Weekend Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65

ECSS EC-Council Certified Security Specialist (ECSSv10)Exam Questions and Answers

Questions 4

Which of the following layers of the loT architecture is responsible for delivering services to respective users from different sectors such as building, industrial, manufacturing, automobile, security, and healthcare?

Options:

A.

Middleware layer

B.

Access gateway layer

C.

Application layer

D.

Edge technology layer

Buy Now
Questions 5

Identify the backup mechanism that is performed within the organization using external devices such as hard disks and requires human interaction to perform the backup operations, thus, making it suspect able to theft or natural disasters.

Options:

A.

Offsite data backup

B.

Cloud data backup

C.

Online data backup

D.

Onsite data backup

Buy Now
Questions 6

James, a forensic specialist, was appointed to investigate an incident in an organization. As part of the investigation, James is attempting to identify whether any external storage devices are connected to the internal systems. For this purpose, he employed a utility to capture the list of all devices connected to the local machine and removed suspicious devices.

Identify the tool employed by James in the above scenario.

Options:

A.

Promise Detect

B.

DriveLetlerView

C.

ESEDatabaseView

D.

ProcDump

Buy Now
Questions 7

Which of the following standards and criteria version of SWCDE mandates that any action with the potential to alter, damage, or destroy any aspect of original evidence must be performed by qualified persons in a forensically sound manner?

Options:

A.

Standards and Criteria 11

B.

Standards and Criteria 13

C.

Standards and Criteria 17

D.

Standards and Criteria 15

Buy Now
Questions 8

Robert, a security specialist, was appointed to strengthen the security of the organization's network. To prevent multiple login attempts from unknown sources, Robert implemented a security strategy of issuing alerts or warning messages when multiple failed login attempts are made.

Which of the following security risks is addressed by Robert to make attempted break-ins unsuccessful?

Options:

A.

Indefinite session timeout

B.

Absence of account lockout for invalid session IDs

C.

Small session-ID generation

D.

Weak session-ID generation

Buy Now
Questions 9

Sam is working as a loan agent for a financial institution. He frequently receives a number of emails from clients providing their personal details for loan approval. As these emails contain sensitive data. Sam had set up a feature that directly downloads the emails on his device without storing a copy on the mail server.

Which of the following protocols provides the above-discussed email features?

Options:

A.

SHA-1

B.

ICMP

C.

SNMP

D.

POP3

Buy Now
Questions 10

Below are the various steps involved in an email crime investigation.

1.Acquiring the email data

2.Analyzing email headers

3.Examining email messages

4.Recovering deleted email messages

5.Seizing the computer and email accounts

6.Retrieving email headers

What is the correct sequence of steps involved in the investigation of an email crime?

Options:

A.

5->l->3->6-->2 >4

B.

2->4->3-->6->5-->l

C.

1—>3->4—>2-->5">6

D.

5 -> 1 -> 6 -> 2 -> 3 -> 4

Buy Now
Questions 11

Messy, a network defender, was hired to secure an organization's internal network. He deployed an IDS in which the detection process depends on observing and comparing the observed events with the normal behavior and then detecting any deviation from it.

Identify the type of IDS employed by Messy in the above scenario.

Options:

A.

Stateful protocol analysis

B.

Anomaly-based

C.

Signature-based

D.

Application proxy

Buy Now
Questions 12

Michael is an attacker who aims to hack Bob's system. He started collecting data without any active interaction with Bob’s system. Using this technique. Michael can extract sensitive information from unencrypted data.

Identify the class of attack Michael has launched in the above scenario.

Options:

A.

Ac live attack

B.

Insider attack

C.

Close in attack

D.

Passive attack

Buy Now
Questions 13

Which of the following cloud computing threats arises from authentication vulnerabilities, user-provisioning and de-provisioning vulnerabilities, hypervisor vulnerabilities, unclear roles and responsibilities, and misconfigurations?

Options:

A.

Supply-chain failure

B.

Isolation failure

C.

Subpoena and e discovery

D.

Privilege escalation

Buy Now
Questions 14

John, a forensic officer, was working on a criminal case. He employed imaging software to create a copy of data from the suspect device on a storage medium for further investigation. For developing an image of the original data, John used a software application that does not allow an unauthorized user to alter the image content on storage media, thereby retaining an unaltered image copy.

Identify the data acquisition step performed by John in the above scenario.

Options:

A.

Validated data acquisition

B.

Planned for contingency

C.

Sanitized the target media

D.

Enabled write protection on the evidence media

Buy Now
Questions 15

Stephen, a security specialist, was instructed to identify emerging threats on the organization's network. In this process, he employed a computer system on the Internet intended to attract and trap those who attempt unauthorized host system utilization to penetrate the organization's network.

Identify the type of security solution employed by Stephen in the above scenario.

Options:

A.

Firewall

B.

IDS

C.

Honeypot

D.

Proxy server

Buy Now
Questions 16

Below is an extracted Apache error log entry.

"(Wed Aug 28 13:35:38.878945 2020] (core:error] (pid 12356:tid 8689896234] (client 10.0.0.8] File not found: /images/folder/pic.jpg"

Identify the element in the Apache error log entry above that represents the IP address from which the request was made.

Options:

A.

10.0.0.8

B.

8689896234

C.

13:35:38.878945

D.

12356

Buy Now
Questions 17

Joseph, a security professional, was instructed to secure the organization's network. In this process, he began analyzing packet headers to check whether any indications of source and destination IP addresses and port numbers are being changed during transmission.

Identify the attack signature analysis technique performed by Joseph in the above scenario.

Options:

A.

Composite-signature-based analysis

B.

Context based signature analysis

C.

Content based signature analysis

D.

Atomic signature based analysis

Buy Now
Questions 18

While investigating a web attack on a Windows-based server, Jessy executed the following command on her system:

C:\> net view <10.10.10.11>

What was Jessy’s objective in running the above command?

Options:

A.

Verify the users using open sessions

B.

Check file space usage to look for a sudden decrease in free space

C.

Check whether sessions have been opened with other systems

D.

Review file shares to ensure their purpose

Buy Now
Questions 19

James is a professional hacker attempting to gain access to an industrial system through a remote control device. In this process, he used a specially designed radio transceiver device to sniff radio commands and inject arbitrary code into the firmware of the remote controllers to maintain persistence.

Which of the following attacks is performed by James in the above scenario?

Options:

A.

Malicious reprogramming attack

B.

Re pairing with a malicious RF controller

C.

Command injection

D.

Abusing reprogramming attack

Buy Now
Questions 20

Kevin, an attacker, is attempting to compromise a cloud server. In this process, Kevin intercepted the SOAP messages transmitted between a user and the server, manipulated the body of the message, and then redirected it to the server as a legitimate user to gain access and run malicious code on the cloud server.

Identify the attack initiated by Kevin on the target cloud server.

Options:

A.

Side-channel attack

B.

Wrapping attack

C.

Cross guest VM breaches

D.

DNS spoofing

Buy Now
Questions 21

Below are the various steps involved in forensic readiness planning.

l.Keep an incident response team ready to review the incident and preserve the evidence.

2.Create a process for documenting the procedure.

3.ldentify the potential evidence required for an incident.

4.Determine the sources of evidence.

5.Establish a legal advisory board to guide the investigation process.

6.ldentify if the incident requires full or formal investigation.

7.Establish a policy for securely handling and storing the collected evidence.

8.Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption. Identify the correct sequence of steps involved in forensic readiness planning.

Options:

A.

1 >2 >3 >4 -5 >6 >7 >8

B.

2..>3->l->4->6->5->7->8

C.

3 >4 >8 >7 >6 >2 >5 >1

D.

3 >1. >4 >S >8 >2 >6 >7

Buy Now
Questions 22

Daniel, a professional hacker, targeted Alice and lured her into downloading a malicious app from a third-party app store. Upon installation, the core malicious code inside the application started infecting other legitimate apps in Alice's mobile device. Daniel overloaded Alice's device with irrelevant and fraudulent advertisements through the infected app for financial gain.

Identify the type of attack Daniel has launched in the above scenario.

Options:

A.

Agent Smith attack

B.

Bluebugging attack

C.

SMiShing attack

D.

SIM card attack

Buy Now
Questions 23

Melanie, a professional hacker, is attempting to break into a target network through an application server. In this process, she identified a logic flaw in the target web application that provided visibility into the source code. She exploited this vulnerability to launch further attacks on the target web application.

Which of the web application vulnerabilities was identified by Melanie in the above scenario?

Options:

A.

Insecure deserialization

B.

Security misconfiguration

C.

Command injection

D.

Broken authentication

Buy Now
Questions 24

Morris, an attacker, targeted an application server to manipulate its services. He succeeded by employing input validation attacks such as XSS that exploited vulnerabilities present in the programming logic of an application. Identify the web application layer in which Morris has manipulated the programming logic.

Options:

A.

Business layer

B.

Presentation layer

C.

Database layer

D.

Client layer

Buy Now
Questions 25

An investigator wants to extract information about the status of the network interface cards (NICs) in an organization's Windows-based systems. Identify the command-line utility that can help the investigator detect the network status.

Options:

A.

ipconfig

B.

PsList

C.

ifconfig

D.

PsLoggedOn

Buy Now
Questions 26

Cheryl, a forensic expert, was recruited to investigate a malicious activity performed by an anonymous hackers’ group on an organization’s systems. Using an automated tool, Cheryl was able to extract the malware file and analyze the assembly code instructions, which helped him understand the malware’s purpose.

Which of the following tools helped Cheryl extract and analyze the assembly code of the malware?

Options:

A.

Virtual Box

B.

OllyDbg

C.

QualNet

D.

VMware vSphere

Buy Now
Questions 27

Clark, a digital forensic expert, was assigned to investigate a malicious activity performed on an organization's network. The organization provided Clark with all the information related to the incident. In this process, he assessed the impact of the incident on the organization, reasons for and source of the incident, steps required to tackle the incident, investigating team required to handle the case, investigative procedures, and possible outcome of the forensic process.

Identify the type of analysis performed by Clark in the above scenario.

Options:

A.

Data analysis

B.

Log analysis

C.

Traffic analysis

D.

Case analysis

Buy Now
Questions 28

An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose. Steven, a security analyst, was instructed to deploy a device to bait attackers. Steven selected a solution that appears to contain very useful information to lure attackers and find their locationsand techniques.

Identify the type of device deployed by Steven in the above scenario.

Options:

A.

Firewall

B.

Router

C.

Intrusion detection system

D.

Honeypot

Buy Now
Questions 29

Martin, a hacker, aimed to crash a target system. For this purpose, he spoofed the source IP address with the target's IP address and sent many ICMP ECHO request packets to an IP broadcast network, causing all the hosts to respond to the received ICMP ECHO requests and ultimately crashing the target machine.

Identify the type of attack performed by Martin in the above scenario.

Options:

A.

UDP flood attack

B.

Multi vector attack

C.

Smurf attack

D.

Fragmentation attack

Buy Now
Questions 30

Bob. a network specialist in an organization, is attempting to identify malicious activities in the network. In this process. Bob analyzed specific data that provided him a summary of a conversation between two network devices, including a source IP and source port, a destination IP and destination port, the duration of the conversation, and the information shared during the conversation.

Which of the following types of network-based evidence was collected by Bob in the above scenario?

Options:

A.

Statistical data

B.

Alert data

C.

Session data

D.

Full content data

Buy Now
Exam Code: ECSS
Exam Name: EC-Council Certified Security Specialist (ECSSv10)Exam
Last Update: Jun 15, 2025
Questions: 100

PDF + Testing Engine

$57.75  $164.99

Testing Engine

$43.75  $124.99
buy now ECSS testing engine

PDF (Q&A)

$36.75  $104.99
buy now ECSS pdf