Free 412-79v10: EC-Council Certified Security Analyst (ECSA) V10 Exam Questions and Answers

Last updated: September 19, 2026

Exam code

412-79v10

Provider

ECCouncil

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   An external intrusion test and analysis identify security weaknesses and strengths of the client's systems and networks as they appear from outside the client's security perimeter, usually from the Internet. The goal of an external intrusion test and analysis is to demonstrate the existence of known vulnerabilities that could be exploited by an external attacker. During external penetration testing, which of the following scanning techniques allow you to determine a port’s state without making a full connection to the host?

   
   • A. XMAS Scan
   • B. SYN scan
   • C. FIN Scan
   • D. NULL Scan
   Reveal Answer

2. Question #2

   A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML) statement should only affect rows that meet specified criteria. The criteria are expressed in the form of predicates. WHERE clauses are not mandatory clauses of SQL DML statements, but can be used to limit the number of rows affected by a SQL DML statement or returned by a query. A pen tester is trying to gain access to a database by inserting exploited query statements with a WHERE clause. The pen tester wants to retrieve all the entries from the database using the WHERE clause from a particular table (e.g. StudentTable). What query does he need to write to retrieve the information?

   
   • A. EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000
   • B. DUMP * FROM StudentTable WHERE roll_number = 1 AND 1=1—
   • C. SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1‘
   • D. RETRIVE * FROM StudentTable WHERE roll_number = 1'#
   Reveal Answer

3. Question #3

   What will the following URL produce in an unpatched IIS Web Server?

   • A. Execute a buffer flow in the C: drive of the web server
   • B. Insert a Trojan horse into the C: drive of the web server
   • C. Directory listing of the C:\windows\system32 folder on the web server
   • D. Directory listing of C: drive on the web server
   Reveal Answer

4. Question #4

   Firewall is an IP packet filter that enforces the filtering and security policies to the flowing network traffic. Using firewalls in IPv6 is still the best way of protection from low level attacks at the network and transport layers. Which one of the following cannot handle routing protocols properly?

   • A. “Internet-router-firewall-net architecture”
   • B. “Internet-firewall-router-net architecture”
   • C. “Internet-firewall/router(edge device)-net architecture”
   • D. “Internet-firewall -net architecture”
   Reveal Answer

5. Question #5

   The IP protocol was designed for use on a wide variety of transmission links. Although the maximum length of an IP datagram is 64K, most transmission links enforce a smaller maximum packet length limit, called a MTU. The value of the MTU depends on the type of the transmission link. The design of IP accommodates MTU differences by allowing routers to fragment IP datagrams as necessary. The receiving station is responsible for reassembling the fragments back into the original full size IP datagram. IP fragmentation involves breaking a datagram into a number of pieces that can be reassembled later. The IP source, destination, identification, total length, and fragment offset fields in the IP header, are used for IP fragmentation and reassembly. The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a:

   
   • A. Multiple of four bytes
   • B. Multiple of two bytes
   • C. Multiple of eight bytes
   • D. Multiple of six bytes
   Reveal Answer

6. Question #6

   Which one of the following acts related to the information security in the US fix the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting?

   • A. California SB 1386
   • B. Sarbanes-Oxley 2002
   • C. Gramm-Leach-Bliley Act (GLBA)
   • D. USA Patriot Act 2001
   Reveal Answer

7. Question #7

   In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

   • A. More RESET packets to the affected router to get it to power back up
   • B. RESTART packets to the affected router to get it to power back up
   • C. The change in the routing fabric to bypass the affected router
   • D. STOP packets to all other routers warning of where the attack originated
   Reveal Answer

8. Question #8

   Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the AXFR and IXFR commands using DIG. What is Simon trying to accomplish here?

   • A. Enumerate all the users in the domain
   • B. Perform DNS poisoning
   • C. Send DOS commands to crash the DNS servers
   • D. Perform a zone transfer
   Reveal Answer

9. Question #9

   Which of the following pen testing reports provides detailed information about all the tasks performed during penetration testing?

   
   • A. Client-Side Test Report
   • B. Activity Report
   • C. Host Report
   • D. Vulnerability Report
   Reveal Answer

10. Question #10

    In the context of penetration testing, what does blue teaming mean?

    
    • A. A penetration test performed with the knowledge and consent of the organization's IT staff
    • B. It is the most expensive and most widely used
    • C. It may be conducted with or without warning
    • D. A penetration test performed without the knowledge of the organization's IT staff but with permission from upper management
    Reveal Answer