412-79V9 Exam Questions and Answers

QUESTION: 25

Black-box testing is a method of software testing that examines the functionality of an application (e.g. what the software does) without peering into its internal structures or workings. Black-box testing is used to detect issues in SQL statements and to detect SQL injection vulnerabilities.

Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during the Implementation/Development phase and will likely require code changes.
Pen testers need to perform this testing during the development phase to find and fix the SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?

Send single quotes as the input data to catch instances where the user input is not sanitized
Send double quotes as the input data to catch instances where the user input is not sanitized
Send long strings of junk data, just as you would send strings to detect buffer overruns
Use a right square bracket (the "]" character) as the input data to catch instances where the user input is used as part of a SQL identifier without any input sanitization

Answer(s): D

Reveal Solution Next Question

QUESTION: 26

Which of the following methods is used to perform server discovery?

Banner Grabbing
Whois Lookup
SQL Injection
Session Hijacking

Answer(s): B

Reference:

http://luizfirmino.blogspot.com/2011/09/server-discovery.html

Reveal Solution Next Question

QUESTION: 27

In Linux, /etc/shadow file stores the real password in encrypted format for user's account with added properties associated with the user's password.

In the example of a /etc/shadow file below, what does the bold letter string indicate?
Vivek: $1$fnffc$GteyHdicpGOfffXX40w#5:13064:0:99999:7

Number of days the user is warned before the expiration date
Minimum number of days required between password changes
Maximum number of days the password is valid
Last password changed

Answer(s): B

Reference:

http://www.cyberciti.biz/faq/understanding-etcshadow-file/ (bullet # 4)

Reveal Solution Next Question

QUESTION: 28

Why is a legal agreement important to have before launching a penetration test?

Guarantees your consultant fees
Allows you to perform a penetration test without the knowledge and consent of the organization's upper management
It establishes the legality of the penetration test by documenting the scope of the project and the consent of the company.
It is important to ensure that the target organization has implemented mandatory security policies

Answer(s): C

Reveal Solution Next Question

QUESTION: 29

Which of the following attributes has a LM and NTLMv1 value as 64bit + 64bit + 64bit and NTLMv2 value as 128 bits?

Hash Key Length
C/R Value Length
C/R Key Length
Hash Value Length

Answer(s): B

Reference:

http://books.google.com.pk/books?id=QWQRSTnkFsQC&pg=SA4- PA5&lpg=SA4-
PA5&dq=attributes+has+a+LM+and+NTLMv1+value+as+64bit+%2B+64bit+%2B+64bit+an d+NTLMv2+value+as+128+bits&source=bl&ots=wJPR32BaF6&sig=YEt9LNfQAbm2M- c6obVggKCkQ2s&hl=en&sa=X&ei=scMfVMfdC8u7ygP4xYGQDg&ved=0CCkQ6AEwAg#v =onepage&q=attributes%20has%20a%20LM%20and%20NTLMv1%20value%20as%2064 bit%20%2B%2064bit%20%2B%2064bit%20and%20NTLMv2%20value%20as%20128%20 bits&f=false (see Table 4-1)

Reveal Solution Next Question

QUESTION: 30

The SnortMain () function begins by associating a set of handlers for the signals, Snort receives. It does this using the signal () function. Which one of the following functions is used as a programspecific signal and the handler for this calls the DropStats() function to output the current Snort statistics?

SIGUSR1
SIGTERM
SIGINT
SIGHUP

Answer(s): A

Reveal Solution Next Question

QUESTION: 31

A Blind SQL injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application response. This attack is often used when the web application is configured to show generic error messages, but has not mitigated the code that is vulnerable to SQL injection.

It is performed when an error message is not received from application while trying to exploit SQL vulnerabilities. The developer's specific message is displayed instead of an error message. So it is quite difficult to find SQL vulnerability in such cases.
A pen tester is trying to extract the database name by using a blind SQL injection. He tests the database using the below query and finally finds the database name.
http://juggyboy.com/page.aspx?id=1; IF (LEN(DB_NAME())=4) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()), 1, 1)))=97) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()), 2, 1)))=98) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()), 3, 1)))=99)
WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((DB_NAME()), 4, 1)))=100) WAITFOR DELAY '00:00:10'--
What is the database name?

WXYZ
PQRS
EFGH
ABCD

Answer(s): D

Reference:

http://www.scribd.com/doc/184891028/CEHv8-Module-14-SQL-Injection-pdf (see module 14, page 2049 to 2051)

Reveal Solution Next Question

QUESTION: 32

A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML) statement should only affect rows that meet specified criteria. The criteria are expressed in the form of predicates. WHERE clauses are not mandatory clauses of SQL DML statements, but can be used to limit the number of rows affected by a SQL DML statement or returned by a query.

A pen tester is trying to gain access to a database by inserting exploited query statements with a WHERE clause. The pen tester wants to retrieve all the entries from the database using the WHERE clause from a particular table (e.g. StudentTable).
What query does he need to write to retrieve the information?

EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000
DUMP * FROM StudentTable WHERE roll_number = 1 AND 1=1--
SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1`
RETRIVE * FROM StudentTable WHERE roll_number = 1'#

Answer(s): C

Reveal Solution Next Question

EC-Council 412-79V9 Exam (page: 4) EC-Council Certified Security Analyst (ECSA) v9 Updated on: 12-Feb-2026

QUESTION: 25

QUESTION: 26

Reference:

QUESTION: 27

Reference:

QUESTION: 28

QUESTION: 29

Reference:

QUESTION: 30

QUESTION: 31

Reference:

QUESTION: 32

EC-Council 412-79V9 Exam (page: 4)
EC-Council Certified Security Analyst (ECSA) v9
Updated on: 12-Feb-2026