EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 131:

  The offset in a hexadecimal code is:

  A. The 0x at the beginning of the code
  B. The 0x at the end of the code
  C. The first byte after the colon
  D. The last byte after the colon
  A. The 0x at the beginning of the code

• Question 132:

  What document does the screenshot represent?

  

  A. Chain of custody form
  B. Search warrant form
  C. Evidence collection form
  D. Expert witness form
  A. Chain of custody form

• Question 133:

  The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

  A. Locard Exchange Principle
  B. Clark Standard
  C. Kelly Policy
  D. Silver-Platter Doctrine
  D. Silver-Platter Doctrine

• Question 134:

  The police believe that Mevin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers, and educational institutions. They also suspect that he has been stealing, copying, and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspect door and searching his home and seizing all of his computer equipment if they haveis preventing the police from breaking down the suspect? door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

  A. The USA Patriot Act
  B. The Good Samaritan Laws
  C. The Federal Rules of Evidence
  D. The Fourth Amendment
  D. The Fourth Amendment

• Question 135:

  A rogue/unauthorized access point is one that Is not authorized for operation by a particular firm or network

  A. True
  B. False
  A. True

• Question 136:

  What operating system would respond to the following command? C:\> nmap -sW 10.10.145.65

  A. Windows XP
  B. Mac OS X
  C. FreeBSD
  D. Windows 95
  C. FreeBSD

• Question 137:

  E-mail logs contain which of the following information to help you in your investigation? (Select up to 4)

  A. user account that was used to send the account
  B. attachments sent with the e-mail message
  C. unique message identifier
  D. contents of the e-mail message
  E. date and time the message was sent
  A. user account that was used to send the account
  C. unique message identifier
  D. contents of the e-mail message
  E. date and time the message was sent

• Question 138:

  Windows Security Event Log contains records of login/logout activity or other security- related events specified by the system's audit policy. What does event ID 531 in Windows Security Event Log indicates?

  A. A user successfully logged on to a computer
  B. The logon attempt was made with an unknown user name or a known user name with a bad password
  C. An attempt was made to log on with the user account outside of the allowed time
  D. A logon attempt was made using a disabled account
  D. A logon attempt was made using a disabled account

• Question 139:

  When collecting electronic evidence at the crime scene, the collection should proceed from the most volatile to the least volatile

  A. True
  B. False
  A. True

• Question 140:

  You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

  A. The attorney-work-product rule
  B. Good manners
  C. Trade secrets
  D. ISO 17799
  A. The attorney-work-product rule