Free EC0-349 Exam Dumps Preview

When you carve an image, recovering the image depends on which of the following skills?

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour.

Why were these passwords cracked so Quickly?

James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network.

What type of DoS attack is James testing against his network?

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will.

What do you do?

You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database.
You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test."

What is the result of this test?

From the following spam mail header, identify the host IP that sent this spam?

From [email protected] [email protected] Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)
Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by
viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)
with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >[email protected]
From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0
X-Priority: 3 X-MSMail-
Priority: Normal
Reply-To: "china hotel web"

Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests.

What type of scan is Jessica going to perform?

Which part of the Windows Registry contains the user's password file?

Larry is an IT consultant who works for corporations and government agencies. Larry plans on shutting down the city's network using BGP devices and zombies?

What type of Penetration Testing is Larry planning to carry out?

What advantage does the tool Evidor have over the built-in Windows search?

While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h.

What does this indicate on the computer?

How many possible sequence number combinations are there in TCP/IP protocol?

What method of copying should always be performed first before carrying out an investigation?

This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.

Why is it a good idea to perform a penetration test from the inside?

If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?

An investigator wants to prove that an acquired image is an exact copy of the original drive.

Which approach is correct?

When obtaining a warrant, it is important to:

You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network.

How would you answer?

What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florid a. They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good. Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa. She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, requested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for.

What principal of social engineering did Julia use?

Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders were able to gain access into the company firewalls by overloading them with IP packets. Cylie then discovers through her investigation that the intruders hacked into the company phone system and used the hard drives on their PBX system to store shared music files.

What would this attack on the company PBX system be called?

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information.

Why will this not be viable?

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab.

How many law-enforcement computer investigators should you request to staff the lab?

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different.

What area of the law is the employee violating?

At what layer does a cross site scripting attack occur on?

John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk.

Why is that?

As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company.

What information will you be able to gather?

Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors.
Jason wants to report this crime to the law enforcement agencies immediately.

Which organization coordinates computer crimes investigations throughout the United States?

When using an iPod and the host computer is running Windows, what file system will be used?

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet.

Why is that?

What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document.

What is that code called?

Where is the default location for Apache access logs on a Linux computer?

How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

Paraben Lockdown device uses which operating system to write hard drive data?

Item 2If you come across a sheepdip machine at your client site, what would you infer?

What encryption technology is used on Blackberry devices Password Keeper?

Which tool or technique is most appropriate for capturing the contents of a system's volatile memory for later analysis?

What is the smallest physical storage unit on a hard drive?

Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

If you see the files Zer0.
tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

What must an investigator do before disconnecting an iPod from any type of computer?