EC-COUNCIL EC-COUNCIL Certifications ECSAV10 Questions & Answers

• Question 181:

  George is the network administrator of a large Internet company on the west coast. Per corporate policy,

  none of the employees in the company are allowed to use FTP or SFTP programs without obtaining

  approval from the IT department.

  Few managers are using SFTP program on their computers.

  Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal

  to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in

  Ethereal?

  A. net port 22

  B. udp port 22 and host 172.16.28.1/24

  C. src port 22 and dst port 22

  D. src port 23 and dst port 23

  Correct Answer: C

• Question 182:

  Which of the following acts related to information security in the US establish that the management of an organization is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting?

  A. USA Patriot Act 2001

  B. Sarbanes-Oxley 2002

  C. Gramm-Leach-Bliley Act (GLBA)

  D. California SB 1386

  Correct Answer: B

• Question 183:

  John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

  A. The SID of Hillary's network account

  B. The network shares that Hillary has permissions

  C. The SAM file from Hillary's computer

  D. Hillary's network username and password hash

  Correct Answer: D

• Question 184:

  Which one of the following log analysis tools is used for analyzing the server's log files?

  A. Performance Analysis of Logs tool

  B. Network Sniffer Interface Test tool

  C. Ka Log Analyzer tool

  D. Event Log Tracker tool

  Correct Answer: C

• Question 185:

  The first and foremost step for a penetration test is information gathering. The main objective of this test is to gather information about the target system which can be used in a malicious manner to gain access to the target systems.

  

  Which of the following information gathering terminologies refers to gathering information through social engineering on-site visits, face-to-face interviews, and direct questionnaires?

  A. Active Information Gathering

  B. Pseudonymous Information Gathering

  C. Anonymous Information Gathering

  D. Open Source or Passive Information Gathering

  Correct Answer: A

• Question 186:

  Vulnerability assessment is an examination of the ability of a system or application, including current security procedures and controls, to withstand assault. It recognizes, measures, and classifies security vulnerabilities in a computer system, network, and communication channels. A vulnerability assessment is used to identify weaknesses that could be exploited and predict the effectiveness of additional security measures in protecting information resources from attack.

  

  Which of the following vulnerability assessment technique is used to test the web server infrastructure for any misconfiguration and outdated content?

  A. Passive Assessment

  B. Host-based Assessment

  C. External Assessment

  D. Application Assessment

  Correct Answer: D

• Question 187:

  What are the security risks of running a "repair" installation for Windows XP?

  A. There are no security risks when running the "repair" installation for Windows XP

  B. Pressing Shift+F1 gives the user administrative rights

  C. Pressing Ctrl+F10 gives the user administrative rights

  D. Pressing Shift+F10 gives the user administrative rights

  Correct Answer: D

• Question 188:

  Software firewalls work at which layer of the OSI model?

  A. Data Link

  B. Network

  C. Transport

  D. Application

  Correct Answer: A

• Question 189:

  The Internet is a giant database where people store some of their most private information on the cloud, trusting that the service provider can keep it all safe. Trojans, Viruses, DoS attacks, website defacement, lost computers, accidental publishing, and more have all been sources of major leaks over the last 15 years.

  

  What is the biggest source of data leaks in organizations today?

  A. Weak passwords and lack of identity management B. Insufficient IT security budget

  C. Rogue employees and insider attacks

  D. Vulnerabilities, risks, and threats facing Web sites

  Correct Answer: C

• Question 190:

  Which vulnerability assessment phase describes the scope of the assessment, identifies and ranks the critical assets, and creates proper information protection procedures such as effective planning, scheduling, coordination, and logistics?

  A. Threat-Assessment Phase

  B. Pre-Assessment Phase

  C. Assessment Phase

  D. Post-Assessment Phase

  Correct Answer: B