EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 51:

  While looking through the IIS log file of a web server, you find the following entries:

  

  What is evident from this log file?

  A. Web bugs
  B. Cross site scripting
  C. Hidden fields
  D. SQL injection is possible
  D. SQL injection is possible

• Question 52:

  When marking evidence that has been collected with the "aaa/ddmmyy/nnnn/zz" format, what does the "nnnn" denote?

  A. The initials of the forensics analyst
  B. The sequence number for the parts of the same exhibit
  C. The year he evidence was taken
  D. The sequential number of the exhibits seized by the analyst
  D. The sequential number of the exhibits seized by the analyst

• Question 53:

  Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

  A. DevScan
  B. Devcon
  C. fsutil
  D. Reg.exe
  B. Devcon

• Question 54:

  What does the 56.58.152.114(445) denote in a Cisco router log?

  Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084) -> 56.58.152.114(445), 1 packet

  A. Source IP address
  B. None of the above
  C. Login IP address
  D. Destination IP address
  D. Destination IP address

• Question 55:

  After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

  A. Stateful firewalls do not work with packet filtering firewalls
  B. NAT does not work with stateful firewalls
  C. IPSEC does not work with packet filtering firewalls
  D. NAT does not work with IPSEC
  D. NAT does not work with IPSEC

• Question 56:

  Andie, a network administrator, suspects unusual network services running on a windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?

  A. net serv
  B. netmgr
  C. lusrmgr
  D. net start
  D. net start

• Question 57:

  Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

  A. The manufacturer of the system compromised
  B. The logic, formatting and elegance of the code used in the attack
  C. The nature of the attack
  D. The vulnerability exploited in the incident
  B. The logic, formatting and elegance of the code used in the attack

• Question 58:

  What is a good security method to prevent unauthorized users from "tailgating"?

  A. Man trap
  B. Electronic combination locks
  C. Pick-resistant locks
  D. Electronic key systems
  A. Man trap

• Question 59:

  During an investigation, Noel found the following SIM card from the suspect's mobile. What does the code 89 44 represent?

  

  A. Issuer Identifier Number and TAC
  B. Industry Identifier and Country code
  C. Individual Account Identification Number and Country Code
  D. TAC and Industry Identifier
  B. Industry Identifier and Country code

• Question 60:

  What is the target host IP in the following command?

  A. 172.16.28.95
  B. 10.10.150.1
  C. Firewalk does not scan target hosts
  D. This command is using FIN packets, which cannot scan target hosts
  A. 172.16.28.95