EC-COUNCIL Certified Ethical Hacker 312-49V9 Questions & Answers

• Question 31:

  You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

  A. Bit-stream copy

  B. Robust copy

  C. Full backup copy

  D. Incremental backup copy

  Correct Answer: A

• Question 32:

  An "idle" system is also referred to as what?

  A. PC not connected to the Internet

  B. PC not being used

  C. Zombie

  D. Bot

  Correct Answer: C

• Question 33:

  What will the following command produce on a website login page?

  SELECT email, passwd, login_id, full_name FROM members

  WHERE email = '[email protected]';

  DROP TABLE members; --'

  A. Retrieves the password for the first user in the members table

  B. This command will not produce anything since the syntax is incorrect

  C. Deletes the entire members table

  D. Inserts the Error! Reference source not found. email address into the members table

  Correct Answer: C

• Question 34:

  When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

  A. A Capital X

  B. A Blank Space

  C. The Underscore Symbol

  D. The lowercase Greek Letter Sigma (s)

  Correct Answer: D

• Question 35:

  A(n) _____________________ is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

  A. blackout attack

  B. automated attack

  C. distributed attack

  D. central processing attack

  Correct Answer: B

• Question 36:

  You are running through a series of tests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?

  A. The firewall failed-open

  B. The firewall failed-closed

  C. The firewall ACL has been purged

  D. The firewall failed-bypass

  Correct Answer: A

• Question 37:

  While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?

  A. Technical material related to forensics

  B. No particular field

  C. Judging the character of defendants/victims

  D. Legal issues

  Correct Answer: B

• Question 38:

  Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

  A. Sector

  B. Metadata

  C. MFT

  D. Slack Space

  Correct Answer: D

• Question 39:

  A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?

  A. Blu-Ray single-layer

  B. HD-DVD

  C. Blu-Ray dual-layer

  D. DVD-18

  Correct Answer: C

• Question 40:

  What is a good security method to prevent unauthorized users from "tailgating"?

  A. Pick-resistant locks

  B. Electronic key systems

  C. Man trap

  D. Electronic combination locks

  Correct Answer: C