EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 441:

  Which of the following filesystem is used by Mac OS X?

  A. EFS
  B. HFS+
  C. EXT2
  D. NFS
  B. HFS+

• Question 442:

  What happens when a file is deleted by a Microsoft operating system using the FAT file system?

  A. The file is erased and cannot be recovered
  B. The file is erased but can be recovered partially
  C. A copy of the file is stored and the original file is erased
  D. Only the reference to the file is removed from the FAT and can be recovered
  D. Only the reference to the file is removed from the FAT and can be recovered

• Question 443:

  Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

  A. CVE
  B. IANA
  C. RIPE
  D. APIPA
  A. CVE

• Question 444:

  Why would a company issue a dongle with the software they sell?

  A. To provide source code protection
  B. To provide wireless functionality with the software
  C. To provide copyright protection
  D. To ensure that keyloggers cannot be used
  C. To provide copyright protection

• Question 445:

  You should make at least how many bit-stream copies of a suspect drive?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

• Question 446:

  You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

  A. The tool hasn't been tested by the International Standards Organization (ISO)
  B. Only the local law enforcement should use the tool
  C. The total has not been reviewed and accepted by your peers
  D. You are not certified for using the tool
  C. The total has not been reviewed and accepted by your peers

• Question 447:

  An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

  A. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
  B. The EFS Revoked Key Agent can be used on the computer to recover the information
  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information
  D. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information
  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information

• Question 448:

  Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?

  A. Sample banners are used to record the system activities when used by the unauthorized user
  B. In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring
  C. The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken
  D. At the time of seizing process, you need to shut down the computer immediately
  D. At the time of seizing process, you need to shut down the computer immediately

• Question 449:

  An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

  A. Smurf
  B. Ping of death
  C. Fraggle
  D. Nmap scan
  B. Ping of death

• Question 450:

  When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

  A. All virtual memory will be deleted
  B. The wrong partition may be set to active
  C. This action can corrupt the disk
  D. The computer will be set in a constant reboot state
  C. This action can corrupt the disk