EC-COUNCIL Certified Ethical Hacker 312-49V9 Questions & Answers

• Question 1:

  Which of the following is NOT a graphics file?

  A. Picture1.tga

  B. Picture2.bmp

  C. Picture3.nfo

  D. Picture4.psd

  Correct Answer: C

• Question 2:

  If you discover a criminal act while investigating a corporate policy abuse, it becomes a public-sector investigation and should be referred to law enforcement?

  A. True

  B. False

  Correct Answer: A

• Question 3:

  You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company? IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?

  A. Network

  B. Transport

  C. Data Link

  D. Session

  Correct Answer: A

• Question 4:

  You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

  A. The X509 Address

  B. The SMTP reply Address

  C. The E-mail Header

  D. The Host Domain Name

  Correct Answer: C

• Question 5:

  You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are reQuired MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?

  A. Trade secret

  B. Social engineering exploit

  C. Competitive exploit

  D. Information vulnerability

  Correct Answer: D

• Question 6:

  Which program is the oot loader?when Windows XP starts up?Which program is the ?oot loader?when Windows XP starts up?

  A. KERNEL.EXE

  B. NTLDR

  C. LOADER

  D. LILO

  Correct Answer: B

• Question 7:

  Microsoft Outlook maintains email messages in a proprietary format in what type of file?

  A. .email

  B. .mail

  C. .pst

  D. .doc

  Correct Answer: C

• Question 8:

  John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?

  A. Firewalk sets all packets with a TTL of one

  B. Firewalk sets all packets with a TTL of zero

  C. Firewalk cannot pass through Cisco firewalls

  D. Firewalk cannot be detected by network sniffers

  Correct Answer: A

• Question 9:

  An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

  A. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information

  B. The EFS Revoked Key Agent can be used on the computer to recover the information

  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information

  D. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information

  Correct Answer: C

• Question 10:

  You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?

  A. Copyright law

  B. Brandmark law

  C. Trademark law

  D. Printright law

  Correct Answer: C