EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 811:

  What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

  A. Compressed file
  B. Data stream file
  C. Encrypted file
  D. Reserved file
  B. Data stream file

• Question 812:

  Which of the following techniques can be used to beat steganography?

  A. Encryption
  B. Steganalysis
  C. Decryption
  D. Cryptanalysis
  B. Steganalysis

• Question 813:

  Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?

  A. Accunetix
  B. Nikto
  C. Snort
  D. Kismet
  C. Snort

• Question 814:

  Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

  A. Mime-Version header
  B. Content-Type header
  C. Content-Transfer-Encoding header
  D. Errors-To header
  D. Errors-To header

• Question 815:

  Jim's company regularly performs backups of their critical servers. But the company cannot afford to send backup tapes to an off-site vendor for long-term storage and archiving. Instead, Jim's company keeps the backup tapes in a safe in the office. Jim's company is audited each year, and the results from this year's audit show a risk because backup tapes are not stored off-site.

  The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?

  A. Encrypt the backup tapes and use a courier to transport them.
  B. Encrypt the backup tapes and transport them in a lock box
  C. Degauss the backup tapes and transport them in a lock box.
  D. Hash the backup tapes and transport them in a lock box.
  B. Encrypt the backup tapes and transport them in a lock box

• Question 816:

  During a complex malware investigation, a forensic investigator found a binary executable suspected to contain malicious code. The investigator decides to perform static malware analysis to identify and analyze the threat. Which of the following actions should be performed next by the investigator to reveal essential information about the executable's functionalities and features?

  A. Performing a string search in the binary using ResourcesExtract tool
  B. Submitting the executable to VirusTotal for online scanning
  C. Disassembling the binary executable to study its structure and functionality
  D. Calculating the cryptographic hash of the binary file for file fingerprinting
  C. Disassembling the binary executable to study its structure and functionality

• Question 817:

  Madison is on trial for allegedly breaking into her university's internal network. The police raided her dorm room and seized all of her computer equipment. Madison's lawyer is trying to convince the judge that the seizure was unfounded and baseless.

  Under which US Amendment is Madison's lawyer trying to prove the police violated?

  A. The 4th Amendment
  B. The 1st Amendment
  C. The 10th Amendment
  D. The 5th Amendment
  A. The 4th Amendment

• Question 818:

  Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file. Which of the following hash algorithms produces a message digest that is 128 bits long?

  A. CRC-32
  B. MD5
  C. SHA-1
  D. SHA-512
  B. MD5

• Question 819:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab.

  What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST
  C. there is no reason to worry about this possible claim because state labs are certified
  D. sign a statement attesting that the evidence is the same as it was when it entered the lab
  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

• Question 820:

  As a forensic investigator, you are asked to identify whether the Dropbox application was installed on a suspect's computer running Windows 10. The request is made by an attorney. You are considering different tools and approaches for your investigation.

  What would be the most appropriate next step in the forensic investigation process?

  A. Rely on your past experience and intuition to confirm or disprove the installation of Dropbox without formulating any hypothesis
  B. Immediately start examining the suspect's computer with any readily available digital forensic tool
  C. Use the most expensive commercial tool to guarantee a thorough investigation and reliable findings
  D. Formulate a hypothesis and design an experiment to test the hypothesis on a similar system before examining the suspect's machine
  D. Formulate a hypothesis and design an experiment to test the hypothesis on a similar system before examining the suspect's machine