EC-COUNCIL EC-COUNCIL Certifications ECSAV10 Questions & Answers

• Question 171:

  Which of the following statements is true about the LM hash?

  A. Disabled in Windows Vista and 7 OSs

  B. Separated into two 8-character strings

  C. Letters are converted to the lowercase

  D. Padded with NULL to 16 characters

  Correct Answer: A

• Question 172:

  Which of the following password hashing algorithms is used in the NTLMv2 authentication mechanism?

  A. AES

  B. DES (ECB mode)

  C. MD5

  D. RC5

  Correct Answer: C

• Question 173:

  Which of the following protocols cannot be used to filter VoIP traffic?

  A. Media Gateway Control Protocol (MGCP)

  B. Real-time Transport Control Protocol (RTCP)

  C. Session Description Protocol (SDP)

  D. Real-Time Publish Subscribe (RTPS)

  Correct Answer: D

• Question 174:

  What is the target host IP in the following command?

  C:\> firewalk -F 80 10.10.150.1 172.16.28.95 -p UDP

  A. Firewalk does not scan target hosts

  B. 172.16.28.95

  C. This command is using FIN packets, which cannot scan target hosts

  D. 10.10.150.1

  Correct Answer: A

• Question 175:

  Which of the following contents of a pen testing project plan addresses the strengths, weaknesses, opportunities, and threats involved in the project?

  A. Project Goal

  B. Success Factors

  C. Objectives

  D. Assumptions

  Correct Answer: D

• Question 176:

  You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California; Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

  A. Use attack as a launching point to penetrate deeper into the network

  B. Demonstrate that no system can be protected against DoS attacks

  C. List weak points on their network

  D. Show outdated equipment so it can be replaced

  Correct Answer: C

• Question 177:

  Variables are used to define parameters for detection, specifically those of your local network and/or specific servers or ports for inclusion or exclusion in rules. These are simple substitution variables set with the var keyword. Which one of the following operator is used to define meta-variables?

  A. "$"

  B. "#"

  C. "*"

  D. "?"

  Correct Answer: A

• Question 178:

  Which Wireshark filter displays all the packets where the IP address of the source host is 10.0.0.7?

  

  A. ip.dst==10.0.0.7

  B. ip.port==10.0.0.7

  C. ip.src==10.0.0.7

  D. ip.dstport==10.0.0.7

  Correct Answer: C

• Question 179:

  You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network. How would you answer?

  A. IBM Methodology

  B. LPT Methodology

  C. Google Methodology

  D. Microsoft Methodology

  Correct Answer: B

• Question 180:

  The IP protocol was designed for use on a wide variety of transmission links. Although the maximum length of an IP datagram is 64K, most transmission links enforce a smaller maximum packet length limit, called a MTU. The value of the MTU depends on the type of the transmission link. The design of IP accommodates MTU differences by allowing routers to fragment IP datagrams as necessary. The receiving station is responsible for reassembling the fragments back into the original full size IP datagram. IP fragmentation involves breaking a datagram into a number of pieces that can be reassembled later. The IP source, destination, identification, total length, and fragment offset fields in the IP header, are used for IP fragmentation and reassembly.

  

  The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a:

  A. Multiple of four bytes

  B. Multiple of two bytes

  C. Multiple of eight bytes

  D. Multiple of six bytes

  Correct Answer: C