Free ECSAv10: EC-Council Certified Security Analyst Exam Questions and Answers

What is the difference between penetration testing and vulnerability testing?

• AA. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of ‘in-depth ethical hacking’
• BB. Penetration testing is based on purely online vulnerability analysis while vulnerability testing engages ethical hackers to find vulnerabilities
• CC. Vulnerability testing is more expensive than penetration testing
• DD. Penetration testing is conducted purely for meeting compliance standards while vulnerability testing is focused on online scans

Transmission Control Protocol (TCP) is a connection-oriented four layer protocol. It is responsible for breaking messages into segments, re-assembling them at the destination station, and re-sending. Which one of the following protocols does not use the TCP?

• AA. Reverse Address Resolution Protocol (RARP)
• BB. HTTP (Hypertext Transfer Protocol)
• CC. SMTP (Simple Mail Transfer Protocol)
• DD. Telnet

Which one of the following acts makes reputational risk of poor security a reality because it requires public disclosure of any security breach that involves personal information if it is unencrypted or if it is reasonably believed that the information has been acquired by an unauthorized person?

• AA. California SB 1386
• BB. Sarbanes-Oxley 2002
• CC. Gramm-Leach-Bliley Act (GLBA)
• DD. USA Patriot Act 2001

The Internet is a giant database where people store some of their most private information on the cloud, trusting that the service provider can keep it all safe. Trojans, Viruses, DoS attacks, website defacement, lost computers, accidental publishing, and more have all been sources of major leaks over the last 15 years. What is the biggest source of data leaks in organizations today?

• AA. Weak passwords and lack of identity management
• BB. Insufficient IT security budget
• CC. Rogue employees and insider attacks
• DD. Vulnerabilities, risks, and threats facing Web sites

Vulnerability assessment is an examination of the ability of a system or application, including current security procedures and controls, to withstand assault. It recognizes, measures, and classifies security vulnerabilities in a computer system, network, and communication channels. A vulnerability assessment is used to identify weaknesses that could be exploited and predict the effectiveness of additional security measures in protecting information resources from attack. Which of the following vulnerability assessment technique is used to test the web server infrastructure for any misconfiguration and outdated content?

• AA. Passive Assessment
• BB. Host-based Assessment
• CC. External Assessment
• DD. Application Assessment

George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

• AA. net port 22
• BB. udp port 22 and host 172.16.28.1/24
• CC. src port 22 and dst port 22
• DD. src port 23 and dst port 23

The IP protocol was designed for use on a wide variety of transmission links. Although the maximum length of an IP datagram is 64K, most transmission links enforce a smaller maximum packet length limit, called a MTU. The value of the MTU depends on the type of the transmission link. The design of IP accommodates MTU differences by allowing routers to fragment IP datagrams as necessary. The receiving station is responsible for reassembling the fragments back into the original full size IP datagram. IP fragmentation involves breaking a datagram into a number of pieces that can be reassembled later. The IP source, destination, identification, total length, and fragment offset fields in the IP header, are used for IP fragmentation and reassembly. The fragment offset is 13 bits and indicates where a fragment belongs in the original IP datagram. This value is a:

• AA. Multiple of four bytes
• BB. Multiple of two bytes
• CC. Multiple of eight bytes
• DD. Multiple of six bytes

Which of the following contents of a pen testing project plan addresses the strengths, weaknesses, opportunities, and threats involved in the project?

• AA. Project Goal
• BB. Success Factors
• CC. Objectives
• DD. Assumptions

You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

• AA. Use attack as a launching point to penetrate deeper into the network
• BB. Demonstrate that no system can be protected against DoS attacks
• CC. List weak points on their network
• DD. Show outdated equipment so it can be replaced

Which one of the following tools of trade is an automated, comprehensive penetration testing product for assessing the specific information security threats to an organization?

• AA. Sunbelt Network Security Inspector (SNSI)
• BB. CORE Impact
• CC. Canvas
• DD. Microsoft Baseline Security Analyzer (MBSA)