EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 301:

  How often must a company keep log files for them to be admissible in a court of law?

  A. All log files are admissible in court no matter their frequency
  B. Weekly
  C. Monthly
  D. Continuously
  D. Continuously

• Question 302:

  Jones had been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones. What is a virtual environment?

  A. A system using Trojaned commands
  B. A honeypot that traps hackers
  C. An environment set up after the user logs in
  D. An environment set up before an user logs in
  B. A honeypot that traps hackers

• Question 303:

  This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

  A. Master Boot Record (MBR)
  B. Master File Table (MFT)
  C. File Allocation Table (FAT)
  D. Disk Operating System (DOS)
  C. File Allocation Table (FAT)

• Question 304:

  What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

  A. Cracks every password in 10 minutes
  B. Distribute processing over 16 or fewer computers
  C. Support for Encrypted File System
  D. Support for MD5 hash verification
  B. Distribute processing over 16 or fewer computers

• Question 305:

  An attack vector is a path or means by which an attacker can gain access to computer or network resources in order to deliver an attack payload or cause a malicious outcome.

  A. True
  B. False
  A. True

• Question 306:

  Digital photography helps in correcting the perspective of the Image which Is used In taking the measurements of the evidence. Snapshots of the evidence and incident-prone areas need to be taken to help in the forensic process. Is digital photography accepted as evidence in the court of law?

  A. Yes
  B. No
  A. Yes

• Question 307:

  If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

  A. deltree command
  B. CMOS
  C. Boot.sys
  D. Scandisk utility
  E. boot.ini
  E. boot.ini

• Question 308:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire
  B. Run the powerful magnets over the hard disk
  C. Format the hard disk multiple times using a low level disk utility
  D. Overwrite the contents of the hard disk with Junk data
  A. Throw the hard disk into the fire
  C. Format the hard disk multiple times using a low level disk utility

• Question 309:

  Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  A. Use Vmware to be able to capture the data in memory and examine it
  B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
  C. Create a Separate partition of several hundred megabytes and place the swap file there
  D. Use intrusion forensic techniques to study memory resident infections
  A. Use Vmware to be able to capture the data in memory and examine it
  C. Create a Separate partition of several hundred megabytes and place the swap file there

• Question 310:

  Tracks numbering on a hard disk begins at 0 from the outer edge and moves towards the center, typically reaching a value of ___________.

  A. 1023
  B. 1020
  C. 1024
  D. 2023
  A. 1023