412-79v8: EC-Council Certified Security Analyst - Free download from Exam Files

What is a goal of the penetration testing report?

The penetration testing report helps you comply with local laws and regulations related to environmental conditions in the organization.
The penetration testing report allows you to sleep better at night thinking your organization is protected
The pen testing report helps executive management to make decisions on implementing security controls in the organization and helps the security team implement security controls and patch any flaws discovered during testing.
The penetration testing report allows you to increase sales performance by effectively communicating with the internal security team.

Correct answer: C

Which of the following is the range for assigned ports managed by the Internet Assigned Numbers Authority (IANA)?

3001-3100
5000-5099
6666-6674
0 – 1023

Correct answer: D

Explanation:

Reference: https://www.ietf.org/rfc/rfc1700.txt (well known port numbers, 4th para)

Identify the injection attack represented in the diagram below:

XPath Injection Attack
XML Request Attack
XML Injection Attack
Frame Injection Attack

Correct answer: C

Explanation:

Reference: http://projects.webappsec.org/w/page/13247004/XML%20Injection

Which of the following approaches to vulnerability assessment relies on the administrator providing baseline of system configuration and then scanning continuously without incorporating any information found at the time of scanning?

Service-based Assessment Solutions
Product-based Assessment Solutions
Tree-based Assessment
Inference-based Assessment

Correct answer: C

Explanation:

Reference: http://www.netsense.info/downloads/security_wp_mva.pdf (page 12, tree-based assessment technology, second para)

The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.

This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.

What is the best way to protect web applications from parameter tampering attacks?

Validating some parameters of the web application
Minimizing the allowable length of parameters
Using an easily guessable hashing algorithm
Applying effective input field filtering parameters

Correct answer: D

Vulnerability assessment is an examination of the ability of a system or application, including the current security procedures and controls, to withstand assault.

What does a vulnerability assessment identify?

Disgruntled employees
Weaknesses that could be exploited
Physical security breaches
Organizational structure

Correct answer: B

This is a group of people hired to give details of the vulnerabilities present in the system found after a penetration test. They are elite and extremely competent penetration testers and intrusion analysts. This team prepares a report on the vulnerabilities in the system, attack methods, and how to defend against them.

What is this team called?

Blue team
Tiger team
Gorilla team
Lion team

Correct answer: B

ARP spoofing is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

ARP spoofing attack is used as an opening for other attacks.

What type of attack would you launch after successfully deploying ARP spoofing?

Parameter Filtering
Social Engineering
Input Validation
Session Hijacking

Correct answer: D

Explanation:

Reference: http://en.wikipedia.org/wiki/ARP_spoofing

Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit.

Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

Which agreement requires a signature from both the parties (the penetration tester and the company)?

Non-disclosure agreement
Client fees agreement
Rules of engagement agreement
Confidentiality agreement

Correct answer: C

John, the penetration testing manager in a pen testing firm, needs to prepare a pen testing pricing report for a client.

Which of the following factors does he need to consider while preparing the pen testing pricing report?

Number of employees in the client organization
Complete structure of the organization
Number of client computers to be tested and resources required to perform a pen test
Number of servers available in the client organization

Correct answer: C

Vendor:	ECCouncil
Exam Code:	412-79v8
Exam Name:	EC-Council Certified Security Analyst
Date:	Aug 19, 2018
File Size:	7 MB

Download EC-Council Certified Security Analyst.412-79v8.PracticeTest.2018-08-19.114q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown