ECSAv10 Free Practice Test

Which one of the following architectures has the drawback of internally considering the hosted services individually?

1. A. Weak Screened Subnet Architecture
2. B. "Inside Versus Outside" Architecture
3. C. "Three-Homed Firewall" DMZ Architecture
4. D. Strong Screened-Subnet Architecture

Correct Answer: C

A framework is a fundamental structure used to support and resolve complex issues. The framework that delivers an efficient set of technologies in order to develop applications which are more secure in using Internet and Intranet is:

1. A. Microsoft Internet Security Framework
2. B. Information System Security Assessment Framework (ISSAF)
3. C. Bell Labs Network Security Framework
4. D. The IBM Security Framework

Correct Answer: A

Which of the following defines the details of services to be provided for the client’s organization and the list of services required for performing the test in the organization?

1. A. Draft
2. B. Report
3. C. Requirement list
4. D. Quotation

Correct Answer: D

Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes. Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?

1. A. Send single quotes as the input data to catch instances where the user input is not sanitized
2. B. Send double quotes as the input data to catch instances where the user input is not sanitized
3. C. Send long strings of junk data, just as you would send strings to detect buffer overruns
4. D. Use a right square bracket (the “]” character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

Correct Answer: D

You are assisting a Department of Defense contract company to become compliant with the stringent
security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers.
What type of firewall must you implement to abide by this policy?

1. A. Circuit-level proxy firewall
2. B. Packet filtering firewall
3. C. Application-level proxy firewall
4. D. Statefull firewall

Correct Answer: D