EC-COUNCIL 412-79 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79 Online Questions & Answers

• Question 171:

  After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a lage organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts responds to your ICMP pings; definitely not the number of hosts you were expecting. Why did this ping sweep only produce a few responses?

  A. A switched network will not respond to packets sent to the broadcast address
  B. Only IBM AS/400 will reply to this scan
  C. Only Unix and Unix-like systems will reply to this scan
  D. Only Windows systems will reply to this scan
  C. Only Unix and Unix-like systems will reply to this scan

• Question 172:

  ____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

  A. Network Forensics
  B. Computer Forensics
  C. Incident Response
  D. Event Reaction
  B. Computer Forensics

• Question 173:

  One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

  A. the File Allocation Table
  B. the file header
  C. the file footer
  D. the sector map
  B. the file header

• Question 174:

  This organization maintains a database of hash signatures for known software:

  A. International Standards Organization
  B. Institute of Electrical and Electronics Engineers
  C. National Software Reference Library
  D. American National standards Institute
  C. National Software Reference Library

• Question 175:

  In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

  A. evidence must be handled in the same way regardless of the type of case
  B. evidence procedures are not important unless you work for a law enforcement agency
  C. evidence in a criminal case must be secured more tightly than in a civil case
  D. evidence in a civil case must be secured more tightly than in a criminal case
  C. evidence in a criminal case must be secured more tightly than in a civil case

• Question 176:

  Corporate investigations are typically easier than public investigations because:

  A. the users have standard corporate equipment and software
  B. the investigator does not have to get a warrant
  C. the investigator has to get a warrant
  D. the users can load whatever they want on their machines
  B. the investigator does not have to get a warrant

• Question 177:

  An Expert witness give an opinion if:

  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
  B. To define the issues of the case for determination by the finder of fact
  C. To stimulate discussion between the consulting expert and the expert witness
  D. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

• Question 178:

  At what layer of the OSI model do routers function on?

  A. 5
  B. 1
  C. 4
  D. 3
  D. 3

• Question 179:

  The police believe that Mevin Mattew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

  A. The Fourth Amendment
  B. The USA patriot Act
  C. The Good Samaritan Laws
  D. The Federal Rules of Evidence
  A. The Fourth Amendment

• Question 180:

  Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida. They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good. Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa. She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, requested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for.

  What principal of social engineering did Julia use?

  A. Reciprocation
  B. Friendship/Liking
  C. Social Validation
  D. Scarcity
  A. Reciprocation