EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 381:

  A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

  A. He should search in C:\Windows\System32\RECYCLED folder
  B. The Recycle Bin does not exist on the hard drive
  C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
  D. Only FAT system contains RECYCLED folder and not NTFS
  C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them

• Question 382:

  Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity.

  A. True
  B. False
  A. True

• Question 383:

  Which of the following attacks allows attacker to acquire access to the communication channels between the victim and server to extract the information?

  A. Man-in-the-middle (MITM) attack
  B. Replay attack
  C. Rainbow attack
  D. Distributed network attack
  A. Man-in-the-middle (MITM) attack

• Question 384:

  You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?

  A. Snort
  B. Airsnort
  C. Ettercap
  D. RaidSniff
  C. Ettercap

• Question 385:

  You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?

  A. Oligomorhic
  B. Transmorphic
  C. Polymorphic
  D. Metamorphic
  D. Metamorphic

• Question 386:

  Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida. They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good. Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa. She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, reQuested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for. What principal of social engineering did Julia use?

  A. Social Validation
  B. Friendship/Liking
  C. Reciprocation
  D. Scarcity
  C. Reciprocation

• Question 387:

  The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term?

  A. Detection
  B. Hearsay
  C. Spoliation
  D. Discovery
  D. Discovery

• Question 388:

  Which of the following is the certifying body of forensics labs that investigate criminal cases by analyzing evidence?

  A. The American Society of Crime Laboratory Directors (ASCLD)
  B. International Society of Forensics Laboratory (ISFL)
  C. The American Forensics Laboratory Society (AFLS)
  D. The American Forensics Laboratory for Computer Forensics (AFLCF)
  A. The American Society of Crime Laboratory Directors (ASCLD)

• Question 389:

  Digital photography helps in correcting the perspective of the Image which Is used In taking the measurements of the evidence. Snapshots of the evidence and incident-prone areas need to be taken to help in the forensic process. Is digital photography accepted as evidence in the court of law?

  A. Yes
  B. No
  A. Yes

• Question 390:

  A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file?its contents. The picture? quality is not degraded at all from this process. What kind of picture is this file?

  A. Raster image
  B. Vector image
  C. Metafile image
  D. Catalog image
  B. Vector image