EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 301:

  Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software?

  A. Operating System (OS) logs
  B. Application logs
  C. Security software logs
  D. Audit logs
  C. Security software logs

• Question 302:

  What TCP/UDP port does the toolkit program netstat use?

  A. Port 7
  B. Port 15
  C. Port 23
  D. Port 69
  B. Port 15

• Question 303:

  Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion.

  A. True
  B. False
  A. True

• Question 304:

  After an unexpected shutdown of a company's database server, the IT forensics team is tasked with collecting data from the Database Plan Cacheto investigate potential issues. What query should they use to retrieve the SQL text of all cached entries and acquire additional aggregate performance statistics?

  A. Use: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_plan_attributes(plan_handle) followed by: select * from sys.dm_exec_query_stats
  B. Use: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_sql_text(plan_handle) followed by: select * from sys.dm_exec_plan_attributes(plan_handle)
  C. Use: select * from sys.dm_exec_sql_text(plan_handle) cross apply sys.dm_exec_cached_plans followed by: select * from sys.dm_exec_query_stats
  D. Use: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_sql_text(plan_handle) followed by: select * from sys.dm_exec_query_stats
  D. Use: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_sql_text(plan_handle) followed by: select * from sys.dm_exec_query_stats

• Question 305:

  A top-tier forensic investigation bureau within the United States is handling a major case related to espionage. They have started electronic monitoring of a permanent lawful inhabitant of the nation suspected of participating in the case. Yet, there seems to be no compelling evidencesuggesting the individual's criminal involvement.

  How does this measure correspond with existing laws?

  A. This measure corresponds with the Protect America Act of 2007 which permits the surveillance of individuals who are thought to be residing outside the United States
  B. This measure breaches the Privacy Act of 1974, involving the unauthorized revelation of private data
  C. This measure corresponds with the Foreign Intelligence Surveillance Act of 1978, permitting the surveillance of US individuals suspected of participating in espionage
  D. This measure breaches the Foreign Intelligence Surveillance Act of 1978 as no compelling evidence suggests criminal involvement
  C. This measure corresponds with the Foreign Intelligence Surveillance Act of 1978, permitting the surveillance of US individuals suspected of participating in espionage

• Question 306:

  Which of the following filesystem is used by Mac OS X?

  A. EFS
  B. HFS+
  C. EXT2
  D. NFS
  B. HFS+

• Question 307:

  You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3. 4 Accounting software are required MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed.

  What is this information posted on the job website considered?

  A. Trade secret
  B. Social engineering exploit
  C. Competitive exploit
  D. Information vulnerability
  D. Information vulnerability

• Question 308:

  Which of the following malware analysis involves executing the malware code to know how the code interacts with the host system and its impact on the system?

  A. Primary Malware Analysis
  B. Static Malware Analysis
  C. Dynamic Malware Analysis
  D. Secondary Malware Analysis
  C. Dynamic Malware Analysis

• Question 309:

  Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?

  A. CacheInf
  B. FATKit
  C. Belkasoft Live RAM Capturer
  D. Coreography
  C. Belkasoft Live RAM Capturer

• Question 310:

  The working of the Tor browser is based on which of the following concepts?

  A. Onion routing
  B. Static routing
  C. Both static and default routing
  D. Default routing
  A. Onion routing