EC-COUNCIL EC0-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-349 Online Questions & Answers

• Question 1:

  You are running through a series of tests on your network to check for any security vulnerabilities.

  After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is

  successful even though you have FTP blocked at the external firewall. What has happened?

  A. The firewall failed-bypass
  B. The firewall failed-closed
  C. The firewall ACL has been purged
  D. The firewall failed-open
  D. The firewall failed-open

• Question 2:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed
  B. It can find bad sectors on the hard drive
  C. It can search slack space D. It can find files hidden within ADS
  C. It can search slack space D. It can find files hidden within ADS

• Question 3:

  How many times can data be written to a DVD+R disk?

  A. Twice
  B. Once
  C. Zero
  D. Infinite
  B. Once

• Question 4:

  Which program is the bootloader when Windows XP starts up?

  A. KERNEL.EXE
  B. NTLDR
  C. LOADER
  D. LILO
  B. NTLDR

• Question 5:

  What is the target host IP in the following command?

  A. 172. 16. 28.95
  B. 10.10.150.1
  C. Firewalk does not scan target hosts
  D. This command is using FIN packets, which cannot scan target hosts
  A. 172. 16. 28.95

• Question 6:

  What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?

  A. Internet service provider information
  B. E-mail header
  C. Username and password
  D. Firewall log
  B. E-mail header

• Question 7:

  Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison lawyer trying to prove the police violated?

  A. The 10th Amendment
  B. The 5th Amendment
  C. The 1st Amendment
  D. The 4th Amendment
  D. The 4th Amendment

• Question 8:

  An investigator needs to preserve e-mail evidence on a mail server immediately during an incident. Which of the following is the best immediate action?

  A. Shut down the mail server to prevent further emails
  B. Request the ISP to preserve logs and mailstore images (preservation hold)
  C. Delete mailbox to prevent contamination
  D. Ask users to change their passwords
  B. Request the ISP to preserve logs and mailstore images (preservation hold)

• Question 9:

  The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

  A. Locard Exchange Principle
  B. Clark Standard
  C. Kelly Policy
  D. Silver-Platter Doctrine
  D. Silver-Platter Doctrine

• Question 10:

  Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  A. Use VMware to be able to capture the data in memory and examine it
  B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
  C. Create a Separate partition of several hundred megabytes and place the swap file there
  D. Use intrusion forensic techniques to study memory resident infections
  C. Create a Separate partition of several hundred megabytes and place the swap file there