EC-COUNCIL 312-49 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49 Online Questions & Answers

• Question 71:

  To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

  A. Post-investigation Phase
  B. Reporting Phase
  C. Pre-investigation Phase
  D. Investigation Phase
  C. Pre-investigation Phase

• Question 72:

  You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments.

  What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

  A. Bit-stream Copy
  B. Robust Copy
  C. Full backup Copy
  D. Incremental Backup Copy
  A. Bit-stream Copy

• Question 73:

  What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

  A. Every byte of the file(s) is given an MD5 hash to match against a master file
  B. Every byte of the file(s) is verified using 32-bit CRC
  C. Every byte of the file(s) is copied to three different hard drives
  D. Every byte of the file(s) is encrypted using three different methods
  B. Every byte of the file(s) is verified using 32-bit CRC

• Question 74:

  Which of the following does not describe the type of data density on a hard disk?

  A. Volume density
  B. Track density
  C. Linear or recording density
  D. Areal density
  A. Volume density

• Question 75:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST
  C. there is no reason to worry about this possible claim because state labs are certified
  D. sign a statement attesting that the evidence is the same as it was when it entered the lab
  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

• Question 76:

  What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

  A. Fraggle
  B. Smurf scan
  C. SYN flood
  D. Teardrop
  A. Fraggle

• Question 77:

  In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

  A. The change in the routing fabric to bypass the affected router
  B. More RESET packets to the affected router to get it to power back up
  C. RESTART packets to the affected router to get it to power back up
  D. STOP packets to all other routers warning of where the attack originated
  A. The change in the routing fabric to bypass the affected router

• Question 78:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

  A. The year the evidence was taken
  B. The sequence number for the parts of the same exhibit
  C. The initials of the forensics analyst
  D. The sequential number of the exhibits seized
  D. The sequential number of the exhibits seized

• Question 79:

  An executive has leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?

  A. Postmortem Analysis
  B. Real-Time Analysis
  C. Packet Analysis
  D. Malware Analysis
  A. Postmortem Analysis

• Question 80:

  Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

  A. HKEY_LOCAL_MACHINE\hardware\windows\start
  B. HKEY_LOCAL_USERS\Software\Microsoft\old\Version\Load
  C. HKEY_CURRENT_USER\Microsoft\Default
  D. HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run
  D. HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run