EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 981:

  Under which Federal Statutes does FBI investigate for computer crimes involving e- mail scams and mail fraud?

  A. 18 U.S.C. 1029 Possession of Access Devices
  B. 18 U.S.C. 1030 Fraud and related activity in connection with computers
  C. 18 U.S.C. 1343 Fraud by wire, radio or television
  D. 18 U.S.C. 1361 Injury to Government Property
  E. 18 U.S.C. 1362 Government communication systems
  F. 18 U.S.C. 1831 Economic Espionage Act
  G. 18 U.S.C. 1832 Trade Secrets Act
  B. 18 U.S.C. 1030 Fraud and related activity in connection with computers

• Question 982:

  An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine. What would he do to achieve this?

  A. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 0
  B. Run the command fsutil behavior set disablelastaccess 0
  C. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1
  D. Run the command fsutil behavior set enablelastaccess 0
  C. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1

• Question 983:

  An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers. Which of the following statement is true for NTP Stratum Levels?

  A. Stratum-0 servers are used on the network; they are not directly connected to computers which then operate as stratum-1 servers
  B. Stratum-1 time server is linked over a network path to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions
  C. A stratum-2 server is directly linked (not over a network path) to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions
  D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on
  D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on

• Question 984:

  Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company's domain controller goes down. From which system would you begin your investigation?

  A. Domain Controller
  B. Firewall
  C. SIEM
  D. IDS
  C. SIEM

• Question 985:

  This is a statement, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted.

  Which among the following is suitable for the above statement?

  A. Rule 1001
  B. Testimony by the accused
  C. Hearsay rule
  D. Limited admissibility
  C. Hearsay rule

• Question 986:

  During the course of a corporate investigation, you find that an employee is committing a federal crime. Can the employer file a criminal complain with the police?

  A. Yes, and all evidence can be turned over to the police
  B. Yes, but only if you turn the evidence over to a district judge
  C. No, because the investigation was conducted without following standard police procedures
  D. No, because the investigation was conducted without a warrant
  A. Yes, and all evidence can be turned over to the police

• Question 987:

  Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

  A. Same-platform correlation
  B. Network-platform correlation
  C. Cross-platform correlation
  D. Multiple-platform correlation
  C. Cross-platform correlation

• Question 988:

  A cybersecurity investigator is working on a case involving a malicious executable suspected of being packed using a popular program packer. The investigator realizes that the packer used is password-protected. In such a scenario, what should be the investigator's first course of action to analyze the packed file?

  A. Mount compound files
  B. Perform static analysis on the packed file
  C. Decrypt the password to unpack the file
  D. Run the packed file in a controlled environment for dynamic analysis
  A. Mount compound files

• Question 989:

  What does the part of the log, "% SEC-6-IPACCESSLOGP", extracted from a Cisco router represent?

  A. The system was not able to process the packet because there was not enough room for all of the desired IP header options
  B. Immediate action required messages
  C. Some packet-matching logs were missed because the access list log messages were rate limited, or no access list log buffers were available
  D. A packet matching the log criteria for the given access list has been detected (TCP or UDP)
  D. A packet matching the log criteria for the given access list has been detected (TCP or UDP)

• Question 990:

  Which Event Correlation approach assumes and predicts what an attacker can do next after the attack by studying statistics and probability?

  A. Profile/Fingerprint-Based Approach
  B. Bayesian Correlation
  C. Time (Clock Time) or Role-Based Approach
  D. Automated Field Correlation
  B. Bayesian Correlation