EC-COUNCIL EC-COUNCIL Certifications ECSAV10 Questions & Answers

• Question 201:

  Which of the following is the range for assigned ports managed by the Internet Assigned Numbers Authority (IANA)?

  A. 3001-3100

  B. 5000-5099

  C. 6666-6674

  D. 0 - 1023

  Correct Answer: D

• Question 202:

  Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

  A. Filtered

  B. Stealth

  C. Closed

  D. Open

  Correct Answer: D

• Question 203:

  Why is a legal agreement important to have before launching a penetration test?

  

  A. Guarantees your consultant fees

  B. Allows you to perform a penetration test without the knowledge and consent of the organization's upper management

  C. It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.

  D. It is important to ensure that the target organization has implemented mandatory security policies

  Correct Answer: C

• Question 204:

  Karen was running port scans on each machine of her network in order to identify suspicious ports on the target machines. She observed the following results during the port scan of a particular machine.

  I. Some of the ports were not being acknowledged, i.e. no acknowledgment from the target machine

  II. Some ports were responding with SYN + ACK packets

  III. Some ports were responding with an RST packet

  What should she interpret for the ports that did not return the acknowledgement?

  A. She should that those ports as Closed ports

  B. She should that those ports as Open ports

  C. She should that those ports as Stealth ports

  D. She should that those ports as Half Open ports

  Correct Answer: C

• Question 205:

  What is the difference between penetration testing and vulnerability testing?

  

  A. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of `in-depth ethical hacking'

  B. Penetration testing is based on purely online vulnerability analysis while vulnerability testing engages ethical hackers to find vulnerabilities

  C. Vulnerability testing is more expensive than penetration testing

  D. Penetration testing is conducted purely for meeting compliance standards while vulnerability testing is focused on online scans

  Correct Answer: A

• Question 206:

  A disgruntled employee Robert targeted to acquire business secrets of the organization he is working in and wants to sell the same to a competing organization for some financial gain. He started gathering information about the organization and somehow came to know that the organization is conducting a meeting to discuss future business plans. To collect the information about the organization's business plans, he had built a listening device housed in his bag and arrived the meeting location wearing a suit and tie. One of the employees of the organization thought he was a senior executive from other branch who came to attend the meeting and readily took him to the meeting room. Robert waited until that employee left the meeting room and planted listening devices at multiple places in the room. Then, he went outside the building and started listening and recorded all the conversations in the meeting. Identify the type of attack being performed by Robert on the target organization?

  A. Vishing

  B. Phishing

  C. Shoulder surfing

  D. Eavesdropping

  Correct Answer: D

• Question 207:

  A company identified critical vulnerability in its hyperconverged infrastructure that provides services such as computing, networking, and storage resources in a single system. Also, the company identified that this vulnerability may lead to various injection attacks that allow the attackers to execute malicious commands as the root users. The company decided to immediately implement appropriate countermeasure to defend against such attacks. Which of the following defensive mechanisms should the company employ?

  A. Data correlation

  B. Patch management

  C. Input validation

  D. Session management

  Correct Answer: C

• Question 208:

  An attacker impersonated himself as a pizza delivery boy and is waiting outside the target company. He observed that an employee of the company is gaining security approval to enter the campus. When the employee is opening the entrance door of the company, the attacker requested the employee to hold the door open to enter into the company. In the above scenario, identify the technique used by the attacker to enter into the company?

  A. Dumpster diving

  B. Vishing

  C. Tailgating

  D. Phishing

  Correct Answer: C

• Question 209:

  Gibson, a security analyst at MileTech Solutions, is performing cloud penetration testing. As part of this process, he needs to check for any governance and compliance issues against cloud services. Which of the following documents helps Gibson in checking whether the CSP is regularly audited and certified for compliance issues?

  A. Service level agreement

  B. Data use agreement

  C. ROE agreement

  D. Nondisclosure agreement

  Correct Answer: B

• Question 210:

  StarMotel is a prominent chain of hotels in the world that uses high-tech solutions to ease the stay of their guests. In those high-tech solutions, they deployed RFID cards using which a guest can get access to the allocated hotel room. Keeping an eye on the RFID technology and with an objective of exploiting it, John, a professional hacker, decided to hack it in order to obtain access to any room in the target hotel. In this process, he first pulled an RFID keycard from the trash of the target hotel and identified the master keycard

  code in several tries using an RFID card reading and writing tool. Then, he created its clone using a new

  RFID card that gave him free reign to roam in any hotel room in the building.

  Identify the RFID attack John has performed on the target hotel?

  A. RFID spoofing attack

  B. Reverse engineering attack

  C. RFID replay attack

  D. Power analysis attack

  Correct Answer: B