412-79 Practice Test

The framework primarily designed to fulfill a methodical and organized way of addressing
five threat classes to network and that can be used to access, plan, manage, and maintain
secure computers and communication networksis:

A.

Nortells Unified Security Framework

B.

The IBM Security Framework

C.

Bell Labs Network Security Framework

D.

Microsoft Internet Security Framework

A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML)
statement should only affect rows that meet specified criteria. The criteria are expressed in
the form ofpredicates. WHERE clauses are not mandatory clauses of SQL DML
statements, but can be used to limit the number of rows affected by a SQL DML statement
or returned by a query.

Apen tester is trying to gain access to a database by inserting exploited query statements
with a WHERE clause. The pen tester wants to retrieve all the entries from the database
using the WHERE clause from a particular table (e.g. StudentTable).
What query does he need to write to retrieve the information?

A.

A. EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000

C.

SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1‘

D.

RETRIVE* FROM StudentTable WHERE roll_number = 1'#

By default, the TFTP server listenson UDP port 69. Which of the following utility reports the
port status of target TCP and UDP ports on a local or a remote computer and is used to
troubleshoot TCP/IP connectivity issues?

A.

PortQry

B.

 Netstat

C.

elnet

D.

racert

Which of the following defines the details of servicesto be provided for the client’s
organization and the list of services required for performing the test in the organization?

A.

 Draft

B.

Report

C.

Requirement list

D.

Quotation

Black-box testing is a method of software testing that examines the functionality of an
application (e.g. what the software does) without peering into its internal structures or
workings. Black-box testing is used to detect issues in SQL statements and to detect SQL
injection vulnerabilities

Most commonly, SQL injection vulnerabilities are a result of coding vulnerabilities during
the Implementation/Development phaseand will likely require code changes.
Pen testers need to perform this testing during the development phase to find and fix the
SQL injection vulnerability.
What can a pen tester do to detect input sanitization issues?

A.

Send single quotes as the input data to catch instances where the user input is not
sanitized

B.

Send double quotes as the input data to catch instances where the user input is not
sanitized

C.

Send long strings of junk data, just as you would send strings to detect buffer overruns

D.

Use a right square bracket (the “]” character) as the input data to catch instances where
the user input is used as part of a SQL identifier without any input sanitization