EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 501:

  Which of the following is NOT an anti-forensics technique?

  A. Data Deduplication
  B. Steganography
  C. Encryption
  D. Password Protection
  A. Data Deduplication

• Question 502:

  You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?

  A. Passwords of 14 characters or less are broken up into two 7-character hashes
  B. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
  C. Networks using Active Directory never use SAM databases so the SAM database pulled was empty
  D. The passwords that were cracked are local accounts on the Domain Controller
  A. Passwords of 14 characters or less are broken up into two 7-character hashes

• Question 503:

  Which of the following is a MAC-based File Recovery Tool?

  A. VirtualLab
  B. GetDataBack
  C. Cisdem DataRecovery 3
  D. Smart Undeleter
  C. Cisdem DataRecovery 3

• Question 504:

  When cataloging digital evidence, the primary goal is to

  A. Make bit-stream images of all hard drives
  B. Preserve evidence integrity
  C. Not remove the evidence from the scene
  D. Not allow the computer to be turned off
  B. Preserve evidence integrity

• Question 505:

  While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?

  A. Technical material related to forensics
  B. No particular field
  C. Judging the character of defendants/victims
  D. Legal issues
  B. No particular field

• Question 506:

  What malware analysis operation can the investigator perform using the jv16 tool?

  A. Files and Folder Monitor
  B. Installation Monitor
  C. Network Traffic Monitoring/Analysis
  D. Registry Analysis/Monitoring
  D. Registry Analysis/Monitoring

• Question 507:

  Why is it a good idea to perform a penetration test from the inside?

  A. It is never a good idea to perform a penetration test from the inside
  B. Because 70% of attacks are from inside the organization
  C. To attack a network from a hacker's perspective
  D. It is easier to hack from the inside
  B. Because 70% of attacks are from inside the organization

• Question 508:

  Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

  A. Search for disk errors within an image file
  B. Backup a disk to an image file
  C. Copy a partition to an image file
  D. Restore a disk from an image file
  D. Restore a disk from an image file

• Question 509:

  Which of the following tool is used to locate IP addresses?

  A. SmartWhois
  B. Deep Log Analyzer
  C. Towelroot
  D. XRY LOGICAL
  A. SmartWhois

• Question 510:

  The MD5 program is used to:

  A. wipe magnetic media before recycling it
  B. make directories on an evidence disk
  C. view graphics files on an evidence drive
  D. verify that a disk is not altered when you examine it
  D. verify that a disk is not altered when you examine it