• Question 74:

  Amazon, an IT based company, conducts a survey on the usage of the Internet. They found that company employees spend most of the time at work surfing the web for their personal use and for inappropriate web site viewing. Management decide to block all such web sites using URL filtering software.

  

  How can employees continue to see the blocked websites?

  A. Using session hijacking

  B. Using proxy servers

  C. Using authentication

  D. Using encryption

  Correct Answer: B

• Question 75:

  In the process of hacking a web application, attackers manipulate the HTTP requests to subvert the application authorization schemes by modifying input fields that relate to the user ID, username, access group, cost, file names, file identifiers, etc. They first access the web application using a low privileged account and then escalate privileges to access protected resources. What attack has been carried out?

  A. XPath Injection Attack

  B. Authorization Attack

  C. Authentication Attack

  D. Frame Injection Attack

  Correct Answer: B

  Reference: http://luizfirmino.blogspot.com/2011_09_01_archive.html (see authorization attack)

• Question 76:

  Which type of security policy applies to the below configuration? i)Provides maximum security while allowing known, but necessary, dangers ii)All services are blocked; nothing is allowed iii)Safe and necessary services are enabled individually iv)Non-essential services and procedures that cannot be made safe are NOT allowed v)Everything is logged

  

  A. Paranoid Policy

  B. Prudent Policy

  C. Permissive Policy

  D. Promiscuous Policy

  Correct Answer: B

• Question 77:

  Which of the following acts related to information security in the US establish that the management of an organization is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting?

  A. USA Patriot Act 2001

  B. Sarbanes-Oxley 2002

  C. Gramm-Leach-Bliley Act (GLBA)

  D. California SB 1386

  Correct Answer: A

  Reference: http://www.sec.gov/rules/final/33-8238.htm (see background)

• Question 78:

  What are the 6 core concepts in IT security?

  

  A. Server management, website domains, firewalls, IDS, IPS, and auditing

  B. Authentication, authorization, confidentiality, integrity, availability, and non-repudiation

  C. Passwords, logins, access controls, restricted domains, configurations, and tunnels

  D. Biometrics, cloud security, social engineering, DoS attack, viruses, and Trojans

  Correct Answer: B

• Question 79:

  You work as an IT security auditor hired by a law firm in Boston. You have been assigned the responsibility to audit the client for security risks. When assessing the risk to the clients network, what step should you take first?

  A. Analyzing, categorizing and prioritizing resources

  B. Evaluating the existing perimeter and internal security

  C. Checking for a written security policy

  D. Analyzing the use of existing management and control architecture

  Correct Answer: C

• Question 80:

  From where can clues about the underlying application environment can be collected?

  A. From the extension of the file

  B. From executable file

  C. From file types and directories

  D. From source code

  Correct Answer: A