EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 871:

  Hash injection attack allows attackers to inject a compromised hash into a local session and use the hash to validate network resources.

  A. True
  B. False
  A. True

• Question 872:

  You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

  A. Make a bit-stream disk-to-disk file
  B. Make a bit-stream disk-to-image file
  C. Create a sparse data copy of a folder or file
  D. Create a compressed copy of the file with DoubleSpace
  C. Create a sparse data copy of a folder or file

• Question 873:

  A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

  

  What can the investigator infer from the screenshot seen below?

  A. A smurf attack has been attempted
  B. A denial of service has been attempted
  C. Network intrusion has occurred
  D. Buffer overflow attempt on the firewall.
  C. Network intrusion has occurred

• Question 874:

  > nmap -sn 192. 168.11.200-215

  The Nmap command above performs which of the following?

  A. A trace sweep
  B. A port scan
  C. A ping scan
  D. An operating system detect
  C. A ping scan

• Question 875:

  Why would a company issue a dongle with the software they sell?

  A. To provide source code protection
  B. To provide wireless functionality with the software
  C. To provide copyright protection
  D. To ensure that keyloggers cannot be used
  C. To provide copyright protection

• Question 876:

  Which of the following tools will allow a forensic investigator to acquire the memory dump of a suspect machine so that it may be investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?

  A. DB Browser SQLite
  B. Belkasoft Live RAM Capturer and AccessData FTK Imager
  C. Bulk Extractor
  D. Hex Editor
  B. Belkasoft Live RAM Capturer and AccessData FTK Imager

• Question 877:

  In an investigation of cybercrime involving advanced persistent threats (APTs), the forensic team faces challenges in managing and interpreting the digital evidence due to the global origin of the crime and the diverse nature of the digital devices involved. The investigator has to select the most effective method to overcome these challenges.

  What should be the preferred approach?

  A. Invest in powerful automated tools to handle the high complexity of digital evidence
  B. Opt for traditional investigation approaches that examine local physical devices
  C. Improve collaboration with international law enforcement agencies to bridge the gap in jurisdictional boundaries
  D. Speed up the investigation process by bypassing the need for warrants and authorizations
  C. Improve collaboration with international law enforcement agencies to bridge the gap in jurisdictional boundaries

• Question 878:

  Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

  A. Record the system state by taking photographs of physical system and the display
  B. Perform data acquisition without disturbing the state of the systems
  C. Open the systems, remove the hard disk and secure it
  D. Switch off the systems and carry them to the laboratory
  A. Record the system state by taking photographs of physical system and the display

• Question 879:

  As a forensic investigator, you are investigating a suspected cyberattack that led to the system crash of a Windows 10 computer. You obtained a memory dump file and intend to utilize Microsoft's DumpChk tool for a quick analysis. However, you are interested in isolating a particular process that you suspect is responsible for the crash, rather than inspecting the whole memory dump file.

  Based on the given details and your knowledge of Windows memory analysis, which of the following would be the most efficient approach?

  A. Directly analyze the entire memory dump file using DumpChk, then isolate the details of the suspected process
  B. Use ListDLLs.exe to list all DLLs loaded into the suspected process, then analyze these DLLs using DumpChk
  C. Run DumpChk with the -y SymbolPath parameter, specifying the path to the symbols of the suspected process
  D. Use the Process Dumper tool to dump the entire process space of the suspected process to a file, then analyze the dump file using DumpChk
  D. Use the Process Dumper tool to dump the entire process space of the suspected process to a file, then analyze the dump file using DumpChk

• Question 880:

  Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?

  A. Events history
  B. Previously typed commands
  C. History of the browser
  D. Passwords used across the system
  B. Previously typed commands