EC-COUNCIL EC0-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-349 Online Questions & Answers

• Question 181:

  As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?

  A. The IP address of the employees' computers
  B. Bank account numbers and the corresponding routing numbers
  C. The employees network usernames and passwords
  D. The MAC address of the employees' computers
  C. The employees network usernames and passwords

• Question 182:

  An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the team have to respond to the incident?

  A. One working day
  B. Two working days
  C. Immediately
  D. Four hours
  A. One working day

• Question 183:

  Microsoft Outlook maintains email messages in a proprietary format in what type of file?

  A. .email
  B. .mail
  C. .pst
  D. .doc
  C. .pst

• Question 184:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST
  C. there is no reason to worry about this possible claim because state labs are certified
  D. sign a statement attesting that the evidence is the same as it was when it entered the lab
  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

• Question 185:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

  A. The year the evidence was taken
  B. The sequence number for the parts of the same exhibit
  C. The initials of the forensics analyst
  D. The sequential number of the exhibits seized
  D. The sequential number of the exhibits seized

• Question 186:

  When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?

  A. RIM Messaging center
  B. Blackberry Enterprise server
  C. Microsoft Exchange server
  D. Blackberry desktop redirector
  C. Microsoft Exchange server

• Question 187:

  When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

  A. Passive IDS
  B. Active IDS
  C. Progressive IDS
  D. NIPS
  B. Active IDS

• Question 188:

  George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

  A. src port 23 and dst port 23
  B. udp port 22 and host 172. 16. 28.1/24
  C. net port 22
  D. src port 22 and dst port 22
  D. src port 22 and dst port 22

• Question 189:

  The police believe that Melvin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

  A. The Fourth Amendment
  B. The USA patriot Act
  C. The Good Samaritan Laws
  D. The Federal Rules of Evidence
  A. The Fourth Amendment

• Question 190:

  What must an investigator do before disconnecting an iPod from any type of computer?

  A. Unmount the iPod
  B. Mount the iPod
  C. Disjoin the iPod
  D. Join the iPod
  A. Unmount the iPod