412-79V9 Exam Questions and Answers

QUESTION: 1

TCP/IP model is a framework for the Internet Protocol suite of computer network protocols that defines the communication in an IP-based network. It provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination. This functionality has been organized into four abstraction layers which are used to sort all related protocols according to the scope of networking involved.

Which of the following TCP/IP layers selects the best path through the network for packets to travel?

Transport layer
Network Access layer
Internet layer
Application layer

Answer(s): C

Reveal Solution Next Question

QUESTION: 2

Firewall is an IP packet filter that enforces the filtering and security policies to the flowing network traffic. Using firewalls in IPv6 is still the best way of protection from low level attacks at the network and transport layers. Which one of the following cannot handle routing protocols properly?

"Internet-router-firewall-net architecture"
"Internet-firewall-router-net architecture"
"Internet-firewall/router(edge device)-net architecture"
"Internet-firewall -net architecture"

Answer(s): B

Reveal Solution Next Question

QUESTION: 3

Port numbers are used to keep track of different conversations crossing the network at the same time. Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers have the assigned ranges.

Port numbers above 1024 are considered which one of the following?

Dynamically assigned port numbers
Statically assigned port numbers
Well-known port numbers
Unregistered port numbers

Answer(s): A

Reference:

http://stackoverflow.com/questions/136709/what-port-number-should-i-use- when-testing-connections-in-my-local-intranet-in (see post 4)

Reveal Solution Next Question

QUESTION: 4

This is a group of people hired to give details of the vulnerabilities present in the system found after a penetration test. They are elite and extremely competent penetration testers and intrusion analysts. This team prepares a report on the vulnerabilities in the system, attack methods, and how to defend against them.

What is this team called?

Blue team
Tiger team
Gorilla team
Lion team

Answer(s): B

Reveal Solution Next Question

QUESTION: 5

You work as an IT security auditor hired by a law firm in Boston. You have been assigned the responsibility to audit the client for security risks. When assessing the risk to the clients network, what step should you take first?

Analyzing, categorizing and prioritizing resources
Evaluating the existing perimeter and internal security
Checking for a written security policy
Analyzing the use of existing management and control architecture

Answer(s): C

Reveal Solution Next Question

QUESTION: 6

Hackers today have an ever-increasing list of weaknesses in the web application structure at their disposal, which they can exploit to accomplish a wide variety of malicious tasks.

New flaws in web application security measures are constantly being researched, both by hackers and by security professionals. Most of these flaws affect all dynamic web applications whilst others are dependent on specific application technologies. In both cases, one may observe how the evolution and refinement of web technologies also brings about new exploits which compromise sensitive databases, provide access to theoretically secure networks, and pose a threat to the daily operation of online businesses.
What is the biggest threat to Web 2.0 technologies?

SQL Injection Attacks
Service Level Configuration Attacks
Inside Attacks
URL Tampering Attacks

Answer(s): A

Reveal Solution Next Question

QUESTION: 7

In which of the following firewalls are the incoming or outgoing packets blocked from accessing services for which there is no proxy?

Circuit level firewalls
Packet filters firewalls
Stateful multilayer inspection firewalls
Application level firewalls

Answer(s): D

Reference:

http://www.vicomsoft.com/learning-center/firewalls/

Reveal Solution Next Question

QUESTION: 8

Which one of the following Snort logger mode commands is associated to run a binary log file through Snort in sniffer mode to dump the packets to the screen?

./snort -dvr packet.log icmp
./snort -dev -l ./log
./snort -dv -r packet.log
./snort -l ./log b

Answer(s): C

Reveal Solution Next Question

EC-Council 412-79V9 Exam (page: 1)
EC-Council Certified Security Analyst (ECSA) v9
Updated on: 12-Feb-2026

Access free 412-79V9 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

QUESTION: 2

QUESTION: 3

Reference:

QUESTION: 4

QUESTION: 5

QUESTION: 6

QUESTION: 7

Reference:

QUESTION: 8

EC-Council 412-79V9 Exam (page: 1) EC-Council Certified Security Analyst (ECSA) v9 Updated on: 12-Feb-2026

Access free 412-79V9 actual exam questions, answers, explanations and user discussions.

QUESTION: 1

QUESTION: 2

QUESTION: 3

Reference:

QUESTION: 4

QUESTION: 5

QUESTION: 6

QUESTION: 7

Reference:

QUESTION: 8

EC-Council 412-79V9 Exam (page: 1)
EC-Council Certified Security Analyst (ECSA) v9
Updated on: 12-Feb-2026