Online Access Free ECSAv10 Exam Questions

When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

• A.NIPS
• B.Active IDS
• C.Passive IDS
• D.Progressive IDS

Which of the following is the objective of Gramm-Leach-Bliley Act?

• A.To set a new or enhanced standards for all U.S. public company boards, management and public accounting firms
• B.To ease the transfer of financial information between institutions and banks
• C.To certify the accuracy of the reported financial statement
• D.To protect the confidentiality, integrity, and availability of data

Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but questionable in the logs.
He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

• A.IANA
• B.APIPA
• C.RIPE
• D.CVE

SQL injection attack consists of insertion or "injection" of either a partial or complete SQL query via the data input or transmitted from the client (browser) to the web application. A successful SQL injection attack can:
i) Read sensitive data from the database
iii) Modify database data (insert/update/delete)
iii) Execute administration operations on the database (such as shutdown the DBMS) iV) Recover the content of a given file existing on the DBMS file system or write files into the file system v) Issue commands to the operating system

Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?

• A.Dynamic Testing
• B.Function Testing
• C.Static Testing
• D.Automated Testing

What is a good security method to prevent unauthorized users from "tailgating"?

• A.Electronic key systems
• B.Electronic combination locks
• C.Man trap
• D.Pick-resistant locks