EC-Council Certified Security Specialist ECSS v10 ECSS Exam Questions

Page: 1 / 14
Total 100 questions
Question 1

Paola, a professional hacker, was hired to break into the target organization's network and extract sensitive dat

a. In this process, Paola found that the target organization has purchased new hardware. She accessed the new hardware while it was in transit and tampered with the hardware to make it vulnerable to attacks.

Identify the class of attack Paola has performed on the target organization.



Answer : A

The scenario describes Paola tampering with new hardware while it was in transit to make it vulnerable to attacks. This type of attack is known as adistribution attack.Distribution attacks involve the interception and manipulation of products during their delivery process1. By accessing and tampering with the hardware before it reaches its final destination, the attacker can introduce vulnerabilities or backdoors that can be exploited later.

This method is distinct from an insider attack, which would involve someone within the organization facilitating the breach. A passive attack refers to monitoring and capturing data without altering the system, and an active attack involves direct engagement with the system to disrupt or manipulate operations. Since Paola's actions involve tampering with hardware during distribution, the correct classification is a distribution attack.


Question 2

Mark, an attacker, aims to access an organization's internal server, but the local firewall implementation restricted him from achieving this objective. To overcome this issue, he started sending specially crafted requests to the public server, through which he gained access to the local server.

Identify the type of attack initiated by Mark in the above scenario.



Answer : B

Mark's actions align with aServer-Side Request Forgery (SSRF)attack. In SSRF, an attacker manipulates the target web server into making requests to unintended locations. In this case, Mark sent specially crafted requests to the public server, which allowed him to access the internal server.SSRF vulnerabilities can lead to sensitive information disclosure, unauthorized access to internal systems, and other dangerous attacks12.


EC-Council Certified Security Specialist (E|CSS) documents and study guide.

EC-Council Certified Security Specialist (E|CSS) course materials34.

Question 3

John, a professional penetration tester, was hired by an organization for conducting a penetration test on their IT infrastructure. He was assigned the task of identifying risks, rather than finding vulnerabilities. In this process, he defined the goal before initiating the penetration test and performed multiple parallel processes to achieve the goal.

Identify the type of penetration assessment performed by John in the above scenario.



Answer : B

In the scenario described, John's approach aligns withobjective-oriented penetration testing. In this method, the tester defines specific goals or objectives before initiating the penetration test. The focus is on identifying risks related to achieving those objectives rather than merely finding vulnerabilities. By performing multiple parallel processes to achieve the defined goal, John is following an objective-oriented approach.


https://www.synopsys.com/glossary/what-is-red-teaming.html

Question 4

Which of the following standards and criteria version of SWCDE mandates that any action with the potential to alter, damage, or destroy any aspect of original evidence must be performed by qualified persons in a forensically sound manner?



Answer : C

TheScientific Working Group on Digital Evidence (SWGDE), in collaboration with theInternational Organization on Digital Evidence (IOCE), has established guidelines and standards for the recovery, preservation, and examination of digital evidence.According to these standards, any action that has the potential to alter, damage, or destroy any aspect of original evidence must be performed by qualified individuals in aforensically soundmanner1.Therefore, the correct answer isStandards and Criteria 17.Reference:1


Question 5

Kane, an investigation specialist, was appointed to investigate an incident in an organization's network. In this process, Kane executed a command and identified that a network interface is running in the promiscuous mode and is allowing all incoming packets without any restriction.

In the above scenario, which of the following commands did Kane use to check whether the network interface is set to the promiscuous mode?



Answer : B

Kane used theifconfigcommand to check whether the network interface is set to promiscuous mode. Theifconfigcommand displays information about network interfaces, including their configuration settings. When a network interface is in promiscuous mode, it allows all incoming packets to be captured without any filtering or restriction.


EC-Council Certified Security Specialist (E|CSS) documents and study guide.

EC-Council Certified Security Specialist (E|CSS) course materials12345678910111213141516

Question 6

Bruce, a professional hacker, targeted an OT network. He initiated a looping strategy to recover the password of the target system. He started sending one character at a time to check whether the first character entered is correct: If so, he continued the loop for consecutive characters. Using this technique. Bruce identified how much time the device takes to finish one complete password authentication process, through which he determined the correct characters in the target password.

Identify the type of attack launched by Bruce on the target OT network.



Answer : D

Bruce's strategy of sending one character at a time and measuring the time it takes for the device to complete the password authentication process is characteristic of aside-channel attack. In side-channel attacks, attackers exploit information leaked during the execution of cryptographic algorithms or other security protocols. In this case, the timing information provides clues about the correct characters in the password.


EC-Council Certified Security Specialist (E|CSS) documents and study guide.

EC-Council Certified Security Specialist (E|CSS) course materials.

Question 7

Kevin, an attacker, is attempting to compromise a cloud server. In this process, Kevin intercepted the SOAP messages transmitted between a user and the server, manipulated the body of the message, and then redirected it to the server as a legitimate user to gain access and run malicious code on the cloud server.

Identify the attack initiated by Kevin on the target cloud server.



Answer : B

The attack described involves intercepting and manipulating SOAP messages, which is characteristic of a wrapping attack. In a wrapping attack, the attacker intercepts the SOAP message and alters the body content to perform unauthorized actions, such as running malicious code on the server. This type of attack exploits the XML signature or encryption of SOAP messages, allowing the attacker to impersonate a legitimate user and gain unauthorized access.


Page:    1 / 14   
Total 100 questions