EC-Council ECSA Certified Security Analyst Exam | Complete
Practice Questions, Answers & Detailed Explanations
(2026/2027)
Question 1
What is the primary purpose of defining Rules of Engagement (RoE)
prior to initiating a penetration test?
• A. To outline the specific vulnerability scanners that must be used
by the client's internal team.
• B. To establish legal boundaries, authorized scope, testing
windows, and safety protocols to prevent operational disruption.
• C. To guarantee that 100% of all critical vulnerabilities in the target
infrastructure will be discovered.
• D. To determine the exact financial compensation structure for the
penetration testing vendor.
Correct Answer: B. To establish legal boundaries, authorized scope,
testing windows, and safety protocols to prevent operational disruption.
Detailed Rationale: Rules of Engagement (RoE) define the legal, ethical,
and operational framework for a penetration test. They protect both
the client and the tester by specifying out-of-bounds systems,
emergency contact procedures, and authorized testing hours.
Question 2
During the reconnaissance phase of a penetration test, a security
analyst uses Google Dorking to locate sensitive configuration files
,exposed on a target's web server. Which specific operator is best suited
to search for files with an extension of .config?
• A. site:
• B. filetype:
• C. inurl:
• D. cache:
Correct Answer: B. filetype:
Detailed Rationale: The filetype: operator instructs search engines to
restrict results to files matching a specific extension or format (e.g.,
filetype:config or filetype:pdf), helping analysts discover publicly
indexed configuration files.
Question 3
What is the primary advantage of using a stealth SYN scan (Stealth Scan
/ -sS in Nmap) compared to a full TCP Connect scan (-sT)?
• A. It completes the full three-way handshake, ensuring absolute
reliability over lossy networks.
• B. It avoids logging full connection attempts on many target
operating systems because it tears down the connection via an
RST packet before the handshake is finalized.
• C. It is completely invisible to all modern intrusion detection
systems (IDS) and firewalls.
• D. It requires no elevated privileges (root or administrator access)
to execute.
,Correct Answer: B. It avoids logging full connection attempts on many
target operating systems because it tears down the connection via an
RST packet before the handshake is finalized.
Detailed Rationale: A SYN scan sends a SYN packet and awaits a SYN-
ACK. Upon receiving it, the scanner responds with an RST packet instead
of an ACK, preventing the completion of the 3-way handshake. This
often bypasses basic application-level logging, though modern stateful
firewalls can still detect it.
Question 4
Which Nmap Scripting Engine (NSE) category should a penetration
tester avoid running during a live production assessment if they want to
strictly minimize the risk of causing a denial of service (DoS)?
• A. safe
• B. discovery
• C. intrusive
• D. default
Correct Answer: C. intrusive
Detailed Rationale: The intrusive NSE category contains scripts that are
high-risk, likely to crash services, consume excessive bandwidth, or
cause a denial of service. They should only be run with explicit client
authorization in non-production environments.
Question 5
, An analyst is performing a passive information gathering exercise
against a target organization. Which of the following tools or techniques
is considered passive?
• A. Executing an aggressive Nmap OS fingerprinting scan against
the primary web server.
• B. Querying public certificate transparency logs (e.g., crt.sh) to
identify internal or auxiliary subdomains.
• C. Sending custom TCP packets with invalid flag combinations to
probe firewall rule sets.
• D. Running a directory brute-force tool like Gobuster against the
corporate portal.
Correct Answer: B. Querying public certificate transparency logs (e.g.,
crt.sh) to identify internal or auxiliary subdomains.
Detailed Rationale: Passive reconnaissance involves interacting with
third-party sources or public repositories without directly probing or
sending packets to the target's infrastructure, ensuring complete stealth
from the target's monitoring systems.
Question 6
When analyzing a target network map, an analyst notices that a specific
router responds to ICMP timestamp requests. What security risk does
this information disclosure present?
• A. It allows an attacker to execute remote code execution via
buffer overflow on the router's BIOS.
• B. It leaks system uptime information, which helps attackers infer
whether recent security patches have been applied.
Practice Questions, Answers & Detailed Explanations
(2026/2027)
Question 1
What is the primary purpose of defining Rules of Engagement (RoE)
prior to initiating a penetration test?
• A. To outline the specific vulnerability scanners that must be used
by the client's internal team.
• B. To establish legal boundaries, authorized scope, testing
windows, and safety protocols to prevent operational disruption.
• C. To guarantee that 100% of all critical vulnerabilities in the target
infrastructure will be discovered.
• D. To determine the exact financial compensation structure for the
penetration testing vendor.
Correct Answer: B. To establish legal boundaries, authorized scope,
testing windows, and safety protocols to prevent operational disruption.
Detailed Rationale: Rules of Engagement (RoE) define the legal, ethical,
and operational framework for a penetration test. They protect both
the client and the tester by specifying out-of-bounds systems,
emergency contact procedures, and authorized testing hours.
Question 2
During the reconnaissance phase of a penetration test, a security
analyst uses Google Dorking to locate sensitive configuration files
,exposed on a target's web server. Which specific operator is best suited
to search for files with an extension of .config?
• A. site:
• B. filetype:
• C. inurl:
• D. cache:
Correct Answer: B. filetype:
Detailed Rationale: The filetype: operator instructs search engines to
restrict results to files matching a specific extension or format (e.g.,
filetype:config or filetype:pdf), helping analysts discover publicly
indexed configuration files.
Question 3
What is the primary advantage of using a stealth SYN scan (Stealth Scan
/ -sS in Nmap) compared to a full TCP Connect scan (-sT)?
• A. It completes the full three-way handshake, ensuring absolute
reliability over lossy networks.
• B. It avoids logging full connection attempts on many target
operating systems because it tears down the connection via an
RST packet before the handshake is finalized.
• C. It is completely invisible to all modern intrusion detection
systems (IDS) and firewalls.
• D. It requires no elevated privileges (root or administrator access)
to execute.
,Correct Answer: B. It avoids logging full connection attempts on many
target operating systems because it tears down the connection via an
RST packet before the handshake is finalized.
Detailed Rationale: A SYN scan sends a SYN packet and awaits a SYN-
ACK. Upon receiving it, the scanner responds with an RST packet instead
of an ACK, preventing the completion of the 3-way handshake. This
often bypasses basic application-level logging, though modern stateful
firewalls can still detect it.
Question 4
Which Nmap Scripting Engine (NSE) category should a penetration
tester avoid running during a live production assessment if they want to
strictly minimize the risk of causing a denial of service (DoS)?
• A. safe
• B. discovery
• C. intrusive
• D. default
Correct Answer: C. intrusive
Detailed Rationale: The intrusive NSE category contains scripts that are
high-risk, likely to crash services, consume excessive bandwidth, or
cause a denial of service. They should only be run with explicit client
authorization in non-production environments.
Question 5
, An analyst is performing a passive information gathering exercise
against a target organization. Which of the following tools or techniques
is considered passive?
• A. Executing an aggressive Nmap OS fingerprinting scan against
the primary web server.
• B. Querying public certificate transparency logs (e.g., crt.sh) to
identify internal or auxiliary subdomains.
• C. Sending custom TCP packets with invalid flag combinations to
probe firewall rule sets.
• D. Running a directory brute-force tool like Gobuster against the
corporate portal.
Correct Answer: B. Querying public certificate transparency logs (e.g.,
crt.sh) to identify internal or auxiliary subdomains.
Detailed Rationale: Passive reconnaissance involves interacting with
third-party sources or public repositories without directly probing or
sending packets to the target's infrastructure, ensuring complete stealth
from the target's monitoring systems.
Question 6
When analyzing a target network map, an analyst notices that a specific
router responds to ICMP timestamp requests. What security risk does
this information disclosure present?
• A. It allows an attacker to execute remote code execution via
buffer overflow on the router's BIOS.
• B. It leaks system uptime information, which helps attackers infer
whether recent security patches have been applied.
