EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 11:

  Which rule requires an original recording to be provided to prove the content of a recording?

  A. 1004
  B. 1002
  C. 1003
  D. 1005
  B. 1002

• Question 12:

  Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

  A. APIPA
  B. IANA
  C. CVE
  D. RIPE
  C. CVE

• Question 13:

  What stage of the incident handling process involves reporting events?

  A. Containment
  B. Follow-up
  C. Identification
  D. Recovery
  C. Identification

• Question 14:

  When investigating a wireless attack, what information can be obtained from the DHCP logs?

  A. The operating system of the attacker and victim computers
  B. IP traffic between the attacker and the victim
  C. MAC address of the attacker
  D. If any computers on the network are running in promiscuous mode
  C. MAC address of the attacker

• Question 15:

  Which principle states that "anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave"?

  A. Locard's Exchange Principle
  B. Enterprise Theory of Investigation
  C. Locard's Evidence Principle
  D. Evidence Theory of Investigation
  A. Locard's Exchange Principle

• Question 16:

  Which of the following is NOT a part of pre-investigation phase?

  A. Building forensics workstation
  B. Gathering information about the incident
  C. Gathering evidence data
  D. Creating an investigation team
  C. Gathering evidence data

• Question 17:

  When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel?

  A. Multiple access points can be set up on the same channel without any issues
  B. Avoid over-saturation of wireless signals
  C. So that the access points will work on different frequencies
  D. Avoid cross talk
  D. Avoid cross talk

• Question 18:

  What happens when a file is deleted by a Microsoft operating system using the FAT file system?

  A. only the reference to the file is removed from the FAT
  B. the file is erased and cannot be recovered
  C. a copy of the file is stored and the original file is erased
  D. the file is erased but can be recovered
  A. only the reference to the file is removed from the FAT

• Question 19:

  What is the first step taken in an investigation for laboratory forensic staff members?

  A. Packaging the electronic evidence
  B. Securing and evaluating the electronic crime scene
  C. Conducting preliminary interviews
  D. Transporting the electronic evidence
  B. Securing and evaluating the electronic crime scene

• Question 20:

  You are assigned a task to examine the log files pertaining to MyISAM storage engine. While examining, you are asked to perform a recovery operation on a MyISAM log file. Which among the following MySQL Utilities allow you to do so?

  A. mysqldump
  B. myisamaccess
  C. myisamlog
  D. myisamchk
  C. myisamlog