EC-COUNCIL EC0-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-349 Online Questions & Answers

• Question 21:

  Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated. When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?

  A. IT personnel
  B. Employees themselves
  C. Supervisors
  D. Administrative assistant in charge of writing policies
  C. Supervisors

• Question 22:

  Study the log given below and answer the following question:

  Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194. 222. 156. 169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194. 222. 156. 169:56693 -> 172. 16. 1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212. 244. 97. 121:3485 -> 172. 16. 1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194. 222. 156. 169:1425 -> 172. 16. 1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24. 9.255. 53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63. 226. 81.13:4499 -> 172. 16. 1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63. 226. 81.13:4630 -> 172. 16. 1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212. 251.1.94:642 -> 172. 16. 1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173. 35. 164:4221 -> 172. 16. 1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107. 87:2291 -> 172. 16. 1.101:53

  Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63. 226. 81.13:1351 -> 172. 16. 1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24. 112. 167. 35:20 -> 172. 16. 1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172. 16. 1.107:23 -> 213. 28.22. 189:4558

  Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

  A. Disallow UDP53 in from outside to DNS server
  B. Allow UDP53 in from DNS server to outside
  C. Disallow TCP53 in from secondaries or ISP server to DNS server
  D. Block all UDP traffic
  A. Disallow UDP53 in from outside to DNS server

• Question 23:

  In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

  A. Security Administrator
  B. Network Administrator
  C. Director of Information Technology
  D. Director of Administration
  B. Network Administrator

• Question 24:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire
  B. Run the powerful magnets over the hard disk
  C. Format the hard disk multiple times using a low level disk utility
  D. Overwrite the contents of the hard disk with Junk data
  A. Throw the hard disk into the fire

• Question 25:

  An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

  A. Smurf
  B. Ping of death
  C. Fraggle
  D. Nmap scan
  B. Ping of death

• Question 26:

  What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

  A. Cracks every password in 10 minutes
  B. Distribute processing over 16 or fewer computers
  C. Support for Encrypted File System
  D. Support for MD5 hash verification
  B. Distribute processing over 16 or fewer computers

• Question 27:

  With Regard to using an Antivirus scanner during a computer forensics investigation, You should:

  A. Scan the suspect hard drive before beginning an investigation
  B. Never run a scan on your forensics workstation because it could change your systems configuration
  C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
  D. Scan your Forensics workstation before beginning an investigation
  D. Scan your Forensics workstation before beginning an investigation

• Question 28:

  Area density refers to:

  A. the amount of data per disk
  B. the amount of data per partition
  C. the amount of data per square inch
  D. the amount of data per platter
  A. the amount of data per disk

• Question 29:

  What hashing method is used to password protect Blackberry devices?

  A. AES
  B. RC5
  C. MD5
  D. SHA-1
  D. SHA-1

• Question 30:

  What method of copying should always be performed first before carrying out an investigation?

  A. Parity-bit copy
  B. Bit-stream copy
  C. MS-DOS disc copy
  D. System level copy
  B. Bit-stream copy