EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 1001:

  You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at the sessions the machine has opened with other systems?

  A. Net sessions
  B. Net config
  C. Net share
  D. Net use
  D. Net use

• Question 1002:

  You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?

  A. allinurl:"exchange/logon.asp"
  B. intitle:"exchange server"
  C. outlook:"search"
  D. locate:"logon page"
  A. allinurl:"exchange/logon.asp"

• Question 1003:

  An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

  A. Smurf
  B. Ping of death
  C. Fraggle
  D. Nmap scan
  B. Ping of death

• Question 1004:

  A cybersecurity investigator is conducting a search and seizure operation involving a large data breach. She needs a witness's signature for theagreement to proceed. She is considering one of her team members as a witness but is unsure whether this would comply with standardprocedures.

  According to best practices in obtaining witness signatures during such operations, what actions should she take?

  A. She should not involve any of her team members as a witness to avoid potential bias in court
  B. If one witness is needed, she may consider her team member, given that they understand the relevance and can testify voluntarily
  C. She should choose anyone present during the seizure as a witness regardless of their understanding of the case
  D. She should choose a member from her team as a witness as it saves time and resources
  B. If one witness is needed, she may consider her team member, given that they understand the relevance and can testify voluntarily

• Question 1005:

  Windows identifies which application to open a file with by examining which of the following?

  A. The File extension
  B. The file attributes
  C. The file Signature at the end of the file
  D. The file signature at the beginning of the file
  A. The File extension

• Question 1006:

  In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

  A. config.db
  B. install.db
  C. sigstore.db
  D. filecache.db
  A. config.db

• Question 1007:

  Jacob, a cybercrime investigator, joined a forensics team to participate in a criminal case involving digital evidence. After the investigator collected all the evidence and presents it to the court, the judge dropped the case and the defense attorney pressed charges against Jacob and the rest of the forensics team for unlawful search and seizure.

  What forensics privacy issue was not addressed prior to collecting the evidence?

  A. Compliance with the Second Amendment of the U.S. Constitution
  B. Compliance with the Third Amendment of the U.S. Constitution
  C. Compliance with the Fourth Amendment of the U.S. Constitution
  D. None of these
  C. Compliance with the Fourth Amendment of the U.S. Constitution

• Question 1008:

  Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

  A. Speculation or opinion as to the cause of the incident
  B. Purpose of the report
  C. Author of the report
  D. Incident summary
  A. Speculation or opinion as to the cause of the incident

• Question 1009:

  Consider the scenario where a large multinational corporation suspects an internal security breach, with significant data possibly compromised.The corporate forensic team initiates the process of conducting a comprehensive forensic investigation following the search and seizureprotocols. During this process, they want to ensure they capture all the required information and minimize disruption to the company's ongoingbusiness operations.

  Which among the following activities should NOT be a part of their plan for this search and seizure operation?

  A. Generating a comprehensive list of all potentially involved devices along with their specifications, status, and locations
  B. Obtaining formal written consent from the company's owner before beginning the investigation process
  C. Requesting a warrant for search and seizure detailing the exact locations and types of evidence expected to be found
  D. Carrying out all search and seizure activities without seeking witness signatures for the activities performed
  D. Carrying out all search and seizure activities without seeking witness signatures for the activities performed

• Question 1010:

  The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

  A. 127. 0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200 2326
  B. [Wed Oct 11 14:32:52 2000] [error] [client 127. 0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test
  C. http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./../winnt/system32/cmd.exe?/c+di r+c:\wintt \system32\Logfiles\W3SVC1
  D. 127. 0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200 2326
  B. [Wed Oct 11 14:32:52 2000] [error] [client 127. 0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test