EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 381:

  Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?

  A. Unvalidated input
  B. Parameter/form tampering
  C. Directory traversal
  D. Security misconfiguration
  C. Directory traversal

• Question 382:

  Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges.

  Which of the following vulnerability/exploitation is referred above?

  A. Session ID in URLs
  B. Timeout Exploitation
  C. I/O exploitation
  D. Password Exploitation
  B. Timeout Exploitation

• Question 383:

  Depending upon the Jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?

  A. 18 USC 7029
  B. 18 USC 7030
  C. 18 USC 7361
  D. 18 USC 7371
  B. 18 USC 7030

• Question 384:

  In a digital forensics investigation involving a data breach at a large corporation, the lead investigator is preparing to obtain a search warrant for seizing potential evidence. She needs to decide which type of warrant is appropriate, given that the main suspect's activities appear to have involved significant online communication and data transfer.

  Which of the following actions should she take?

  A. Obtain a service provider search warrant to access the suspect's online communication records
  B. Obtain a search warrant for the suspect's company property only, as this is where the crime occurred
  C. Obtain an electronic storage device search warrant to seize the suspect's personal computer
  D. Obtain a search warrant for the suspect's car, as it's possible that physical evidence may be found there
  A. Obtain a service provider search warrant to access the suspect's online communication records

• Question 385:

  When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

  A. Undo the last action performed on the system
  B. Reboot Windows
  C. Use a recovery tool to undelete the file
  D. Download the file from Microsoft website
  A. Undo the last action performed on the system

• Question 386:

  Windows Security Event Log contains records of login/logout activity or other security- related events specified by the system's audit policy. What does event ID 531 in Windows Security Event Log indicates?

  A. A user successfully logged on to a computer
  B. The logon attempt was made with an unknown user name or a known user name with a bad password
  C. An attempt was made to log on with the user account outside of the allowed time
  D. A logon attempt was made using a disabled account
  D. A logon attempt was made using a disabled account

• Question 387:

  Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG.

  What is Simon trying to accomplish here?

  A. Send DOS commands to crash the DNS servers
  B. Perform DNS poisoning
  C. Enumerate all the users in the domain
  D. Perform a zone transfer
  D. Perform a zone transfer

• Question 388:

  You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation.

  At what layer of the OSI model are you monitoring while watching traffic to and from the router?

  A. Network
  B. Transport
  C. Data Link
  D. Session
  A. Network

• Question 389:

  Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

  A. wmic service
  B. Reg.exe
  C. fsutil
  D. Devcon
  C. fsutil

• Question 390:

  This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

  A. Master Boot Record (MBR)
  B. Master File Table (MFT)
  C. File Allocation Table (FAT)
  D. Disk Operating System (DOS)
  C. File Allocation Table (FAT)