EC-COUNCIL Certified Ethical Hacker 412-79 Questions & Answers

• Question 21:

  During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complain with Police?

  A. Yes, and all evidence can be turned over to the police

  B. Yes, but only if you turn the evidence over to a federal law enforcement agency

  C. No, because the investigation was conducted without following standard police procedures

  D. No, because the investigation was conducted without warrant

  Correct Answer: A

• Question 22:

  What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

  A. mcopy

  B. image

  C. MD5

  D. dd

  Correct Answer: D

• Question 23:

  Printing under a Windows Computer normally requires which one of the following files types to be created?

  A. EME

  B. MEM

  C. EMF

  D. CME

  Correct Answer: C

• Question 24:

  Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

  A. The manufacturer of the system compromised

  B. The logic, formatting and elegance of the code used in the attack

  C. The nature of the attack

  D. The vulnerability exploited in the incident

  Correct Answer: B

• Question 25:

  To preserve digital evidence, an investigator should ____________________

  A. Make tow copies of each evidence item using a single imaging tool

  B. Make a single copy of each evidence item using an approved imaging tool

  C. Make two copies of each evidence item using different imaging tools

  D. Only store the original evidence item

  Correct Answer: C

• Question 26:

  When using Windows acquisitions tools to acquire digital evidence, it is important to use a well- tested hardware write-blocking device to:

  A. Automate Collection from image files

  B. Avoiding copying data from the boot partition

  C. Acquire data from host-protected area on a disk

  D. Prevent Contamination to the evidence drive

  Correct Answer: D

• Question 27:

  An Expert witness give an opinion if:

  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

  B. To define the issues of the case for determination by the finder of fact

  C. To stimulate discussion between the consulting expert and the expert witness

  D. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

  Correct Answer: A

• Question 28:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire

  B. Run the powerful magnets over the hard disk

  C. Format the hard disk multiple times using a low level disk utility

  D. Overwrite the contents of the hard disk with Junk data

  Correct Answer: A

• Question 29:

  Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

  A. Globally unique ID

  B. Microsoft Virtual Machine Identifier

  C. Personal Application Protocol

  D. Individual ASCII string

  Correct Answer: A

• Question 30:

  You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

  A. The X509 Address

  B. The SMTP reply Address

  C. The E-mail Header

  D. The Host Domain Name

  Correct Answer: C