EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 231:

  When an investigator contacts by telephone the domain administrator or controller listed by a whois lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

  A. Title 18, Section 1030
  B. Title 18, Section 2703(d)
  C. Title 18, Section Chapter 90
  D. Title 18, Section 2703(f)
  D. Title 18, Section 2703(f)

• Question 232:

  With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ______

  B. 1
  C. 10
  D. 100
  A

• Question 233:

  What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

  A. Key escrow
  B. Steganography
  C. Rootkit
  D. Offset
  B. Steganography

• Question 234:

  You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

  A. HKEY_USERS
  B. HKEY_LOCAL_ADMIN
  C. HKEY_CLASSES_ADMIN
  D. HKEY_CLASSES_SYSTEM
  A. HKEY_USERS

• Question 235:

  The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

  A. INFO2 file
  B. INFO1 file
  C. LOGINFO2 file
  D. LOGINFO1 file
  A. INFO2 file

• Question 236:

  SMTP (Simple Mail Transfer protocol) receives outgoing mail from clients and validates source and destination addresses, and also sends and receives emails to and from other SMTP servers.

  A. True
  B. False
  A. True

• Question 237:

  The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. (Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0)

  Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 From the options given below choose the one which best interprets the following entry: Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

  A. An IDS evasion technique
  B. A buffer overflow attempt
  C. A DNS zone transfer
  D. Data being retrieved from 63.226.81.13
  A. An IDS evasion technique

• Question 238:

  What type of equipment would a forensics investigator store in a StrongHold bag?

  A. PDAPDA?
  B. Backup tapes
  C. Hard drives
  D. Wireless cards
  D. Wireless cards

• Question 239:

  What are the security risks of running a "repair" installation for Windows XP?

  A. Pressing Shift+F1 gives the user administrative rights
  B. Pressing Ctrl+F10 gives the user administrative rights
  C. There are no security risks when running the "repair" installation for Windows XP
  D. Pressing Shift+F10 gives the user administrative rights
  D. Pressing Shift+F10 gives the user administrative rights

• Question 240:

  Paul's company is in the process of undergoing a complete security audit including logical and physical security testing. After all logical tests were performed; it is now time for the physical round to begin. None of the employees are made aware of this round of testing. The security-auditing firm sends in a technician dressed as an electrician. He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas. After entering the main office, he is able to get into the server room telling the IT manager that there is a problem with the outlets in that room. What type of attack has the technician performed?

  A. Fuzzing
  B. Tailgating
  C. Backtrapping
  D. Man trap attack
  B. Tailgating