EC-COUNCIL EC0-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC0-349 Online Questions & Answers

• Question 31:

  Sectors in hard disks typically contain how many bytes?

  A. 256
  B. 512
  C. 1024
  D. 2048
  B. 512

• Question 32:

  You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

  A. Show outdated equipment so it can be replaced
  B. List weak points on their network
  C. Use attack as a launching point to penetrate deeper into the network
  D. Demonstrate that no system can be protected against DoS attacks
  B. List weak points on their network

• Question 33:

  While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

  A. Keep the information of file for later review
  B. Destroy the evidence
  C. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
  D. Present the evidence to the defense attorney
  C. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge

• Question 34:

  What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

  A. digital attack
  B. denial of service
  C. physical attack
  D. ARP redirect
  B. denial of service

• Question 35:

  An investigator finds evidence of anti-forensic activity: many files have been securely wiped. Which artifact is most useful to show this activity occurred even if the files are unrecoverable?

  A. Residual MFT entries, USN journal, and volume shadow copy metadata showing deletion timestamps
  B. The Recycle Bin containing intact files
  C. The boot sector containing file names
  D. The application event log only
  A. Residual MFT entries, USN journal, and volume shadow copy metadata showing deletion timestamps

• Question 36:

  When a router receives an update for its routing table, what is the metric value change to that path?

  A. Increased by 2
  B. Decreased by 1
  C. Increased by 1
  D. Decreased by 2
  C. Increased by 1

• Question 37:

  You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

  A. Stringsearch
  B. grep
  C. dir
  D. vim
  B. grep

• Question 38:

  What must be obtained before an investigation is carried out at a location?

  A. Search warrant
  B. Subpoena
  C. Habeas corpus
  D. Modus operandi
  A. Search warrant

• Question 39:

  If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

  A. true
  B. false
  A. true

• Question 40:

  You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

  A. Packet filtering firewall
  B. Circuit-level proxy firewall
  C. Application-level proxy firewall
  D. Stateful firewall
  D. Stateful firewall