重考一次 412-79v9，等於再付一次報名費，還要再花好幾週重新準備。與其承擔重考成本，不如先用 KaoGuTi 的 205 道練習題，把 EC-COUNCIL EC-Council Certified Security Analyst (ECSA) v9 的每個領域練熟再上場。

EC-COUNCIL 412-79v9 考試概覽:

認證廠商:	EC-Council
考試名稱:	EC-Council Certified Security Analyst (ECSA) v9 Exam
考試代碼:	412-79v9
考試形式:	情境題, 選擇題
支援語言:	英文
證照有效期限:	3 年
實際考試題數:	150
及格分數:	70%
考試時間:	240 分鐘
考試費用:	約 $550 USD
相關認證:	Licensed Penetration Tester (LPT) Certified Ethical Hacker (CEH)
推薦課程:	EC-Council 官方 ECSA 培訓 EC-Council iLabs / 實作練習環境
考試報名:	EC-Council 官方認證入口網站 EC-Council 考試註冊
範例考題:
考試方式:	線上監考或授權測試中心 (Pearson VUE / EC-Council 考試入口網站)
必備條件:	建議：具備 Certified Ethical Hacker (CEH) 證照或同等的滲透測試基礎知識
官方大綱網址:	https://www.eccouncil.org/programs/ecsa-certification/

EC-COUNCIL 412-79v9 考試大綱主題:

EC-COUNCIL EC-Council Certified Security Analyst (ECSA) v9 考試常見問題解答

最新的 ECSA 412-79v9 免費考試真題：

問題 #1

Which one of the following is false about Wireshark? (Select all that apply)

A. In order for Wireshark to decrypt the contents of the WEP-encrypted packets, it must be given the appropriate WEP key for the network
B. It does not support decrypting the TKIP or CCMP packets
C. Wireshark offers some options to analyze the WEP-decrypted data
D. Packet Sniffer Mode

問題 #2

A pen tester has extracted a database name by using a blind SQL injection. Now he begins to test the table inside the database using the below query and finds the table:
http://juggyboy.com/page.aspx?id=1; IF (LEN(SELECT TOP 1 NAME from sysobjects where xtype='U')=3) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),1,1)))=101) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),2,1)))=109) WAITFOR DELAY '00:00:10'--
http://juggyboy.com/page.aspx?id=1; IF (ASCII(lower(substring((SELECT TOP 1 NAME from sysobjects where xtype=char(85)),3,1)))=112) WAITFOR DELAY '00:00:10'-
What is the table name?

A. QRT
B. CTS
C. EMP
D. ABC

問題 #3

Which one of the following architectures has the drawback of internally considering the hosted services individually?

A. "Three-Homed Firewall" DMZ Architecture
B. Weak Screened Subnet Architecture
C. Strong Screened-Subnet Architecture
D. "Inside Versus Outside" Architecture

問題 #4

What is a difference between host-based intrusion detection systems (HIDS) and network- based intrusion detection systems (NIDS)?

A. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual computers within the system.
B. Attempts to install Trojans or backdoors cannot be monitored by a HIDS whereas NIDS can monitor and stop such intrusion events.
C. NIDS are usually a more expensive solution to implement compared to HIDS.
D. HIDS requires less administration and training compared to NIDS.

問題 #5

ARP spoofing is a technique whereby an attacker sends fake ("spoofed") Address
Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.
ARP spoofing attack is used as an opening for other attacks.

What type of attack would you launch after successfully deploying ARP spoofing?

A. Session Hijacking
B. Input Validation
C. Parameter Filtering
D. Social Engineering

問題與答案：