EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 61:

  Consider that you are investigating a machine running an Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:\Recycler \\.

  You read an entry named "Dd5. exe". What does Dd5. exe mean?

  A. D drive. fifth file deleted, a .exe file
  B. D drive, fourth file restored, a .exe file
  C. D drive, fourth file deleted, a .exe file
  D. D drive, sixth file deleted, a .exe file
  A. D drive. fifth file deleted, a .exe file

• Question 62:

  An image is an artifact that reproduces the likeness of some subject. These are produced by optical devices (i.e. cameras, mirrors, lenses, telescopes, and microscopes). Which property of the image shows you the number of colors available for each pixel in an image?

  A. Pixel
  B. Bit Depth
  C. File Formats
  D. Image File Size
  B. Bit Depth

• Question 63:

  A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?

  A. The boot loader will attempt to load the mkext cache file containing a set of device drivers
  B. The system will initialize the I/O kit and link the loaded drivers to the kernel
  C. The boot loader will pass control to BootX (PowerPC) or boot.efi (Intel)
  D. The boot loader will search for drivers in the/System/Library/Extensions directory
  A. The boot loader will attempt to load the mkext cache file containing a set of device drivers

• Question 64:

  As a Computer Hacking Forensics Investigator, you are analyzing a TCP dump of network traffic during a suspected breach. During the investigation, you noticed that the "Packets dropped by kernel" count was unusually high. Given that the network has a high load, what could bethe most probable reason for this situation?

  A. The Tcpdump tool was run without the -c flag, causing it to capture packets indefinitely
  B. The TCP packets were not matching the input expression of Tcpdump
  C. The Boolean expression used with Tcpdump was too restrictive, missing some packets
  D. The buffer space in the OS running Tcpdump was insufficient, leading to dropped packets
  D. The buffer space in the OS running Tcpdump was insufficient, leading to dropped packets

• Question 65:

  Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups?

  A. Inode bitmap block
  B. Superblock
  C. Block bitmap block
  D. Data block
  B. Superblock

• Question 66:

  During the seizure of digital evidence, the suspect can be allowed touch the computer system.

  A. True
  B. False
  B. False

• Question 67:

  Lynne receives the following email:

  Dear [email protected]

  We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved on 2016/11/10 20:40:24.

  You have 24 hours to fix this problem or risk being closed permanently!

  To proceed, please connect >> My Apple ID

  Thank you.

  The link to My Apple ID shows:

  http://byggarbetsplatsen.se/backup/signon/

  What type of attack is this?

  A. Mail Bombing
  B. Phishing
  C. Email Spamming
  D. Email Spoofing
  B. Phishing

• Question 68:

  When you carve an image, recovering the image depends on which of the following skills?

  A. Recognizing the pattern of the header content
  B. Recovering the image from a tape backup
  C. Recognizing the pattern of a corrupt file
  D. Recovering the image from the tape backup
  A. Recognizing the pattern of the header content

• Question 69:

  What is a bit-stream copy?

  A. Bit-Stream Copy is a bit-by-bit copy of the original storage medium and exact copy of the original disk
  B. A bit-stream image is the file that contains the NTFS files and folders of all the data on a disk or partition
  C. A bit-stream image is the file that contains the FAT32 files and folders of all the data on a disk or partition
  D. Creating a bit-stream image transfers only non-deleted files from the original disk to the image disk
  A. Bit-Stream Copy is a bit-by-bit copy of the original storage medium and exact copy of the original disk

• Question 70:

  A cybersecurity forensic investigator analyzes log les to investigate an SQL Injection attack. While going through the Apache across.log, they come across a GET request from the IP 10.0.0.19 containing an encoded query string:

  GET /sqli/examplel.php?name=root' UniON SeLeCT 1,table_name,3,4,5 From information_schema.tables where Table_Schema=DatabasE() limit 1,2--What is the intention behind the attacker's query?

  A cybersecurity forensic investigator analyzes log files to investigate an SQL Injection attack. While going through the Apache across.log, they come across a GET request from the IP 10.0.0.19 containing an encoded query string:

  GET /sqli/examplel.php?name=root' UniON SeLeCT 1,table_name,3,4,5 From information_schema.tables where Table_Schema=DatabasE() limit 1,2--What is the intention behind the attacker's query?

  A. To erase the data in the specific tables of the database
  B. To retrieve the names of the tables in the database
  C. To bypass the website's authentication mechanism and view all user details
  D. To manipulate the order of the columns in the database
  B. To retrieve the names of the tables in the database