EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 91:

  The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data.

  A. True
  B. False
  B. False

• Question 92:

  Network forensics allows Investigators to inspect network traffic and logs to identify and locate the attack system Network forensics can reveal: (Select three answers)

  A. Source of security incidents' and network attacks
  B. Path of the attack
  C. Intrusion techniques used by attackers
  D. Hardware configuration of the attacker's system
  A. Source of security incidents' and network attacks
  B. Path of the attack
  C. Intrusion techniques used by attackers

• Question 93:

  An Expert witness gives an opinion if:

  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
  B. To define the issues of the case for determination by the finder of fact
  C. To stimulate discussion between the consulting expert and the expert witness
  D. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

• Question 94:

  You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

  A. 0:1000, 150
  B. 0:1709, 150
  C. 1:1709, 150
  D. 0:1709-1858
  B. 0:1709, 150

• Question 95:

  When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________

  A. Automate collection from image files
  B. Avoiding copying data from the boot partition
  C. Acquire data from the host-protected area on a disk
  D. Prevent contamination to the evidence drive
  D. Prevent contamination to the evidence drive

• Question 96:

  Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?

  A. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media
  B. Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence
  C. Connect the target media; Delete the system for acquisition; Secure the evidence; Copy the media
  D. Secure the evidence; Prepare the system for acquisition; Connect the target media; Copy the media
  B. Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence

• Question 97:

  Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?

  A. Sample banners are used to record the system activities when used by the unauthorized user
  B. In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring
  C. The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken
  D. At the time of seizing process, you need to shut down the computer immediately
  D. At the time of seizing process, you need to shut down the computer immediately

• Question 98:

  Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?

  A. Enticement
  B. Entrapment
  C. Intruding into ahoneypot is not illegal
  D. Intruding into a DMZ is not illegal
  B. Entrapment

• Question 99:

  Why is it Important to consider health and safety factors in the work carried out at all stages of the forensic process conducted by the forensic analysts?

  A. This is to protect the staff and preserve any fingerprints that may need to be recovered at a later date
  B. All forensic teams should wear protective latex gloves which makes them look professional and cool
  C. Local law enforcement agencies compel them to wear latest gloves
  D. It is a part of ANSI 346 forensics standard
  A. This is to protect the staff and preserve any fingerprints that may need to be recovered at a later date

• Question 100:

  Operating System logs are most beneficial for Identifying or Investigating suspicious activities involving a particular host. Which of the following Operating System logs contains information about operational actions performed by OS components?

  A. Event logs
  B. Audit logs
  C. Firewall logs
  D. IDS logs
  A. Event logs