EC-COUNCIL 412-79 Online Practice Questions and Exam Preparation

EC-COUNCIL 412-79 Online Questions & Answers

• Question 181:

  Which of the following is NOT a graphics file?

  A. Picture1.tga
  B. Picture2.bmp
  C. Picture3.nfo
  D. Picture4.psd
  C. Picture3.nfo

• Question 182:

  You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

  A. 0:1000, 150
  B. 0:1709, 150
  C. 1:1709, 150
  D. 0:1709-1858
  B. 0:1709, 150

• Question 183:

  Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers. Bill protects the PDF documents with a password and sends them to their intended recipients. Why PDF passwords do not offer maximum protection?

  A. PDF passwords can easily be cracked by software brute force tools
  B. PDF passwords are not considered safe by Sarbanes-Oxley
  C. PDF passwords are converted to clear text when sent through E-mail
  D. When sent through E-mail, PDF passwords are stripped from the document completely
  A. PDF passwords can easily be cracked by software brute force tools

• Question 184:

  Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

  A. 18 U.S.C. 1029
  B. 18 U.S.C. 1362
  C. 18 U.S.C. 2511
  D. 18 U.S.C. 2703
  A. 18 U.S.C. 1029

• Question 185:

  Click on the Exhibit Button

  Paulette works for an IT security consulting company that is currently performing an audit for the firm ACE Unlimited. Paulette's duties include logging on to all the company's network equipment to ensure IOS versions are up-to-date and all the other security settings are as stringent as possible. Paulette presents the following screenshot to her boss so he can inform the client about necessary changes need to be made. From the screenshot, what changes should the client company make?

  Exhibit:

  

  A. The banner should not state "only authorized IT personnel may proceed"
  B. Remove any identifying numbers, names, or version information
  C. The banner should include the Cisco tech support contact information as well
  D. The banner should have more detail on the version numbers for the network equipment
  B. Remove any identifying numbers, names, or version information

• Question 186:

  You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

  A. 70 years
  B. the life of the author
  C. the life of the author plus 70 years
  D. copyrights last forever
  C. the life of the author plus 70 years

• Question 187:

  What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

  A. rootkit
  B. key escrow
  C. steganography
  D. Offset
  C. steganography

• Question 188:

  You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

  A. All forms should be placed in an approved secure container because they are now primary evidence in the case.
  B. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.
  C. The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file.
  D. All forms should be placed in the report file because they are now primary evidence in the case.
  B. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.

• Question 189:

  From the following spam mail header, identify the host IP that sent this spam? From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001

  17:26:36

  +0800 (HKT) Message-Id: >[email protected] From: "china hotel web"

  To: "Shlam"

  Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME- Version: 1.0 X-Priority: 3 X-MSMail- Priority: Normal Reply-To: "china hotel web"

  A. 137.189.96.52
  B. 8.12.1.0
  C. 203.218.39.20
  D. 203.218.39.50
  C. 203.218.39.20

• Question 190:

  In the context of file deletion process, which of the following statement holds true?

  A. When files are deleted, the data is overwritten and the cluster marked as available
  B. The longer a disk is inuse, the less likely it is that deleted files will be overwritten
  C. While booting, the machine may create temporary files that can delete evidence
  D. Secure delete programs work by completely overwriting the file in one go
  C. While booting, the machine may create temporary files that can delete evidence
  D. Secure delete programs work by completely overwriting the file in one go