EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 11:

  You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

  A. 0:1000, 150
  B. 0:1709, 150
  C. 1:1709, 150
  D. 0:1709-1858
  B. 0:1709, 150

• Question 12:

  Which of the following tasks DOES NOT come under the investigation phase of a cybercrime forensics investigation case?

  A. Data collection
  B. Secure the evidence
  C. First response
  D. Data analysis
  C. First response

• Question 13:

  What is the framework used for application development for iOS-based mobile devices?

  A. Cocoa Touch
  B. Dalvik
  C. Zygote
  D. AirPlay
  A. Cocoa Touch

• Question 14:

  Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?

  A. pstree
  B. pgrep
  C. ps
  D. grep
  B. pgrep

• Question 15:

  An investigator is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

  A. Dynamic analysis
  B. Threat hunting
  C. Threat analysis
  D. Static analysis
  D. Static analysis

• Question 16:

  Which among the following files provides email header information in the Microsoft Exchange server?

  A. gwcheck.db
  B. PRIV.EDB
  C. PUB.EDB
  D. PRIV.STM
  B. PRIV.EDB

• Question 17:

  Which command line tool is used to determine active network connections?

  A. netsh
  B. nbstat
  C. nslookup
  D. netstat
  D. netstat

• Question 18:

  As a Computer Hacking Forensics Investigator, you have been tasked with examining a suspicious.E01 disk image file using The Sleuth Kit (TSK). You need to display the metadata structure of an inode but also want to show the addresses of its disk units.

  Which TSK command would best serve this purpose?

  A. istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
  B. img_stat [-i imgtype] [-b dev_sector_size] [-tvV] image [images]
  C. fsstat [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-tvV] image [images]
  D. fls [-adDFIpruvV] [-m mnt ] [-z zone ] [-f fstype ] [-s seconds ] [-i imgtype ] [-o imgoffset ] [-b dev_sector_size] image [images] [ inode]
  A. istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode

• Question 19:

  Which U.S. Federal law requires financial institutions that offer consumers financial products or services to protect their customers' private information?

  A. Payment Card Industry Data Security Standard (PCI DSS)
  B. Federal Information Security Management Act of 2002 (FISMA)
  C. Health insurance Portability and Accountability Act of 1996 (HIPAA)
  D. Gramm-Leach-Bliley Act (GLBA)
  A. Payment Card Industry Data Security Standard (PCI DSS)

• Question 20:

  Dumpster Diving refers to:

  A. Searching for sensitive information in the user's trash bins and printer trash bins, and searching the user's desk for sticky notes
  B. Looking at either the user's keyboard or screen while he/she is logging in
  C. Convincing people to reveal the confidential information
  D. Creating a set of dictionary words and names, and trying all the possible combinations to crack the password
  A. Searching for sensitive information in the user's trash bins and printer trash bins, and searching the user's desk for sticky notes