EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 21:

  What is the capacity of Recycle bin in a system running on Windows Vista?

  A. 2. 99GB
  B. 3. 99GB
  C. Unlimited
  D. 10% of the partition space
  C. Unlimited

• Question 22:

  What is the target host IP in the following command?

  A. 10.10.150.1
  B. This command is using FIN packets, which cannot scan target hosts
  C. Firewalk does not scan target hosts
  D. 172. 16. 28.95
  D. 172. 16. 28.95

• Question 23:

  A new corporation is setting up a Computer Forensics Lab (CFL) to handle potential cybercrimes. They want to establish a CFL that covers allnecessary considerations to ensure smooth and effective investigations. Which of the following sets of steps does NOT represent a proper way to set up a CFL?

  A. Determine the number of expected cases, hire certified professionals, purchase forensic and non-forensic workstations, design the lab foreasy access to emergency services, install a dedicated Integrated Services Digital Network (ISDN), maintain a log register, and ensure acomfortable lab ambience
  B. Evaluate crime statistics of the previous year, ensure the use of licensed software versions, arrange for storage lockers, maintain labcleanliness, ensure the lab has proper lighting systems, keep workstations under surveillance, and set up an intrusion alarm system
  C. Focus solely on internal corporate investigations, overstaff with inexperienced personnel, use demo versions of forensic software,underestimate lab size and budget, ignore physical security measures, and disregard licensing and accreditation processes
  D. Choose types of investigations, estimate the number of investigators, determine equipment and software requirements, calculate lab size,ensure access to essential services, establish workstation requirements, and enhance physical security
  C. Focus solely on internal corporate investigations, overstaff with inexperienced personnel, use demo versions of forensic software,underestimate lab size and budget, ignore physical security measures, and disregard licensing and accreditation processes

• Question 24:

  An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer.

  Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

  A. EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
  B. The EFS Revoked Key Agent can be used on the Computer to recover the information
  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
  D. When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.
  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.

• Question 25:

  Jane, who holds the title of Computer Hacking Forensic Investigator, is knee-deep in a case of a system security breach in a vast global corporation. The breach may have started its trouble-making journey in another country. Jane is focusing on preserving and investigating digital evidence.

  Keeping in mind the fragile and volatile nature of digital evidence, what is the first step Jane should take in the process of investigation?

  A. Contact local law enforcement in the country where the attack originated
  B. Gather system data before an intruder can alter it
  C. Begin documenting all the traces and records of the attack in the system
  D. Notify all jurisdictions involved about the breach
  B. Gather system data before an intruder can alter it

• Question 26:

  Printing under a Windows Computer normally requires which one of the following files types to be created?

  A. EME
  B. MEM
  C. EMF
  D. CME
  C. EMF

• Question 27:

  Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card.

  What can Jason do in this scenario to reset the PIN and access SIM data?

  A. He should contact the network operator for a Temporary Unlock Code (TUK)
  B. Use system and hardware tools to gain access
  C. He can attempt PIN guesses after 24 hours
  D. He should contact the network operator for Personal Unlock Number (PUK)
  D. He should contact the network operator for Personal Unlock Number (PUK)

• Question 28:

  Why should you never power on a computer that you need to acquire digital evidence from?

  A. When the computer boots up, files are written to the computer rendering the data nclean
  B. When the computer boots up, the system cache is cleared which could destroy evidence
  C. When the computer boots up, data in the memory buffer is cleared which could destroy evidence
  D. Powering on a computer has no affect when needing to acquire digital evidence from it
  A. When the computer boots up, files are written to the computer rendering the data nclean

• Question 29:

  In Java, when multiple applications are launched, multiple Dalvik Virtual Machine instances occur that consume memory and time. To avoid that, Android implements a process that enables low memory consumption and quick start-up time. What is the process called?

  A. Init
  B. Zygote
  C. Daemon
  D. Media server
  B. Zygote

• Question 30:

  Task list command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer.

  Which of the following task list commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

  A. tasklist/s
  B. tasklist/u
  C. tasklist/p
  D. tasklist/V
  D. tasklist/V