We're so confident of our products that we provide no hassle product exchange.
EC-COUNCIL ECSAv8 Exam Overview:
| Certification Vendor: | EC-Council |
| Exam Name: | EC-Council Certified Security Analyst (ECSA) Version 8 |
| Exam Number: | 412-79v8 / ECSAv8 |
| Related Certifications: | Certified Ethical Hacker (CEH) Licensed Penetration Tester (LPT) |
| Passing Score: | 70% |
| Exam Duration: | 240 minutes |
| Available Languages: | English |
| Real Exam Qty: | 150 |
| Exam Price: | $950–$999 USD |
| Exam Format: | Multiple Choice, Multiple Response |
| Certificate Validity Period: | 3 years |
| Recommended Training: | Official ECSA v8 Training iClass by EC-Council |
| Exam Registration: | EC-Council Official Registration ECC Exam Portal |
| Sample Questions: | EC-COUNCIL ECSAv8 Sample Questions |
| Exam Way: | In-person at authorized EC-Council test centers or online proctored exam |
| Pre Condition: | Recommended: CEH certification or equivalent knowledge; no strict mandatory prerequisite but prior ethical hacking experience is highly advised |
| Official Syllabus URL: | https://www.eccouncil.org/programs/certified-security-analyst-ecsa/ |
EC-COUNCIL ECSAv8 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Network Infrastructure Security Assessment | 15% | - IDS/IPS evasion and analysis - Router, switch and firewall security testing |
| Topic 2: Wireless and Mobile Security Assessment | 10% | - Wireless network encryption flaws - Mobile device and application security analysis |
| Topic 3: Vulnerability Analysis and Assessment | 15% | - Vulnerability scanning tools and techniques - Vulnerability classification and management |
| Topic 4: Introduction to Security Analysis and Penetration Testing | 10% | - Security assessment methodologies - Penetration testing standards and frameworks |
| Topic 5: Cloud and Virtualization Security | 8% | - Cloud infrastructure assessment - Virtual machine and hypervisor security |
| Topic 6: Malware Analysis and Reverse Engineering | 7% | - Static and dynamic malware analysis - Reverse engineering fundamentals |
| Topic 7: Web Application Security Assessment | 13% | - OWASP top 10 vulnerabilities - Web application testing methodologies |
| Topic 8: Reporting and Documentation | 10% | - Risk rating and remediation recommendations - Penetration test report structure |
| Topic 9: Information Gathering and Reconnaissance | 12% | - Network scanning and enumeration - Active and passive reconnaissance |
EC-COUNCIL EC-Council Certified Security Analyst (ECSA) Sample Questions:
1. Identify the correct formula for Return on Investment (ROI).
A) ROI = (Expected Returns Cost of Investment) / Cost of Investment
B) ROI = (Expected Returns + Cost of Investment) / Cost of Investment
C) ROI = ((Expected Returns - Cost of Investment) / Cost of Investment) * 100
D) ROI = ((Expected Returns + Cost of Investment) / Cost of Investment) * 100
2. Which among the following information is not furnished by the Rules of Engagement (ROE) document?
A) Techniques for data collection from systems upon termination of the test
B) Details on how organizational data is treated throughout and after the test
C) Techniques for data exclusion from systems upon termination of the test
D) Details on how data should be transmitted during and after the test
3. Which of the following attacks does a hacker perform in order to obtain UDDI information such as businessEntity, businesService, bindingTemplate, and tModel?
A) Web Services Footprinting Attack
B) Service Level Configuration Attacks
C) URL Tampering Attacks
D) Inside Attacks
4. SQL injection attack consists of insertion or "injection" of either a partial or complete SQL
query via the data input or transmitted from the client (browser) to the web application.
A successful SQL injection attack can:
i)Read sensitive data from the database
iii)Modify database data (insert/update/delete)
iii)Execute administration operations on the database (such as shutdown the DBMS)
iV)Recover the content of a given file existing on the DBMS file system or write files into the
file system
v)Issue commands to the operating system
Pen tester needs to perform various tests to detect SQL injection vulnerability. He has to make a list of all input fields whose values could be used in crafting a SQL query, including the hidden fields of POST requests and then test them separately, trying to interfere with the query and to generate an error.
In which of the following tests is the source code of the application tested in a non-runtime environment to detect the SQL injection vulnerabilities?
A) Automated Testing
B) Static Testing
C) Function Testing
D) Dynamic Testing
5. Vulnerability assessment is an examination of the ability of a system or application, including current security procedures and controls, to withstand assault. It recognizes, measures, and classifies security vulnerabilities in a computer system, network, and communication channels.
A vulnerability assessment is used to identify weaknesses that could be exploited and predict the effectiveness of additional security measures in protecting information resources from attack.
Which of the following vulnerability assessment technique is used to test the web server infrastructure for any misconfiguration and outdated content?
A) Passive Assessment
B) External Assessment
C) Application Assessment
D) Host-based Assessment
Solutions:
| Question # 1 Answer: A | Question # 2 Answer: B | Question # 3 Answer: A | Question # 4 Answer: A | Question # 5 Answer: D |
By Esther
