EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 31:

  To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?

  A. Computer Forensics Tools and Validation Committee (CFTVC)
  B. Association of Computer Forensics Software Manufactures (ACFSM)
  C. National Institute of Standards and Technology (NIST)
  D. Society for Valid Forensics Tools and Testing (SVFTT)
  C. National Institute of Standards and Technology (NIST)

• Question 32:

  Kyle is performing the final testing of an application he developed for the accounting department.

  His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command. What is he testing at this point?

  #include #include int main(int argc, char

  *argv[]) { char buffer[10]; if (argc < 2) { fprintf (stderr, "USAGE: %s string\n", argv[0]); return 1; }

  strcpy(buffer, argv[1]); return 0; }

  A. Buffer overflow
  B. SQL injection
  C. Format string bug
  D. Kernal injection
  A. Buffer overflow

• Question 33:

  An "idle" system is also referred to as what?

  A. PC not connected to the Internet
  B. Zombie
  C. PC not being used
  D. Bot
  B. Zombie

• Question 34:

  What will the following command accomplish?

  A. Test ability of a router to handle over-sized packets
  B. Test the ability of a router to handle under-sized packets
  C. Test the ability of a WLAN to handle fragmented packets
  D. Test the ability of a router to handle fragmented packets
  A. Test ability of a router to handle over-sized packets

• Question 35:

  Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

  A. Sector
  B. Metadata
  C. MFT
  D. Slack Space
  D. Slack Space

• Question 36:

  Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses' testimony during federal legal proceedings?

  A. SWGDE and SWGIT
  B. IOCE
  C. Frye
  D. Daubert
  D. Daubert

• Question 37:

  What will the following command accomplish in Linux? fdisk /dev/hda

  A. Partition the hard drive
  B. Format the hard drive
  C. Delete all files under the /dev/hda folder
  D. Fill the disk with zeros
  A. Partition the hard drive

• Question 38:

  Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card. What can Jason do in this scenario to reset the PIN and access SIM data?

  A. He should contact the network operator for a Temporary Unlock Code (TUK)
  B. Use system and hardware tools to gain access
  C. He can attempt PIN guesses after 24 hours
  D. He should contact the network operator for Personal Unlock Number (PUK)
  D. He should contact the network operator for Personal Unlock Number (PUK)

• Question 39:

  Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?

  A. Core Services
  B. Media services
  C. Cocoa Touch
  D. Core OS
  D. Core OS

• Question 40:

  Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob's testimony in this case?

  A. Certification
  B. Justification
  C. Reiteration
  D. Authentication
  D. Authentication