EC-COUNCIL 412-79v8 問題集

質問 1：
What is the difference between penetration testing and vulnerability testing?

A. Penetration testingis based on purely online vulnerability analysis while vulnerability testing engages ethical hackers to find vulnerabilities
B. Vulnerability testing is more expensive than penetration testing
C. Penetration testing goes one step further than vulnerability testing; while vulnerability tests check for known vulnerabilities, penetration testing adopts the concept of 'in-depth ethical hacking'
D. Penetration testing is conducted purely for meeting compliance standards while vulnerability testing is focused on online scans
正解：C

質問 2：
John, a penetration tester from a pen test firm, was asked to collect information about the host file in a Windows system directory. Which of the following is the location of the host file in Window system directory?
A. C:\Windows\System32\restore
B. C:\Windows\System32\Boot
C. C:\WINDOWS\system32\cmd.exe
D. C:\WINNT\system32\drivers\etc
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Security auditors determine the use of WAPs on their networks with Nessus vulnerability scanner which identifies the commonly used WAPs. One of the plug-ins that the Nessus Vulnerability Scanner uses is ID #11026 and is named "Access Point Detection". This plug-in uses four techniques to identify the presence of a WAP. Which one of the following techniques is mostly used for uploading new firmware images while upgrading the WAP device?
A. FTP fingerprinting
B. NMAP TCP/IP fingerprinting
C. HTTP fingerprinting
D. SNMP fingerprinting
正解：A

質問 4：
Internet Control Message Protocol (ICMP) messages occur in many situations, such as whenever a datagram cannot reach the destination or the gateway does not have the buffering capacity to forward a datagram. Each ICMP message contains three fields: type, code, and checksum. Different types of Internet Control Message Protocols (ICMPs) are identified by a type and code field.

Which of the following ICMP messages will be generated if the destination port is not reachable?
A. ICMP Type 3 code 2
B. ICMP Type 11 code 1
C. ICMP Type 3 code 3
D. ICMP Type 5 code 3
正解：C

質問 5：
ARP spoofing is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.
ARP spoofing attack is used as an opening for other attacks.

What type of attack would you launch after successfully deploying ARP spoofing?
A. Parameter Filtering
B. Social Engineering
C. Session Hijacking
D. Input Validation
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which of the following is not a condition specified by Hamel and Prahalad (1990)?
A. Core competency should be aimed at protecting company interests
B. Core competency can be leveraged widely to many products and markets
C. Core competency is hard for competitors to imitate
D. Core competency provides customer benefits
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which of the following statement holds true for TCP Operation?

A. Flow control shows the trend of a transmitting host overflowing the buffers in the receiving host
B. Sequence numbers are used to track the number of packets lost in transmission
C. Port numbers are used to know which application the receiving host should pass the data to
D. Data transfer begins even before the connection is established
正解：D

質問 8：
Which of the following contents of a pen testing project plan addresses the strengths, weaknesses, opportunities, and threats involved in the project?
A. Project Goal
B. Objectives
C. Success Factors
D. Assumptions
正解：D

質問 9：
From where can clues about the underlying application environment can be collected?
A. From source code
B. From executable file
C. From the extension of the file
D. From file types and directories
E. Explanation:
QUESTIONNO: 16 Which of the following information gathering techniques collects information from an organization's web-based calendar and email services?
A. Anonymous Information Gathering
B. Private Information Gathering
C. Passive Information Gathering
D. Active Information Gathering
正解：C
解説: (Topexam メンバーにのみ表示されます)