A web application security tester is using Burp Suite to test an application that uses JSON Web Tokens (JWTs) for authentication. The tester wants to test for algorithm confusion vulnerabilities. Which action should the tester take?

Use Burp Intruder to brute force the JWT secret

Modify the JWT header to change the algorithm to 'none' and remove the signature

Use Burp Scanner to scan for SQL injection

Use Burp Repeater to replay the token without modification

What is the primary purpose of a security assessment report?

To serve as a legal document that proves the organization is secure

To replace the need for future security assessments

To provide a step-by-step guide for attackers to exploit the network

To communicate findings and recommended actions to stakeholders

EC-CouncilCertified Cybersecurity Technician

Domain 3Objective 1

Network Security Assessment Techniques and Tools CCT Practice Questions (Page 10)

Part of the Security Assessment and Application Security domain, which makes up ~9% of our current practice bank.

49questions here

10free pages

12concepts

Questions 46–49

46expert · hard
A web application security tester is using Burp Suite to test an application that uses JSON Web Tokens (JWTs) for authentication. The tester wants to test for algorithm confusion vulnerabilities. Which action should the tester take?
Select an answer first
47foundation · easy
What is the primary purpose of a security assessment report?
Select an answer first
48application · medium
During a penetration test, you have identified a potential vulnerability in a web application and need to confirm whether it is actually exploitable. Which tool should you use to validate the vulnerability by attempting to exploit it?
Select an answer first
49application · medium
You are assessing the security of a corporate Wi-Fi network that uses WPA2-PSK. You need to capture the four-way handshake and attempt to crack the pre-shared key. Which tool should you use to capture the handshake?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.

Network Security Assessment Techniques and Tools CCT Practice Questions (Page 10)

Questions 46–49

A web application security tester is using Burp Suite to test an application that uses JSON Web Tokens (JWTs) for authentication. The tester wants to test for algorithm confusion vulnerabilities. Which action should the tester take?

What is the primary purpose of a security assessment report?

During a penetration test, you have identified a potential vulnerability in a web application and need to confirm whether it is actually exploitable. Which tool should you use to validate the vulnerability by attempting to exploit it?

You are assessing the security of a corporate Wi-Fi network that uses WPA2-PSK. You need to capture the four-way handshake and attempt to crack the pre-shared key. Which tool should you use to capture the handshake?

Keep studying — Security Assessment and Application Security