EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 351:

  Ron. a computer forensics expert, Is Investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in on condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner. Which of the following key combinations he can use to recover the IMEI number?

  A. #*06*#
  B. *#06#
  C. #06r
  D. *1MEI#
  B. *#06#

• Question 352:

  P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails.

  A. Port 109
  B. Port 110
  C. Port 115
  D. Port 123
  B. Port 110

• Question 353:

  Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

  A. Fill the disk with zeros
  B. Low-level format
  C. Fill the disk with 4096 zeros
  D. Copy files from the master disk to the slave disk on the secondary IDE controller
  A. Fill the disk with zeros

• Question 354:

  Wi-Fi Protected Access (WPA) is a data encryption method for WLANs based on 802.11 standards. Temporal Key Integrity Protocol (TKIP) enhances WEP by adding a rekeying mechanism to provide fresh encryption and integrity keys. Temporal keys are changed for every____________.

  A. 5,000 packets
  B. 10.000 packets
  C. 15,000 packets
  D. 20.000 packets
  B. 10.000 packets

• Question 355:

  During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:

  A. Inculpatory evidence
  B. mandatory evidence
  C. exculpatory evidence
  D. Terrible evidence
  C. exculpatory evidence

• Question 356:

  One way to identify the presence of hidden partitions on a suspect hard drive is to:One way to identify the presence of hidden partitions on a suspect? hard drive is to:

  A. Add up the total size of all known partitions and compare it to the total size of the hard drive
  B. Examine the FAT and identify hidden partitions by noting an ?in the artition Type?fieldExamine the FAT and identify hidden partitions by noting an ??in the ?artition Type?field
  C. Examine the LILO and note an ?in the artition Type?fieldExamine the LILO and note an ??in the ?artition Type?field It is not possible to have hidden partitions on a hard drive
  A. Add up the total size of all known partitions and compare it to the total size of the hard drive

• Question 357:

  A computer forensic report is a report which provides detailed information on the complete forensics investigation process.

  A. True
  B. False
  A. True

• Question 358:

  To preserve digital evidence, an investigator should ____________

  A. Make two copies of each evidence item using a single imaging tool
  B. Make a single copy of each evidence item using an approved imaging tool
  C. Make two copies of each evidence item using different imaging tools
  D. Only store the original evidence item
  C. Make two copies of each evidence item using different imaging tools

• Question 359:

  Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob? testimony in this case?

  A. Justification
  B. Authentication
  C. Reiteration
  D. Certification
  B. Authentication

• Question 360:

  An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers. Which of the following statement is true for NTP Stratum Levels?

  A. Stratum-0 servers are used on the network; they are not directly connected to computers which then operate as stratum-1 servers
  B. Stratum-1 time server is linked over a network path to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions
  C. A stratum-2 server is directly linked (not over a network path) to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions
  D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on
  D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on