EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 161:

  Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content. Which of the following files is he going to examine?

  A. PRIV.STM

  B. gwcheck.db

  C. PRIV.EDB

  D. PUB.EDB

  Correct Answer: A

• Question 162:

  Which of the following is a database in which information about every file and directory on an NT File System (NTFS) volume is stored?

  A. Volume Boot Record

  B. Master Boot Record

  C. GUID Partition Table

  D. Master File Table

  Correct Answer: D

• Question 163:

  Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

  A. Record the system state by taking photographs of physical system and the display

  B. Perform data acquisition without disturbing the state of the systems

  C. Open the systems, remove the hard disk and secure it

  D. Switch off the systems and carry them to the laboratory

  Correct Answer: A

• Question 164:

  Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?

  A. filecache.db

  B. config.db

  C. sigstore.db

  D. Sync_config.db

  Correct Answer: D

• Question 165:

  An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense.

  A. Expert in criminal investigation

  B. Subject matter specialist

  C. Witness present at the crime scene

  D. Expert law graduate appointed by attorney

  Correct Answer: B

• Question 166:

  Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?

  A. C: $Recycled.Bin

  B. C: \$Recycle.Bin

  C. C:\RECYCLER

  D. C:\$RECYCLER

  Correct Answer: B

• Question 167:

  In Steganalysis, which of the following describes a Known-stego attack?

  A. The hidden message and the corresponding stego-image are known

  B. During the communication process, active attackers can change cover

  C. Original and stego-object are available and the steganography algorithm is known

  D. Only the steganography medium is available for analysis

  Correct Answer: C

• Question 168:

  What is the size value of a nibble?

  A. 0.5 kilo byte

  B. 0.5 bit

  C. 0.5 byte

  D. 2 bits

  Correct Answer: C

• Question 169:

  Which of the following tool enables a user to reset his/her lost admin password in a Windows system?

  A. Advanced Office Password Recovery

  B. Active@ Password Changer

  C. Smartkey Password Recovery Bundle Standard

  D. Passware Kit Forensic

  Correct Answer: B

• Question 170:

  Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?

  A. Accunetix

  B. Nikto

  C. Snort

  D. Kismet

  Correct Answer: C