ECSAv8 Online Practice Questions and Answers

Which of the following statement holds true for TCP Operation?

A. Port numbers are used to know which application the receiving host should pass the data to

B. Sequence numbers are used to track the number of packets lost in transmission

C. Flow control shows the trend of a transmitting host overflowing the buffers in the receiving host

D. Data transfer begins even before the connection is established

Vulnerability assessment is an examination of the ability of a system or application, including the current security procedures and controls, to withstand assault.

What does a vulnerability assessment identify?

A. Disgruntled employees

B. Weaknesses that could be exploited

C. Physical security breaches

D. Organizational structure

Amazon Consulting Corporation provides penetration testing and managed security services to companies. Legality and regulatory compliance is one of the important components in conducting a successful security audit. Before starting a test, one of the agreements both the parties need to sign relates to limitations, constraints, liabilities, code of conduct, and indemnification considerations between the parties.

Which agreement requires a signature from both the parties (the penetration tester and the company)?

A. Non-disclosure agreement

B. Client fees agreement

C. Rules of engagement agreement

D. Confidentiality agreement

John, the penetration testing manager in a pen testing firm, needs to prepare a pen testing pricing report

for a client.

Which of the following factors does he need to consider while preparing the pen testing pricing report?

A. Number of employees in the client organization

B. Complete structure of the organization

C. Number of client computers to be tested and resources required to perform a pen test

D. Number of servers available in the client organization

Rule of Engagement (ROE) is the formal permission to conduct a pen-test. It provides top- level guidance for conducting the penetration testing. Various factors are considered while preparing the scope of ROE which clearly explain the limits associated with the security test.

Which of the following factors is NOT considered while preparing the scope of the Rules of Engagment (ROE)?

A. A list of employees in the client organization

B. A list of acceptable testing techniques

C. Specific IP addresses/ranges to be tested

D. Points of contact for the penetration testing team

Identify the type of testing that is carried out without giving any information to the employees or administrative head of the organization.

A. Unannounced Testing

B. Double Blind Testing

C. Announced Testing

D. Blind Testing

In Linux, /etc/shadow file stores the real password in encrypted format for user's account with added properties associated with the user's password.

In the example of a /etc/shadow file below, what does the bold letter string indicate? Vivek: $1$fnffc$GteyHdicpGOfffXX40w#5:13064:0:99999:7

A. Number of days the user is warned before the expiration date

B. Minimum number of days required between password changes

C. Maximum number of days the password is valid

D. Last password changed

A penetration tester performs OS fingerprinting on the target server to identify the operating system used on the target server with the help of ICMP packets.

While performing ICMP scanning using Nmap tool, message received/type displays "3 ?Destination Unreachable[5]" and code 3.

Which of the following is an appropriate description of this response?

A. Destination port unreachable

B. Destination host unavailable

C. Destination host unreachable

D. Destination protocol unreachable

What threat categories should you use to prioritize vulnerabilities detected in the pen testing report?

A. 1, 2, 3, 4, 5

B. Low, medium, high, serious, critical

C. Urgent, dispute, action, zero, low

D. A, b, c, d, e

Which of the following defines the details of services to be provided for the client's organization and the list of services required for performing the test in the organization?

A. Draft

B. Report

C. Requirement list

D. Quotation