EC-COUNCIL 412-79 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79 Online Questions & Answers

• Question 111:

  Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

  A. %systemroot%\system32\drivers\etc
  B. %systemroot%\repair
  C. %systemroot%\LSA
  D. %systemroot%\system32\LSA
  B. %systemroot%\repair

• Question 112:

  Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

  A. HKEY_LOCAL_MACHINEhardwarewindowsstart
  B. HKEY_LOCAL_USERSSoftware|MicrosoftoldVersionLoad
  C. HKEY_CURRENT_USERMicrosoftDefault
  D. HKEY_LOCAL_MACHINESoftwareMicrosoftCurrentVersionRun
  D. HKEY_LOCAL_MACHINESoftwareMicrosoftCurrentVersionRun

• Question 113:

  Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform?

  A. Smurf scan
  B. Tracert
  C. Ping trace
  D. ICMP ping sweep
  D. ICMP ping sweep

• Question 114:

  You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have founD. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subjects computer. You inform the officer that you will not be able to comply with that request because doing so would:

  A. Violate your contract
  B. Cause network congestion
  C. Make you an agent of law enforcement
  D. Write information to the subjects hard drive
  C. Make you an agent of law enforcement

• Question 115:

  To preserve digital evidence, an investigator should ____________________

  A. Make tow copies of each evidence item using a single imaging tool
  B. Make a single copy of each evidence item using an approved imaging tool
  C. Make two copies of each evidence item using different imaging tools
  D. Only store the original evidence item
  C. Make two copies of each evidence item using different imaging tools

• Question 116:

  When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expecteD.

  A. Hard Drive Failure
  B. Scope Creep
  C. Unauthorized expenses
  D. Overzealous marketing
  B. Scope Creep

• Question 117:

  A state department site was recently attacked and all the servers had their disks eraseD. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have

  the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally eraseD. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects

  including three summer interns.

  Where did the incident team go wrong?

  A. They examined the actual evidence on an unrelated system
  B. They attempted to implicate personnel without proof
  C. They tampered with evidence by using it
  D. They called in the FBI without correlating with the fingerprint data
  C. They tampered with evidence by using it

• Question 118:

  On Linux/Unix based Web servers, what privilege should the daemon service be run under?

  A. Guest
  B. You cannot determine what privilege runs the daemon service
  C. Root
  D. Something other than root
  D. Something other than root

• Question 119:

  To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software ?

  A. Computer Forensics Tools and Validation Committee (CFTVC)
  B. Association of Computer Forensics Software Manufactures (ACFSM)
  C. National Institute of Standards and Technology (NIST)
  D. Society for Valid Forensics Tools and Testing (SVFTT)
  C. National Institute of Standards and Technology (NIST)

• Question 120:

  You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that

  includes the IP address of one of the routers:

  http://172.168.4.131/level/99/exec/show/config

  After typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

  A. URL Obfuscation Arbitrary Administrative Access Vulnerability
  B. Cisco IOS Arbitrary Administrative Access Online Vulnerability
  C. HTTP Configuration Arbitrary Administrative Access Vulnerability
  D. HTML Configuration Arbitrary Administrative Access Vulnerability
  C. HTTP Configuration Arbitrary Administrative Access Vulnerability