최신EC-COUNCIL EC-Council Certified Security Analyst (ECSA) - ECSAv8무료샘플문제
문제1
Which of the following is not a condition specified by Hamel and Prahalad (1990)?
Which of the following is not a condition specified by Hamel and Prahalad (1990)?
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제2
The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.
This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.
What is the best way to protect web applications from parameter tampering attacks?
The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.
This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.
What is the best way to protect web applications from parameter tampering attacks?
정답: D
문제3
You are conducting a penetration test against a company and you would like to know a personal email address of John, a crucial employee. What is the fastest, cheapest way to find out John's email address.
You are conducting a penetration test against a company and you would like to know a personal email address of John, a crucial employee. What is the fastest, cheapest way to find out John's email address.
정답: A
문제4
Which of the following is NOT related to the Internal Security Assessment penetration testing strategy?
Which of the following is NOT related to the Internal Security Assessment penetration testing strategy?
정답: B
문제5
Which of the following are the default ports used by NetBIOS service?
Which of the following are the default ports used by NetBIOS service?
정답: C
문제6
SQL injection attack consists of insertion or "injection" of either a partial or complete SQL
query via the data input or transmitted from the client (browser) to the web application.
A successful SQL injection attack can:
i)Read sensitive data from the database
iii)Modify database data (insert/update/delete)
iii)Execute administration operations on the database (such as shutdown the DBMS)
iV)Recover the content of a given file existing on the DBMS file system or write files into the
file system
v)Issue commands to the operating system
Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?
SQL injection attack consists of insertion or "injection" of either a partial or complete SQL
query via the data input or transmitted from the client (browser) to the web application.
A successful SQL injection attack can:
i)Read sensitive data from the database
iii)Modify database data (insert/update/delete)
iii)Execute administration operations on the database (such as shutdown the DBMS)
iV)Recover the content of a given file existing on the DBMS file system or write files into the
file system
v)Issue commands to the operating system
Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제7
What are the 6 core concepts in IT security?
What are the 6 core concepts in IT security?
정답: C
문제8
Identify the port numbers used by POP3 and POP3S protocols.
Identify the port numbers used by POP3 and POP3S protocols.
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제9
During the process of fingerprinting a web application environment, what do you need to do in order to analyze HTTP and HTTPS request headers and the HTML source code?
During the process of fingerprinting a web application environment, what do you need to do in order to analyze HTTP and HTTPS request headers and the HTML source code?
정답: B
문제10
Identify the type of authentication mechanism represented below:
Identify the type of authentication mechanism represented below:
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)