EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 321:

  When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

  A. on the individual computer's ARP cache
  B. in the Web Server log files
  C. in the DHCP Server log files
  D. there is no way to determine the specific IP address
  C. in the DHCP Server log files

• Question 322:

  Which of the following does Microsoft Exchange E-mail Server use for collaboration of various e-mail applications?

  A. Simple Mail Transfer Protocol (SMTP)
  B. Messaging Application Programming Interface (MAPI)
  C. Internet Message Access Protocol (IMAP)
  D. Post Office Protocol version 3 (POP3)
  B. Messaging Application Programming Interface (MAPI)

• Question 323:

  Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image?

  A. gif
  B. bmp
  C. jpeg
  D. png
  C. jpeg

• Question 324:

  Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

  A. A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
  B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
  C. A simple DOS copy will not include deleted files, file slack and other information
  D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
  C. A simple DOS copy will not include deleted files, file slack and other information

• Question 325:

  You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

  A. The registry
  B. The swap file
  C. The recycle bin
  D. The metadata
  B. The swap file

• Question 326:

  Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.

  Which organization coordinates computer crimes investigations throughout the United States?

  A. Internet Fraud Complaint Center
  B. Local or national office of the U.S. Secret Service
  C. National Infrastructure Protection Center
  D. CERT Coordination Center
  B. Local or national office of the U.S. Secret Service

• Question 327:

  John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents?

  A. Strip-cut shredder
  B. Cross-cut shredder
  C. Cross-hatch shredder
  D. Cris-cross shredder
  B. Cross-cut shredder

• Question 328:

  With Regard to using an Antivirus scanner during a computer forensics investigation, You should:

  A. Scan the suspect hard drive before beginning an investigation
  B. Never run a scan on your forensics workstation because it could change your systems configuration
  C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
  D. Scan your Forensics workstation before beginning an investigation
  D. Scan your Forensics workstation before beginning an investigation

• Question 329:

  Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

  A. Record the system state by taking photographs of physical system and the display
  B. Perform data acquisition without disturbing the state of the systems
  C. Open the systems, remove the hard disk and secure it
  D. Switch off the systems and carry them to the laboratory
  A. Record the system state by taking photographs of physical system and the display

• Question 330:

  A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

  A. /auth
  B. /proc
  C. /var/log/debug
  D. /var/spool/cron/
  B. /proc