EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 201:

  You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

  A. 8
  B. 1
  C. 4
  D. 2
  C. 4

• Question 202:

  What is a SCSI (Small Computer System Interface)?

  A. A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners
  B. A standard electronic interface used between a computer motherboard's data paths or bus and the computer's disk storage devices
  C. A "plug-and-play" interface, which allows a device to be added without an adapter card and without rebooting the computer
  D. A point-to-point serial bi-directional interface for transmitting data between computer devices at data rates of up to 4 Gbps
  A. A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners

• Question 203:

  The ARP table of a router comes in handy for Investigating network attacks, as the table contains IP addresses associated with the respective MAC addresses. The ARP table can be accessed using the __________command in Windows 7.

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

• Question 204:

  Area density refers to:

  A. the amount of data per disk
  B. the amount of data per partition
  C. the amount of data per square inch
  D. the amount of data per platter
  A. the amount of data per disk
  C. the amount of data per square inch

• Question 205:

  An intrusion detection system (IDS) gathers and analyzes information from within a computer or a network to identify any possible violations of security policy, including unauthorized access, as well as misuse. Which of the following intrusion detection systems audit events that occur on a specific host?

  A. Network-based intrusion detection
  B. Host-based intrusion detection
  C. Log file monitoring
  D. File integrity checking
  B. Host-based intrusion detection

• Question 206:

  When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on

  A. True
  B. False
  B. False

• Question 207:

  Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform?

  A. ICMP ping sweep
  B. Ping trace
  C. Tracert
  D. Smurf scan
  A. ICMP ping sweep

• Question 208:

  When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?

  A. 202
  B. 404
  C. 505
  D. 909
  B. 404

• Question 209:

  When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

  A. Time-Sync Protocol
  B. SyncTime Service
  C. Network Time Protocol
  D. Universal Time Set
  C. Network Time Protocol

• Question 210:

  You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

  A. Bit-stream copy
  B. Robust copy
  C. Full backup copy
  D. Incremental backup copy
  A. Bit-stream copy