EC-COUNCIL EC-Council Certified Security Analyst (ECSA) Sample Questions:

1. Which of the following acts related to information security in the US establish that the management of an organization is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting?

A) Sarbanes-Oxley 2002
B) USA Patriot Act 2001
C) Gramm-Leach-Bliley Act (GLBA)
D) California SB 1386

2. Which of the following shields Internet users from artificial DNS data, such as a deceptive or mischievous address instead of the genuine address that was requested?

A) Packet filtering
B) DNSSEC
C) IPSec
D) Firewall

3. The amount of data stored in organizational databases has increased rapidly in recent years due to the rapid advancement of information technologies. A high percentage of these data is sensitive, private and critical to the organizations, their clients and partners.
Therefore, databases are usually installed behind internal firewalls, protected with intrusion detection mechanisms and accessed only by applications. To access a database, users have to connect to one of these applications and submit queries through them to the database. The threat to databases arises when these applications do not behave properly and construct these queries without sanitizing user inputs first.
Identify the injection attack represented in the diagram below:

A) LDAP Injection Attack
B) Frame Injection Attack
C) SOAP Injection Attack
D) XPath Injection Attack

4. Which among the following information is not furnished by the Rules of Engagement (ROE) document?

A) Details on how organizational data is treated throughout and after the test
B) Details on how data should be transmitted during and after the test
C) Techniques for data exclusion from systems upon termination of the test
D) Techniques for data collection from systems upon termination of the test

5. A man enters a PIN number at an ATM machine, being unaware that the person next to him was watching. Which of the following social engineering techniques refers to this type of information theft?

A) Phishing
B) Insider Accomplice
C) Vishing
D) Shoulder surfing

Solutions: