最新なEC-COUNCIL ECSAv8問題集（150題）、真実試験の問題を全部にカバー！

質問 1：
Which of the following defines the details of services to be provided for the client's organization and the list of services required for performing the test in the organization?
A. Requirement list
B. Report
C. Quotation
D. Draft
正解：C

質問 2：
Which vulnerability assessment phase describes the scope of the assessment, identifies and ranks the critical assets, and creates proper information protection procedures such as effective planning, scheduling, coordination, and logistics?
A. Pre-Assessment Phase
B. Post-Assessment Phase
C. Assessment Phase
D. Threat-Assessment Phase
正解：A

質問 3：
A wireless intrusion detection system (WIDS) monitors the radio spectrum for the presence of unauthorized, rogue access points and the use of wireless attack tools. The system monitors the radio spectrum used by wireless LANs, and immediately alerts a systems administrator whenever a rogue access point is detected.
Conventionally it is achieved by comparing the MAC address of the participating wireless devices.
Which of the following attacks can be detected with the help of wireless intrusion detection system (WIDS)?

A. SQL injection
B. Parameter tampering
C. Social engineering
D. Man-in-the-middle attack
正解：D
解説: (Pass4Test メンバーにのみ表示されます)

質問 4：
What threat categories should you use to prioritize vulnerabilities detected in the pen testing report?
A. Low, medium, high, serious, critical
B. 1, 2, 3, 4, 5
C. A, b, c, d, e
D. Urgent, dispute, action, zero, low
正解：A

質問 5：
SQL injection attack consists of insertion or "injection" of either a partial or complete SQL
query via the data input or transmitted from the client (browser) to the web application.
A successful SQL injection attack can:
i)Read sensitive data from the database
iii)Modify database data (insert/update/delete)
iii)Execute administration operations on the database (such as shutdown the DBMS)
iV)Recover the content of a given file existing on the DBMS file system or write files into the
file system
v)Issue commands to the operating system

Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?
A. Automated Testing
B. Dynamic Testing
C. Function Testing
D. Static Testing
正解：A
解説: (Pass4Test メンバーにのみ表示されます)

質問 6：
John, the penetration tester in a pen test firm, was asked to find whether NTP services are opened on the target network (10.0.0.7) using Nmap tool.

Which one of the following Nmap commands will he use to find it?
A. nmap -sU -p 123 10.0.0.7
B. nmap -sU -p 161 10.0.0.7
C. nmap -sU -p 389 10.0.0.7
D. nmap -sU -p 135 10.0.0.7
正解：D

質問 7：
Which of the following statements is true about the LM hash?
A. Separated into two 8-character strings
B. Padded with NULL to 16 characters
C. Letters are converted to the lowercase
D. Disabled in Windows Vista and 7 OSs
正解：D
解説: (Pass4Test メンバーにのみ表示されます)