Q:2-A WHERE clause in SQL specifies that a SQL Data Manipulation Language (DML) statement should only affect rows that meet specified criteria. The criteria are expressed in the form of predicates. WHERE clauses are not mandatory clauses of SQL DML statements, but can be used to limit the number of rows affected by a SQL DML statement or returned by a query.

A pen tester is trying to gain access to a database by inserting exploited query statements with a WHERE clause. The pen tester wants to retrieve all the entries from the database using the WHERE clause from a particular table (e.g. StudentTable).
What query does he need to write to retrieve the information?
Mark one answer:
EXTRACT* FROM StudentTable WHERE roll_number = 1 order by 1000
DUMP * FROM StudentTable WHERE roll_number = 1 AND 1=1—
SELECT * FROM StudentTable WHERE roll_number = '' or '1' = '1'
RETRIVE * FROM StudentTable WHERE roll_number = 1'#

Q:3-Information gathering is performed to:
i) Collect basic information about the target company and its network
ii) Determine the operating system used, platforms running, web server versions, etc.
iii) Find vulnerabilities and exploits

Which of the following pen testing tests yields information about a company’s technology infrastructure?
Mark one answer:
Searching for web page posting patterns
Analyzing the link popularity of the company’s website
Searching for trade association directories
Searching for a company’s job postings

Q:4-Which of the following defines the details of services to be provided for the client’s organization and the list of services required for performing the test in the organization?
Mark one answer:
Draft
Report
Requirement list
Quotation

Q:5-You work as an IT security auditor hired by a law firm in Boston. You have been assigned the responsibility to audit the client for security risks. When assessing the risk to the clients network, what step should you take first?
Mark one answer:
Analyzing, categorizing and prioritizing resources
Evaluating the existing perimeter and internal security
Checking for a written security policy
Analyzing the use of existing management and control architecture