EC-COUNCIL EC0-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-349 Online Questions & Answers

• Question 171:

  Before you are called to testify as an expert, what must an attorney do first?

  A. engage in damage control
  B. prove that the tools you used to conduct your examination are perfect
  C. read your curriculum vitae to the jury
  D. qualify you as an expert witness
  D. qualify you as an expert witness

• Question 172:

  You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

  A. create a compressed copy of the file with DoubleSpace
  B. create a sparse data copy of a folder or file
  C. make a bit-stream disk-to-image file
  D. make a bit-stream disk-to-disk file
  C. make a bit-stream disk-to-image file

• Question 173:

  Using Internet logging software to investigate a case of malicious use of computers, the investigator comes across some entries that appear odd.

  

  From the log, the investigator can see where the person in question went on the Internet. From the log, it appears that the user was manually typing in different user ID numbers. What technique this user was trying?

  A. Parameter tampering
  B. Cross site scripting
  C. SQL injection
  D. Cookie Poisoning
  A. Parameter tampering

• Question 174:

  It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

  A. by law, three
  B. quite a few
  C. only one
  D. at least two
  C. only one

• Question 175:

  As a CHFI professional, which of the following is the most important to your professional reputation?

  A. Your Certifications
  B. The correct, successful management of each and every case
  C. The free that you charge
  D. The friendship of local law enforcement officers
  B. The correct, successful management of each and every case

• Question 176:

  At what layer does a cross site scripting attack occur on?

  A. Presentation
  B. Application
  C. Session
  D. Data Link
  B. Application

• Question 177:

  What is the first step taken in an investigation for laboratory forensic staff members?

  A. Packaging the electronic evidence
  B. Securing and evaluating the electronic crime scene
  C. Conducting preliminary interviews
  D. Transporting the electronic evidence
  B. Securing and evaluating the electronic crime scene

• Question 178:

  Which of the following is NOT a graphics file?

  A. Picture1.tga
  B. Picture2. bmp
  C. Picture3. nfo
  D. Picture4. psd
  C. Picture3. nfo

• Question 179:

  You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3. 4 Accounting software are required MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?

  A. Social engineering exploit
  B. Competitive exploit
  C. Information vulnerability
  D. Trade secret
  C. Information vulnerability

• Question 180:

  To preserve digital evidence, an investigator should ____________________.

  A. Make two copies of each evidence item using a single imaging tool
  B. Make a single copy of each evidence item using an approved imaging tool
  C. Make two copies of each evidence item using different imaging tools
  D. Only store the original evidence item
  C. Make two copies of each evidence item using different imaging tools