ECSAv8 Exam Training Practice Tests (EC-COUNCIL EC-Council Certified Security Analyst (ECSA))]

Question 1

In the example of a /etc/passwd file below, what does the bold letter string indicate?
nomad:HrLNrZ3VS3TF2:501:100: Simple Nomad:/home/nomad:/bin/bash

A. GECOS information B. User number C. Maximum number of days the password is valid D. Group number

Correct Answer: B

Question 2

Which Wireshark filter displays all the packets where the IP address of the source host is 10.0.0.7?

A. ip.src==10.0.0.7 B. ip.dstport==10.0.0.7 C. ip.port==10.0.0.7 D. ip.dst==10.0.0.7

Correct Answer: A

Question 3

In which of the following IDS evasion techniques does IDS reject the packets that an end system accepts?

A. TTL evasion technique B. UDP evasion technique C. IDS evasion technique D. IPS evasion technique

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

What is a difference between host-based intrusion detection systems (HIDS) and network-based intrusion detection systems (NIDS)?

A. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual computers within the system. B. NIDS are usually a more expensive solution to implement compared to HIDS. C. Attempts to install Trojans or backdoors cannot be monitored by a HIDS whereas NIDS can monitor and stop such intrusion events. D. HIDS requires less administration and training compared to NIDS.

Correct Answer: A

Question 5

Which of the following is NOT related to the Internal Security Assessment penetration testing strategy?

A. Testing performed from a number of network access points representing each logical and physical segment B. Testing to provide a more complete view of site security C. Testing including tiers and DMZs within the environment, the corporate network, or partner company connections D. Testing focused on the servers, infrastructure, and the underlying software, including the target

Correct Answer: A

Question 6

During external penetration testing, which of the following techniques uses tools like Nmap to predict the sequence numbers generated by the targeted server and use this information to perform session hijacking techniques?

A. IPID State Number Prediction B. TCP State Number Prediction C. TCP Sequence Number Prediction D. IPID Sequence Number Prediction

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Which of the following is a framework of open standards developed by the Internet Engineering Task Force (IETF) that provides secure transmission of the sensitive data over an unprotected medium, such as the Internet?

A. DNSSEC B. IPsec C. IKE D. Netsec

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

Which of the following methods is used to perform server discovery?

A. Whois Lookup B. Banner Grabbing C. SQL Injection D. Session Hijacking

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

EC-COUNCIL EC-Council Certified Security Analyst (ECSA) - ECSAv8 Exam Practice Test