EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 241:

  What will the following URL produce in an unpatched IIS Web Server? http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\

  A. Directory listing of C: drive on the web server
  B. Execute a buffer flow in the C: drive of the web server
  C. Directory listing of the C:\windows\system32 folder on the web server
  D. Insert a Trojan horse into the C: drive of the web server
  A. Directory listing of C: drive on the web server

• Question 242:

  When investigating a Windows System, it is important to view the contents of the page or swap file because:

  A. Windows stores all of the systems configuration information in this file
  B. This is file that windows use to communicate directly with Registry
  C. A Large volume of data can exist within the swap file of which the computer user has no knowledge
  D. This is the file that windows use to store the history of the last 100 commands that were run from the command line
  C. A Large volume of data can exist within the swap file of which the computer user has no knowledge

• Question 243:

  A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

  

  What can the investigator infer from the screenshot seen below?

  A. A smurf attack has been attempted
  B. A denial of service has been attempted
  C. Network intrusion has occurred
  D. Buffer overflow attempt on the firewall.
  C. Network intrusion has occurred

• Question 244:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?

  A. The year the evidence was taken
  B. The sequence number for the parts of the same exhibit
  C. The initials of the forensics analyst
  D. The sequential number of the exhibits seized
  D. The sequential number of the exhibits seized

• Question 245:

  Data files from original evidence should be used for forensics analysis

  A. True
  B. False
  B. False

• Question 246:

  Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob? testimony in this case?

  A. Justification
  B. Authentication
  C. Reiteration
  D. Certification
  B. Authentication

• Question 247:

  Graphics Interchange Format (GIF) is a ___________RGB bitmap Image format for Images with up to 256 distinct colors per frame.

  A. 8-bit
  B. 16-bit
  C. 24-bit
  D. 32-bit
  A. 8-bit

• Question 248:

  In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

  A. The change in the routing fabric to bypass the affected router
  B. More RESET packets to the affected router to get it to power back up
  C. STOP packets to all other routers warning of where the attack originated
  D. RESTART packets to the affected router to get it to power back up
  A. The change in the routing fabric to bypass the affected router

• Question 249:

  What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

  A. ARP redirect
  B. Physical attack
  C. Digital attack
  D. Denial of service
  D. Denial of service

• Question 250:

  A packet is sent to a router that does not have the packet destination address in its route table, how will the packet get to its properA packet is sent to a router that does not have the packet? destination address in its route table, how will the packet get to its proper destination?

  A. Border Gateway Protocol
  B. Root Internet servers
  C. Gateway of last resort
  D. Reverse DNS
  C. Gateway of last resort