EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 311:

  Diskcopy is:

  A. a utility by AccessData
  B. a standard MS-DOS command
  C. Digital Intelligence utility
  D. dd copying tool
  B. a standard MS-DOS command

• Question 312:

  Bob works as information security analyst for a big finance company. One day, the anomaly-based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the main web server was occurring. What kind of attack is it?

  A. IDS attack
  B. APT
  C. Web application attack
  D. Network attack
  D. Network attack

• Question 313:

  What is cold boot (hard boot)?

  A. It is the process of restarting a computer that is already in sleep mode
  B. It is the process of shutting down a computer from a powered-on or on state
  C. It is the process of restarting a computer that is already turned on through the operating system
  D. It is the process of starting a computer from a powered-down or off state
  D. It is the process of starting a computer from a powered-down or off state

• Question 314:

  Which of the following is NOT a physical evidence?

  A. Removable media
  B. Cables
  C. Image file on a hard disk
  D. Publications
  C. Image file on a hard disk

• Question 315:

  Which of the following is a federal law enacted in the US to control the ways that financial institutions deal with the private information of individuals?

  A. SOX
  B. HIPAA 1996
  C. GLBA
  D. PCI DSS
  C. GLBA

• Question 316:

  Before performing a logical or physical search of a drive in Encase, what must be added to the program?

  A. File signatures
  B. Keywords
  C. Hash sets
  D. Bookmarks
  B. Keywords

• Question 317:

  Why should you note all cable connections for a computer you want to seize as evidence?

  A. to know what outside connections existed
  B. in case other devices were connected
  C. to know what peripheral devices exist
  D. to know what hardware existed
  A. to know what outside connections existed

• Question 318:

  You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?

  A. trademark law
  B. copyright law
  C. printright law
  D. brandmark law
  A. trademark law

• Question 319:

  Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?

  A. Events history
  B. Previously typed commands
  C. History of the browser
  D. Passwords used across the system
  B. Previously typed commands

• Question 320:

  Which of the following techniques can be used to beat steganography?

  A. Encryption
  B. Steganalysis
  C. Decryption
  D. Cryptanalysis
  B. Steganalysis