Free 312-49 Exam Dumps Preview

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear.
In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

Which of the following tool enables data acquisition and duplication?

You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court.

What argument could the defense make to weaken your case?

You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company clients. You have rummaged through their trash and found very little information. You do not want to set off any alarms on their network, so you plan on performing passive foot printing against their Web servers.

What tool should you use?

An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack.

Which type of attack is this?

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document.

What can an investigator examine to verify that a file has the correct extension?

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices.

How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

You have been given the task to investigate web attacks on a Windows-based server.

Which of the following commands will you use to look at the sessions the machine has opened with other systems?

Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1.

What is the file type of the image?

George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network.

What filter should George use in Ethereal?

Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces.

What could have prevented this information from being stolen from the laptops?

John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk.

Why is that?

A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file.

What kind of picture is this file?

You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?

22,164 cylinders/disk
80 heads/cylinder
63 sectors/track

What is the investigator trying to view by issuing the command displayed in the following screenshot?

You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for.

You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are required MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

What is one method of bypassing a system BIOS password?

Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?

The following is a log file screenshot from a default installation of IIS 6.0.

What time standard is used by IIS as seen in the screenshot?

What binary coding is used most often for e-mail purposes?

Windows identifies which application to open a file with by examining which of the following?

When you carve an image, recovering the image depends on which of the following skills?

Which of the following should a computer forensics lab used for investigations have?

Where are files temporarily written in Unix when printing?

Law enforcement officers are conducting a legal search for which a valid warrant was obtained.
While conducting the search, officers observe an item of evidence for an unrelated crime that was not included in the warrant. The item was clearly visible to the officers and immediately identified as evidence.

What is the term used to describe how this evidence is admissible?

When obtaining a warrant, it is important to:

Charles has accidentally deleted an important file while working on his Mac computer. He wants to recover the deleted file as it contains some of his crucial business secrets.

Which of the following tool will help Charles?

Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying.

What term should Harold use?

Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization's DC server. Smith wants to find all the values typed into the Run box in the Start menu.

Which of the following registry keys will Smith check to find the above information?

Diskcopy is:

Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated.

When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?

Which among the following files provides email header information in the Microsoft Exchange server?

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will.

What do you do?

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed.

What information will the virtual memory scan produce?

What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

John is working on his company policies and guidelines. The section he is currently working on covers
company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed.

What type of shredder should John write in the guidelines to be used when destroying documents?

As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company.

What information will you be able to gather?

Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space.

What type of test would confirm his claim?

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time-based induction machine" be used.

What IDS feature must George implement to meet this requirement?

You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network.

Why would you want to initiate a DoS attack on a system you are testing?

What advantage does the tool Evidor have over the built-in Windows search?

Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate.
He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT. Which firewall would be most appropriate for Harold?
needs?

How often must a company keep log files for them to be admissible in a court of law?

Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security. Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort.

Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers.

What should be his first response while maintaining the integrity of evidence?

Which command line tool is used to determine active network connections?

Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless.
Under which US Amendment is Madison lawyer trying to prove the police violated?

At what layer does a cross site scripting attack occur on?

When is it appropriate to use computer forensics?

What must be obtained before an investigation is carried out at a location?

Which of the following processes is part of the dynamic malware analysis?

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

In Linux, what is the smallest possible shellcode?

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense.

Microsoft Outlook maintains email messages in a proprietary format in what type of file?

From the following spam mail header, identify the host IP that sent this spam?

From [email protected] [email protected] Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)
Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by
viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)
with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >[email protected]
From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0
X-Priority: 3 X-MSMail-
Priority: Normal
Reply-To: "china hotel web"

Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics.

Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

Why is it a good idea to perform a penetration test from the inside?

If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation.
At what layer of the OSI model are you monitoring while watching traffic to and from the router?

What is the slave device connected to the secondary IDE controller on a Linux OS referred to?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled.

Where could the investigator search to find the message tracking log file on the Exchange server?

Ron, a computer forensics expert, is investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in ON condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner.

Which of the following key combinations can he use to recover the IMEI number?

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls.

Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it?

Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?

During forensics investigations, investigators tend to collect the system time at first and compare it with UTC.

What does the abbreviation UTC stand for?

Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.
?

In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database.
You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test."

What is the result of this test?

What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

Where is the default location for Apache access logs on a Linux computer?

Item 2If you come across a sheepdip machine at your client site, what would you infer?