EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 111:

  You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printed out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

  A. Routing Table
  B. Firewall log
  C. Configuration files
  D. Email Header
  D. Email Header

• Question 112:

  After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?

  A. RestrictAnonymous must be set to "2" for complete security
  B. There is no way to always prevent an anonymous null session from establishing
  C. RestrictAnonymous must be set to "10" for complete security
  D. RestrictAnonymous must be set to "3" for complete security
  A. RestrictAnonymous must be set to "2" for complete security

• Question 113:

  What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

  A. Compressed file
  B. Data stream file
  C. Encrypted file
  D. Reserved file
  B. Data stream file

• Question 114:

  A forensic investigator is a person who handles the complete Investigation process, that is, the preservation, identification, extraction, and documentation of the evidence. The investigator has many roles and responsibilities relating to the cybercrime analysis. The role of the forensic investigator is to:

  A. Take permission from all employees of the organization for investigation
  B. Harden organization network security
  C. Create an image backup of the original evidence without tampering with potential evidence
  D. Keep the evidence a highly confidential and hide the evidence from law enforcement agencies
  C. Create an image backup of the original evidence without tampering with potential evidence

• Question 115:

  The evolution of web services and their increasing use in business offers new attack vectors in an application framework. Web services are based on XML protocols such as web Services Definition Language (WSDL) for describing the connection points, Universal Description, Discovery, and Integration (UDDI) for the description and discovery of Web services and Simple Object Access Protocol (SOAP) for communication between Web services that are vulnerable to various web application threats. Which of the following layer in web services stack is vulnerable to fault code leaks?

  A. Presentation Layer
  B. Security Layer
  C. Discovery Layer
  D. Access Layer
  C. Discovery Layer

• Question 116:

  E-mail logs contain which of the following information to help you in your investigation?

  (Select up to 4)

  A. user account that was used to send the account
  B. attachments sent with the e-mail message
  C. unique message identifier
  D. contents of the e-mail message
  E. date and time the message was sent
  A. user account that was used to send the account
  C. unique message identifier
  D. contents of the e-mail message
  E. date and time the message was sent

• Question 117:

  Computer security logs contain information about the events occurring within an organization's systems and networks. Application and Web server log files are useful in detecting web attacks. The source, nature, and time of the attack can be determined by _________of the compromised system.

  A. Analyzing log files
  B. Analyzing SAM file
  C. Analyzing rainbow tables
  D. Analyzing hard disk boot records
  A. Analyzing log files

• Question 118:

  Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  A. Use Vmware to be able to capture the data in memory and examine it
  B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
  C. Create a Separate partition of several hundred megabytes and place the swap file there
  D. Use intrusion forensic techniques to study memory resident infections
  A. Use Vmware to be able to capture the data in memory and examine it
  C. Create a Separate partition of several hundred megabytes and place the swap file there

• Question 119:

  Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security. Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort. Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

  A. Simple Network Management Protocol
  B. Cisco Discovery Protocol
  C. Border Gateway Protocol
  D. Broadcast System Protocol
  B. Cisco Discovery Protocol

• Question 120:

  Smith, as a part his forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What Jason can do in this scenario to reset the PIN and access SIM data?

  A. He should contact the device manufacturer for a Temporary Unlock Code (TUK) to gain access to the SIM
  B. He cannot access the SIM data in this scenario as the network operators or device manufacturers have no idea about a device PIN
  C. He should again attempt PIN guesses after a time of 24 hours
  D. He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM
  D. He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM