EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 491:

  Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?

  A. Microsoft Outlook
  B. Eudora
  C. Mozilla Thunderbird
  D. Microsoft Outlook Express
  D. Microsoft Outlook Express

• Question 492:

  At what layer of the OSI model do routers function on?

  A. 4
  B. 3
  C. 1
  D. 5
  B. 3

• Question 493:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed
  B. It can find bad sectors on the hard drive
  C. It can search slack space
  D. It can find files hidden within ADS
  C. It can search slack space

• Question 494:

  In Microsoft file structures, sectors are grouped together to form:

  A. Clusters
  B. Drives
  C. Bitstreams
  D. Partitions
  A. Clusters

• Question 495:

  Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?

  A. bench warrant
  B. wire tap
  C. subpoena
  D. search warrant
  D. search warrant

• Question 496:

  Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages. What networking protocol language should she learn that routers utilize?

  A. ATM
  B. UDP
  C. BPG
  D. OSPF
  D. OSPF

• Question 497:

  When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

  A. All virtual memory will be deleted
  B. The wrong partition may be set to active
  C. This action can corrupt the disk
  D. The computer will be set in a constant reboot state
  C. This action can corrupt the disk

• Question 498:

  What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?

  A. Internet service provider information
  B. E-mail header
  C. Username and password
  D. Firewall log
  B. E-mail header

• Question 499:

  During the trial, an investigator observes that one of the principal witnesses is severely ill and cannot be present for the hearing. He decides to record the evidence and present it to the court. Under which rule should he present such evidence?

  A. Rule 1003: Admissibility of Duplicates
  B. Limited admissibility
  C. Locard's Principle
  D. Hearsay
  B. Limited admissibility

• Question 500:

  Which of the following files DOES NOT use Object Linking and Embedding (OLE) technology to embed and link to other objects?

  A. Portable Document Format
  B. MS-office Word Document
  C. MS-office Word OneNote
  D. MS-office Word PowerPoint
  A. Portable Document Format