EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 461:

  When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

  A. Hard Drive Failure

  B. Scope Creep

  C. Unauthorized expenses

  D. Overzealous marketing

  Correct Answer: B

• Question 462:

  You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

  A. Demonstrate that no system can be protected againstDoS attacks

  B. List weak points on their network

  C. Show outdatedeQuipment so it can be replaced

  D. Use attack as a launching point to penetrate deeper into the network

  Correct Answer: B

• Question 463:

  If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

  A. 31402

  B. The zombie will not send a response

  C. 31401

  D. 31399

  Correct Answer: C

• Question 464:

  Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?

  A. Spycrack

  B. Spynet

  C. Netspionage

  D. Hackspionage

  Correct Answer: C

• Question 465:

  If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  A. The system files have been copied by a remote attacker

  B. The system administrator has created an incremental backup

  C. The system has been compromised using a t0rn rootkit

  D. Nothing in particular as these can be operational files

  Correct Answer: C

• Question 466:

  You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?

  A. Passwords of 14 characters or less are broken up into two 7-character hashes

  B. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network

  C. Networks using Active Directory never use SAM databases so the SAM database pulled was empty

  D. The passwords that were cracked are local accounts on the Domain Controller

  Correct Answer: A

• Question 467:

  When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

  A. Recycle Bin

  B. MSDOS.sys

  C. BIOS

  D. Case files

  Correct Answer: A

• Question 468:

  In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

  A. evidence must be handled in the same way regardless of the type of case

  B. evidence procedures are not important unless you work for a law enforcement agency

  C. evidence in a criminal case must be secured more tightly than in a civil case

  D. evidence in a civil case must be secured more tightly than in a criminal case

  Correct Answer: C

• Question 469:

  A. Snort

  B. Airsnort

  C. Ettercap

  D. RaidSniff

  Correct Answer: C

• Question 470:

  Why would you need to find out the gateway of a device when investigating a wireless attack?

  A. The gateway will be the IP of the proxy server used by the attacker to launch the attack

  B. The gateway will be the IP of the attacker computerThe gateway will be the IP of the attacker? computer

  C. The gateway will be the IP used to manage the RADIUS server

  D. The gateway will be the IP used to manage the access point

  Correct Answer: D