EC-COUNCIL 412-79v9 問題集

質問 1：
The Internet is a giant database where people store some of their most private information on the cloud, trusting that the service provider can keep it all safe. Trojans, Viruses, DoS attacks, website defacement, lost computers, accidental publishing, and more have all been sources of major leaks over the last 15 years.

What is the biggest source of data leaks in organizations today?
A. Rogue employees and insider attacks
B. Vulnerabilities, risks, and threats facing Web sites
C. Weak passwords and lack of identity management
D. Insufficient IT security budget
正解：A

質問 2：
Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes.
Pen testers need to perform this testing during the development phase to find and fix the
SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?
A. Send long strings of junk data, just as you would send strings to detect buffer overruns
B. Send double quotes as the input data to catch instances where the user input is not sanitized
C. Send single quotes as the input data to catch instances where the user input is not sanitized
D. Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization
正解：D

質問 3：
Which of the following is not the SQL injection attack character?
A. @@variable
B. #
C. $
D. PRINT
正解：C

質問 4：
Which among the following information is not furnished by the Rules of Engagement (ROE) document?
A. Details on how organizational data is treated throughout and after the test
B. Techniques for data exclusion from systems upon termination of the test
C. Details on how data should be transmitted during and after the test
D. Techniques for data collection from systems upon termination of the test
正解：D

質問 5：
Which of the following shields Internet users from artificial DNS data, such as a deceptive or mischievous address instead of the genuine address that was requested?
A. Firewall
B. DNSSEC
C. IPSec
D. Packet filtering
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
How many possible sequence number combinations are there in TCP/IP protocol?
A. 32 million
B. 320 billion
C. 4 billion
D. 1 billion
正解：C

質問 7：
In the context of penetration testing, what does blue teaming mean?

A. It is the most expensive and most widely used
B. A penetration test performed without the knowledge of the organization's IT staff but with permission from upper management
C. It may be conducted with or without warning
D. A penetration test performed with the knowledge and consent of the organization's IT staff
正解：D
解説: (Topexam メンバーにのみ表示されます)