EC-COUNCIL Certified Ethical Hacker 412-79 Questions & Answers

• Question 31:

  You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have founD. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subjects computer. You inform the officer that you will not be able to comply with that request because doing so would:

  A. Violate your contract

  B. Cause network congestion

  C. Make you an agent of law enforcement

  D. Write information to the subjects hard drive

  Correct Answer: C

• Question 32:

  A law enforcement officer may only search for and seize criminal evidence with _____________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searcheD.

  A. Mere Suspicion

  B. A preponderance of the evidence

  C. Probable cause

  D. Beyond a reasonable doubt

  Correct Answer: C

• Question 33:

  The police believe that Mevin Mattew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

  A. The Fourth Amendment

  B. The USA patriot Act

  C. The Good Samaritan Laws

  D. The Federal Rules of Evidence

  Correct Answer: A

• Question 34:

  You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

  A. Stringsearch

  B. grep

  C. dir

  D. vim

  Correct Answer: B

• Question 35:

  When cataloging digital evidence, the primary goal is to:

  A. Make bit-stream images of all hard drives

  B. Preserve evidence integrity

  C. Not remove the evidence from the scene

  D. Not allow the computer to be turned off

  Correct Answer: B

• Question 36:

  As a CHFI professional, which of the following is the most important to your professional reputation?

  A. Your Certifications

  B. The correct, successful management of each and every case

  C. The free that you charge

  D. The friendship of local law enforcement officers

  Correct Answer: B

• Question 37:

  You are assisting in the investigation of a possible Web Server Hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a porno graphic web site. The company checked the web server and nothing appears wrong. When you type in the IP address of the web site in your browser everything appears normal. What is the name of the attack that affects the DNS cache of the name resolution servers, resulting in those servers directing users to the wrong web site?

  A. ARP Poisoning

  B. DNS Poisoning

  C. HTTP redirect attack

  D. IP Spoofing

  Correct Answer: B

• Question 38:

  In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

  A. The ISP can investigate anyone using their service and can provide you with assistance

  B. The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

  C. The ISP can t conduct any type of investigations on anyone and therefore can t assist you

  D. ISP s never maintain log files so they would be of no use to your investigation

  Correct Answer: B

• Question 39:

  You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer laB. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

  A. Bit-stream Copy

  B. Robust Copy

  C. Full backup Copy

  D. Incremental Backup Copy

  Correct Answer: A

• Question 40:

  Microsoft Outlook maintains email messages in a proprietary format in what type of file?

  A. .email

  B. .mail

  C. .pst

  D. .doc

  Correct Answer: C