EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 121:

  Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

  A. A text file deleted from C drive in sixth sequential order

  B. A text file deleted from C drive in fifth sequential order

  C. A text file copied from D drive to C drive in fifth sequential order

  D. A text file copied from C drive to D drive in fifth sequential order

  Correct Answer: B

• Question 122:

  Andie, a network administrator, suspects unusual network services running on a windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?

  A. net serv

  B. netmgr

  C. lusrmgr

  D. net start

  Correct Answer: D

• Question 123:

  You are assigned a task to examine the log files pertaining to MyISAM storage engine. While examining, you are asked to perform a recovery operation on a MyISAM log file. Which among the following MySQL Utilities allow you to do so?

  A. mysqldump

  B. myisamaccess

  C. myisamlog

  D. myisamchk

  Correct Answer: C

• Question 124:

  Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

  A. Speculation or opinion as to the cause of the incident

  B. Purpose of the report

  C. Author of the report

  D. Incident summary

  Correct Answer: A

• Question 125:

  Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?

  A. OpenGL/ES and SGL

  B. Surface Manager

  C. Media framework

  D. WebKit

  Correct Answer: A

• Question 126:

  A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect's available information but without any success. Which of the following tool can help the investigator to solve this issue?

  A. Cain and Abel

  B. Xplico

  C. Recuva

  D. Colasoft's Capsa

  Correct Answer: A

• Question 127:

  Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

  A. Tokenmon

  B. PSLoggedon

  C. TCPView

  D. Process Monitor

  Correct Answer: B

• Question 128:

  Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

  A. Civil Investigation

  B. Administrative Investigation

  C. Both Civil and Criminal Investigations

  D. Criminal Investigation

  Correct Answer: B

• Question 129:

  An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?

  A. SysAnalyzer

  B. PEiD

  C. Comodo Programs Manager

  D. Dependency Walker

  Correct Answer: B

• Question 130:

  Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

  A. NTFS

  B. FAT

  C. EXT

  D. FAT32

  Correct Answer: A