EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 411:

  Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?

  A. network-based IDS systems (NIDS)
  B. host-based IDS systems (HIDS)
  C. anomaly detection
  D. signature recognition
  B. host-based IDS systems (HIDS)
  C. anomaly detection

• Question 412:

  Software firewalls work at which layer of the OSI model?

  A. Transport
  B. Application
  C. Data Link
  D. Network
  C. Data Link

• Question 413:

  Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

  A. It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers
  B. Local archives do not have evidentiary value as the email client may alter the message data
  C. Local archives should be stored together with the server storage archives in order to be admissible in a court of law
  D. Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server
  A. It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers

• Question 414:

  When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code

  A. First 12
  B. First 16
  C. First 22
  D. First 24
  B. First 16

• Question 415:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST
  C. there is no reason to worry about this possible claim because state labs are certified
  D. sign a statement attesting that the evidence is the same as it was when it entered the lab
  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

• Question 416:

  When reviewing web logs, you see an entry for esource not found?in the HTTP status code field. What is the actual error code that you wouldWhen reviewing web logs, you see an entry for ?esource not found?in the HTTP status code field. What is the actual error code that you would see in the log for esource not found?see in the log for ?esource not found?

  A. 202
  B. 404
  C. 606
  D. 999
  B. 404

• Question 417:

  When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

  A. Recycle Bin
  B. MSDOS.sys
  C. BIOS
  D. Case files
  A. Recycle Bin

• Question 418:

  During the course of a corporate investigation, you find that an employee is committing a federal crime. Can the employer file a criminal complain with the police?

  A. Yes, and all evidence can be turned over to the police
  B. Yes, but only if you turn the evidence over to a district judge
  C. No, because the investigation was conducted without following standard police procedures
  D. No, because the investigation was conducted without a warrant
  A. Yes, and all evidence can be turned over to the police

• Question 419:

  The newer Macintosh Operating System (MacOS X) is based on:

  A. Microsoft Windows
  B. OS/2
  C. BSD Unix
  D. Linux
  C. BSD Unix

• Question 420:

  At what layer of the OSI model do routers function on?

  A. 4
  B. 3
  C. 1
  D. 5
  B. 3