EC-COUNCIL EC-COUNCIL Certifications ECSAv8 Questions & Answers

• Question 111:

  Phishing is typically carried out by email spoofing or instant messaging and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one.

  Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, public awareness, and technical security measures.

  

  What characteristics do phishing messages often have that may make them identifiable?

  A. Invalid email signatures or contact information

  B. Suspiciously good grammar and capitalization

  C. They trigger warning pop-ups

  D. Suspicious attachments

  Correct Answer: D

• Question 112:

  Which of the following are the default ports used by NetBIOS service?

  A. 135, 136, 139, 445

  B. 134, 135, 136, 137

  C. 137, 138, 139, 140

  D. 133, 134, 139, 142

  Correct Answer: C

• Question 113:

  What is the maximum value of a "tinyint" field in most database systems?

  A. 222

  B. 224 or more

  C. 240 or less

  D. 225 or more

  Correct Answer: D

  Reference: http://books.google.com.pk/books?id=JUcIAAAAQBAJandpg=SA3- PA3andlpg=SA3PA3anddq=maximum+value+of+a+%E2%80%9Ctinyint%E2%80%9D+field+in+most+databa se +systemsandsource=blandots=NscGk-R5randsig=1hMOYByxt7ebRJ4UEjbpxMijTQsandhl=enandsa=Xandei=pvgeVJnTCNDkaI_fgugOandv ed=0CDYQ6AEwAw#v=onepageandq=maximum%20value%20of%20a%20%E2%80%9Ctin yint%E2%80% 9D%20field%20in%20most%20database%20systemsandf=false

• Question 114:

  Which of the following policies states that the relevant application owner must authorize requests for additional access to specific business applications in writing to the IT Department/resource?

  A. Special-Access Policy

  B. User Identification and Password Policy

  C. Personal Computer Acceptable Use Policy

  D. User-Account Policy

  Correct Answer: B

• Question 115:

  Which of the following contents of a pen testing project plan addresses the strengths, weaknesses, opportunities, and threats involved in the project?

  A. Project Goal

  B. Success Factors

  C. Objectives

  D. Assumptions

  Correct Answer: B

  Explanation: http://www.scribd.com/doc/133635084/LPTv4-Module-14-Penetration- Testing-Planning-andScheduling-NoRestriction

• Question 116:

  In a TCP packet filtering firewall, traffic is filtered based on specified session rules, such as when a session is initiated by a recognized computer.

  

  Identify the level up to which the unknown traffic is allowed into the network stack.

  A. Level 5 ?Application

  B. Level 2 ?Data Link

  C. Level 4 ?TCP

  D. Level 3 ?Internet Protocol (IP)

  Correct Answer: D

  Reference: http://books.google.com.pk/books?id=KPjLAyA7HgoCandpg=PA208andlpg=PA208anddq=TCP+p acket+filtering +firewall+level+up+to+which+the+unknown+traffic+is+allowed+into+the+net work +stackandsource=blandots=zRrbchVYngandsig=q5G3T8lggTfAMNRkL7Kp0SRslHUandhl=enand sa=Xandei=5PUeVLSbC8TmaMzrgZgCandved=0CBsQ6AEwAA#v=onepageandq=TCP%20pack et%20filtering %20firewall%20level%20up%20to%20which%20the%20unknown%20traffic %20is%20allowed%20into% 20the%20network%20stackandf=false

• Question 117:

  Which of the following is the objective of Gramm-Leach-Bliley Act?

  A. To ease the transfer of financial information between institutions and banks

  B. To protect the confidentiality, integrity, and availability of data

  C. To set a new or enhanced standards for all U.S. public company boards, management and public accounting firms

  D. To certify the accuracy of the reported financial statement

  Correct Answer: B

  Reference: http://www.itap.purdue.edu/security/policies/glb_safeguards_rule_training_general.pdf

• Question 118:

  A penetration test will show you the vulnerabilities in the target system and the risks associated with it. An educated valuation of the risk will be performed so that the vulnerabilities can be reported as High/ Medium/Low risk issues.

  

  What are the two types of `white-box' penetration testing?

  A. Announced testing and blind testing

  B. Blind testing and double blind testing

  C. Blind testing and unannounced testing

  D. Announced testing and unannounced testing

  Correct Answer: B

• Question 119:

  Which of the following is not the SQL injection attack character?

  A. $

  B. PRINT

  C. #

  D. @@variable

  Correct Answer: B

• Question 120:

  Vulnerability assessment is an examination of the ability of a system or application, including the current security procedures and controls, to withstand assault.

  

  What does a vulnerability assessment identify?

  A. Disgruntled employees

  B. Weaknesses that could be exploited

  C. Physical security breaches

  D. Organizational structure

  Correct Answer: B