Online Access Free ECSAv10 Exam Questions

Which of the following is developed to address security concerns on time and reduce the misuse or threat of attacks in an organization?

• A.Testing Plan
• B.Action Plan
• C.Configuration checklists
• D.Vulnerabilities checklists

SQL injection attack consists of insertion or "injection" of either a partial or complete SQL query via the data input or transmitted from the client (browser) to the web application. A successful SQL injection attack can:
i) Read sensitive data from the database
iii) Modify database data (insert/update/delete)
iii) Execute administration operations on the database (such as shutdown the DBMS) iV) Recover the content of a given file existing on the DBMS file system or write files into the file system v) Issue commands to the operating system

Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?

• A.Static Testing
• B.Function Testing
• C.Automated Testing
• D.Dynamic Testing

Which of the following equipment could a pen tester use to perform shoulder surfing?

• A.Painted ultraviolet material
• B.Microphone
• C.All the above
• D.Binoculars

Before performing the penetration testing, there will be a pre-contract discussion with different pen-testers (the team of penetration testers) to gather a quotation to perform pen testing.

Which of the following factors is NOT considered while preparing a price quote to perform pen testing?

• A.Expected time required to finish the project
• B.Total number of employees in the client organization
• C.Type of testers involved
• D.The budget required

Which of the following defines the details of services to be provided for the client's organization and the list of services required for performing the test in the organization?

• A.Draft
• B.Report
• C.Requirement list
• D.Quotation