EC-COUNCIL 412-79v8 問題集

質問 1：
A Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

It is performed when an error message is not received from application while trying to exploit SQL vulnerabilities. The developer's specific message is displayed instead of an error message. So it is quite difficult to find SQL vulnerability in such cases.
A pen tester is trying to extract the database name by using a blind SQL injection. He tests the database using the below query and finally finds the database name.
http://juggyboy.com/page.aspx?id=1; IF (LEN(DB_NAME())=4) WAITFOR DELAY '00:00:10'-
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),1,1)))=97) WAITFOR DELAY '00:00:10'-
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),2,1)))=98) WAITFOR DELAY '00:00:10'-
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),3,1)))=99) WAITFOR DELAY '00:00:10'-
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()),4,1)))=100) WAITFOR DELAY '00:00:10'-
What is the database name?
A. EFGH
B. ABCD
C. WXYZ
D. PQRS
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
During the process of fingerprinting a web application environment, what do you need to do in order to analyze HTTP and HTTPS request headers and the HTML source code?
A. Examine Source of the Available Pages
B. Check the HTTP and HTML Processing by the Browser
C. Perform Banner Grabbing
D. Perform Web Spidering
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which of the following has an offset field that specifies the length of the header and data?
A. IP Header
B. UDP Header
C. ICMP Header
D. TCP Header
正解：D

質問 4：
Which of the following attacks does a hacker perform in order to obtain UDDI information such as businessEntity, businesService, bindingTemplate, and tModel?
A. Inside Attacks
B. Service Level Configuration Attacks
C. Web Services Footprinting Attack
D. URL Tampering Attacks
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Which of the following appendices gives detailed lists of all the technical terms used in the report?
A. Research
B. References
C. Required Work Efforts
D. Glossary
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
The amount of data stored in organizational databases has increased rapidly in recent years due to the rapid advancement of information technologies. A high percentage of these data is sensitive, private and critical to the organizations, their clients and partners.
Therefore, databases are usually installed behind internal firewalls, protected with intrusion detection mechanisms and accessed only by applications. To access a database, users have to connect to one of these applications and submit queries through them to the database. The threat to databases arises when these applications do not behave properly and construct these queries without sanitizing user inputs first.
Identify the injection attack represented in the diagram below:

A. SOAP Injection Attack
B. LDAP Injection Attack
C. XPath Injection Attack
D. Frame Injection Attack
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Which of the following is developed to address security concerns on time and reduce the misuse or threat of attacks in an organization?
A. Configuration checklists
B. Testing Plan
C. Vulnerabilities checklists
D. Action Plan
正解：C

質問 8：
What is a goal of the penetration testing report?

A. The penetration testing report allows you to increase sales performance by effectively communicating with the internal security team.
B. The penetration testing report allows you to sleep better at night thinking your organization is protected
C. The penetration testing report helps you comply with local laws and regulations related to environmental conditions in the organization.
D. The pen testing report helps executive management to make decisions on implementing security controls in the organization and helps the security team implement security controls and patch any flaws discovered during testing.
正解：D

質問 9：
What information can be collected by dumpster diving?
A. All the above
B. Email messages
C. Customer contact information
D. Sensitive documents
正解：D
解説: (Topexam メンバーにのみ表示されます)