EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 511:

  Which of the following refers to the process of the witness being questioned by the attorney who called the latter to the stand?

  A. Witness Authentication
  B. Direct Examination
  C. Expert Witness
  D. Cross Questioning
  B. Direct Examination

• Question 512:

  Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?

  A. Identifying File Dependencies
  B. Strings search
  C. Dynamic analysis
  D. File obfuscation
  B. Strings search

• Question 513:

  In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

  A. evidence must be handled in the same way regardless of the type of case
  B. evidence procedures are not important unless you work for a law enforcement agency
  C. evidence in a criminal case must be secured more tightly than in a civil case
  D. evidence in a civil case must be secured more tightly than in a criminal case
  C. evidence in a criminal case must be secured more tightly than in a civil case

• Question 514:

  Which of the following tool enables data acquisition and duplication?

  A. Colasoft's Capsa
  B. DriveSpy
  C. Wireshark
  D. Xplico
  B. DriveSpy

• Question 515:

  Which of the following commands shows you the username and IP address used to access the system via a remote login session and the type of client from which they are accessing the system?

  A. Net config
  B. Net sessions
  C. Net share
  D. Net stat
  B. Net sessions

• Question 516:

  You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printer out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

  A. Routing Table
  B. Firewall log
  C. Configuration files
  D. Email Header
  D. Email Header

• Question 517:

  What must an investigator do before disconnecting an iPod from any type of computer?

  A. Unmount the iPod
  B. Mount the iPod
  C. Disjoin the iPod
  D. Join the iPod
  A. Unmount the iPod

• Question 518:

  Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

  A. Mime-Version header
  B. Content-Type header
  C. Content-Transfer-Encoding header
  D. Errors-To header
  D. Errors-To header

• Question 519:

  Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?

  A. Sparse File
  B. Master File Table
  C. Meta Block Group
  D. Slack Space
  B. Master File Table

• Question 520:

  Lynne receives the following email:

  Dear [email protected]! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24 You have 24 hours to fix this problem or risk to be closed permanently!

  To proceed Please Connect >> My Apple ID

  Thank You The link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/

  What type of attack is this?

  A. Mail Bombing
  B. Phishing
  C. Email Spamming
  D. Email Spoofing
  B. Phishing