EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 31:

  BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

  A. Header
  B. The RGBQUAD array
  C. Information header
  D. Image data
  B. The RGBQUAD array

• Question 32:

  If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

  A. Lossful compression
  B. Lossy compression
  C. Lossless compression
  D. Time-loss compression
  B. Lossy compression

• Question 33:

  When you carve an image, recovering the image depends on which of the following skills?

  A. Recognizing the pattern of the header content
  B. Recovering the image from a tape backup
  C. Recognizing the pattern of a corrupt file
  D. Recovering the image from the tape backup
  A. Recognizing the pattern of the header content

• Question 34:

  Billy, a computer forensics expert, has recovered a large number of DBX files during forensic investigation of a laptop. Which of the following email clients he can use to analyze the DBX files?

  A. Microsoft Outlook
  B. Microsoft Outlook Express
  C. Mozilla Thunderoird
  D. Eudora
  B. Microsoft Outlook Express

• Question 35:

  In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

  A. one who has NTFS 4 or 5 partitions
  B. one who uses dynamic swap file capability
  C. one who uses hard disk writes on IRQ 13 and 21
  D. one who has lots of allocation units per block or cluster
  D. one who has lots of allocation units per block or cluster

• Question 36:

  File deletion is a way of removing a file from a computer's file system. What happens when a file is deleted in windows7?

  A. The last letter of a file name is replaced by a hex byte code E5h
  B. The operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted
  C. Corresponding clusters in FAT are marked as used
  D. The computer looks at the clusters occupied by that file and does not avails space to store a new file
  B. The operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted

• Question 37:

  A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?

  A. Blu-Ray single-layer
  B. HD-DVD
  C. Blu-Ray dual-layer
  D. DVD-18
  C. Blu-Ray dual-layer

• Question 38:

  What is one method of bypassing a system BIOS password?

  A. Removing the processor
  B. Removing the CMOS battery
  C. Remove all the system memoryRemove all the system? memory
  D. Login to Windows and disable the BIOS password
  B. Removing the CMOS battery

• Question 39:

  Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:

  A. C:\windows\system32\config\SAM
  B. C:\windows\system32\con\SAM
  C. C:\windows\system32\Boot\SAM
  D. C:\windows\system32\drivers\SAM
  A. C:\windows\system32\config\SAM

• Question 40:

  Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?

  A. Send DOS commands to crash the DNS servers
  B. Perform DNS poisoning
  C. Enumerate all the users in the domain
  D. Perform a zone transfer
  D. Perform a zone transfer