EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 481:

  George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time- based induction machine" be used. What IDS feature must George implement to meet this requirement?

  A. Pattern matching

  B. Statistical-based anomaly detection

  C. Real-time anomaly detection

  D. Signature-based anomaly detection

  Correct Answer: C

• Question 482:

  In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

  A. The change in the routing fabric to bypass the affected router

  B. More RESET packets to the affected router to get it to power back up

  C. STOP packets to all other routers warning of where the attack originated

  D. RESTART packets to the affected router to get it to power back up

  Correct Answer: A

• Question 483:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST

  C. there is no reason to worry about this possible claim because state labs are certified

  D. sign a statement attesting that the evidence is the same as it was when it entered the lab

  Correct Answer: A

• Question 484:

  When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________

  A. Automate collection from image files

  B. Avoiding copying data from the boot partition

  C. Acquire data from the host-protected area on a disk

  D. Prevent contamination to the evidence drive

  Correct Answer: D

• Question 485:

  At what layer of the OSI model do routers function on?

  A. 4

  B. 3

  C. 1

  D. 5

  Correct Answer: B

• Question 486:

  This organization maintains a database of hash signatures for known software

  A. International Standards Organization

  B. Institute of Electrical and Electronics Engineers

  C. National Software Reference Library

  D. American National standards Institute

  Correct Answer: C

• Question 487:

  During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:

  A. Inculpatory evidence

  B. mandatory evidence

  C. exculpatory evidence

  D. Terrible evidence

  Correct Answer: C

• Question 488:

  You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

  A. Packet filtering firewall

  B. Application-level proxy firewall

  C. Statefull firewall

  D. Circuit-level proxy firewall

  Correct Answer: C

• Question 489:

  Where are files temporarily written in Unix when printing?

  A. /usr/spool

  B. /var/print

  C. /spool

  D. /var/spool

  Correct Answer: D

• Question 490:

  After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?

  A. RestrictAnonymous must be set to "2" for complete security

  B. There is no way to always prevent an anonymous null session from establishing

  C. RestrictAnonymous must be set to "10" for complete security

  D. RestrictAnonymous must be set to "3" for complete security

  Correct Answer: A