EC-COUNCIL 412-79v9 問題集

質問 1：
Which of the following approaches to vulnerability assessment relies on the administrator providing baseline of system configuration and then scanning continuously without incorporating any information found at the time of scanning?

A. Inference-based Assessment
B. Product-based Assessment Solutions
C. Service-based Assessment Solutions
D. Tree-based Assessment
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
What is a difference between host-based intrusion detection systems (HIDS) and network- based intrusion detection systems (NIDS)?

A. Attempts to install Trojans or backdoors cannot be monitored by a HIDS whereas NIDS can monitor and stop such intrusion events.
B. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual computers within the system.
C. NIDS are usually a more expensive solution to implement compared to HIDS.
D. HIDS requires less administration and training compared to NIDS.
正解：B

質問 3：
What is the maximum value of a "tinyint" field in most database systems?
A. 222
B. 225 or more
C. 224 or more
D. 240 or less
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which of the following reports provides a summary of the complete pen testing process, its outcomes, and recommendations?
A. Vulnerability Report
B. Host Report
C. Client-side test Report
D. Executive Report
正解：D

質問 5：
Besides the policy implications of chat rooms, Internet Relay Chat (IRC) is frequented by attackers and used as a command and control mechanism. IRC normally uses which one of the following TCP ports?
A. 6771 TCP port
B. 6566 TCP port
C. 6667 TCP port
D. 6257 TCP port
正解：C

質問 6：
Due to illegal inputs, various types of TCP stacks respond in a different manner. Some
IDSs do not take into account the TCP protocol's urgency feature, which could allow testers to evade the IDS.

Penetration tester needs to try different combinations of TCP flags (e.g. none, SYN/FIN,
SYN/RST, SYN/FIN/ACK, SYN/RST/ACK, and All Flags) to test the IDS.
Which of the following TCP flag combinations combines the problem of initiation, midstream, and termination flags with the PSH and URG?
A. SYN/FIN
B. All Flags
C. SYN/RST/ACK
D. SYN/FIN/ACK
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
To locate the firewall, SYN packet is crafted using Hping or any other packet crafter and sent to the firewall. If ICMP unreachable type 13 message (which is an admin prohibited packet) with a source IP address of the access control device is received, then it means which of the following type of firewall is in place?
A. Packet filter
B. Stateful multilayer inspection firewall
C. Circuit level gateway
D. Application level gateway
正解：A