412-79 Exam Questions and Answers | Exam-Dumps (Page: 3)

QUESTION: 11 Topic 1, Volume A

What are the security risks of running a "repair" installation for Windows XP?

There are no security risks when running the "repair" installation for Windows XP
Pressing Shift+F1 gives the user administrative rights
Pressing Ctrl+F10 gives the user administrative rights
Pressing Shift+F10 gives the user administrative rights

Answer(s): D

QUESTION: 12 Topic 1, Volume A

You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?

RaidSniff
Snort
Ettercap
Airsnort

Answer(s): C

Reveal Solution Next Question

QUESTION: 13 Topic 1, Volume A

George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their
computers. Before talking to his boss, George wants to have some proof of their activity.
George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

net port 22
udp port 22 and host 172.16.28.1/24
src port 22 and dst port 22
src port 23 and dst port 23

Answer(s): C

Reveal Solution Next Question

QUESTION: 14 Topic 1, Volume A

You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

Circuit-level proxy firewall
Packet filtering firewall
Application-level proxy firewall
Statefull firewall

Answer(s): D

Reveal Solution Next Question

QUESTION: 15 Topic 1, Volume A

You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?

Metamorphic
Oligomorhic
Polymorphic
Transmorphic

Answer(s): A

Reveal Solution Next Question

EC-Council 412-79 Exam (page: 3) EC-Council Certified Security Analyst (ECSA) Exam Updated on: 07-Feb-2026

QUESTION: 11 Topic 1, Volume A

QUESTION: 12 Topic 1, Volume A

QUESTION: 13 Topic 1, Volume A

QUESTION: 14 Topic 1, Volume A

QUESTION: 15 Topic 1, Volume A

EC-Council 412-79 Exam (page: 3)
EC-Council Certified Security Analyst (ECSA) Exam
Updated on: 07-Feb-2026