EC-COUNCIL 412-79v8 問題集

質問 1：
What information can be collected by dumpster diving?
A. All the above
B. Email messages
C. Customer contact information
D. Sensitive documents
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Which one of the following is a useful formatting token that takes an int * as an argument, and writes the number of bytes already written, to that location?
A. "%s"
B. "%p"
C. "%w"
D. "%n"
正解：D

質問 3：
During the process of fingerprinting a web application environment, what do you need to do in order to analyze HTTP and HTTPS request headers and the HTML source code?
A. Examine Source of the Available Pages
B. Check the HTTP and HTML Processing by the Browser
C. Perform Banner Grabbing
D. Perform Web Spidering
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which type of security policy applies to the below configuration? i)Provides maximum security while allowing known, but necessary, dangers ii)All services are blocked; nothing is allowed iii)Safe and necessary services are enabled individually iv)Non-essential services and procedures that cannot be made safe are NOT allowed v)Everything is logged

A. Paranoid Policy
B. Prudent Policy
C. Permissive Policy
D. Promiscuous Policy
正解：B

質問 5：
Firewall is an IP packet filter that enforces the filtering and security policies to the flowing network traffic. Using firewalls in IPv6 is still the best way of protection from low level attacks at the network and transport layers. Which one of the following cannot handle routing protocols properly?
A. "Internet-firewall -net architecture"
B. "Internet-firewall/router(edge device)-net architecture"
C. "Internet-firewall-router-net architecture"
D. "Internet-router-firewall-netarchitecture"
正解：C

質問 6：
If a web application sends HTTP cookies as its method for transmitting session tokens, it may be vulnerable which of the following attacks?
A. Parameter tampering Attack
B. Sql injection attack
C. Session Hijacking
D. Cross-site request attack
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Traceroute is a computer network diagnostic tool for displaying the route (path) and measuring transit delays of packets across an Internet Protocol (IP) network. It sends a sequence of three Internet Control Message Protocol (ICMP) echo request packets addressed to a destination host.
The time-to-live (TTL) value, also known as hop limit, is used in determining the intermediate routers being traversed towards the destination.

During routing, each router reduces packets' TTL value by
A. 2
B. 3
C. Reference:http://www.packetu.com/2009/10/09/traceroute-through-the-asa/
QUESTIONNO: 90
Which of the following attributes has a LM and NTLMv1 value as 64bit + 64bit + 64bit and NTLMv2 value as 128 bits?
A. Hash Key Length
B. C/R Value Length
C. C/R Key Length
D. Hash Value Length
D. 4
E. 1
正解：E
解説: (Topexam メンバーにのみ表示されます)

質問 8：
In the context of penetration testing, what does blue teaming mean?

A. It is the most expensive and most widely used
B. A penetration test performed without the knowledge of the organization's IT staff but with permission from upper management
C. It may be conducted with or without warning
D. A penetration test performed with the knowledge and consent of the organization's IT staff
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 9：
The Web parameter tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.
This attack takes advantage of the fact that many programmers rely on hidden or fixed fields (such as a hidden tag in a form or a parameter in a URL) as the only security measure for certain operations. Attackers can easily modify these parameters to bypass the security mechanisms that rely on them.

What is the best way to protect web applications from parameter tampering attacks?
A. Using an easily guessable hashing algorithm
B. Applying effective input field filtering parameters
C. Validating some parameters of the web application
D. Minimizing the allowable length of parameters
正解：B