EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 61:

  While working for a prosecutor, What do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense ?

  A. Keep the information of file for later review
  B. Destroy the evidence
  C. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
  D. Present the evidence to the defense attorney
  C. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge

• Question 62:

  What TCP/UDP port does the toolkit program netstat use?

  A. Port 7
  B. Port 15
  C. Port 23
  D. Port 69
  B. Port 15

• Question 63:

  Damaged portions of a disk on which no read/Write operation can be performed is known as ______________.

  A. Lost sector
  B. Bad sector
  C. Empty sector
  D. Unused sector
  B. Bad sector

• Question 64:

  When collecting electronic evidence at the crime scene, the collection should proceed from the most volatile to the least volatile

  A. True
  B. False
  A. True

• Question 65:

  Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible.

  A. True
  B. False
  A. True

• Question 66:

  Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack Jason can infer from his findings?

  A. DNS Poisoning
  B. Cookie Poisoning Attack
  C. DNS Redirection
  D. Session poisoning
  A. DNS Poisoning

• Question 67:

  You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the

  Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour.

  Why were these passwords cracked so Quickly?

  A. Passwords of 14 characters or less are broken up into two 7-character hashes
  B. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
  C. Networks using Active Directory never use SAM databases so the SAM database pulled was empty
  D. The passwords that were cracked are local accounts on the Domain Controller
  A. Passwords of 14 characters or less are broken up into two 7-character hashes

• Question 68:

  Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white- collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subjectJulie? paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America. What crime should Julie focus on?

  A. Physical theft
  B. Copyright infringement
  C. Industrial espionage
  D. Denial of Service attacks
  C. Industrial espionage

• Question 69:

  One way to identify the presence of hidden partitions on a suspect hard drive is to:One way to identify the presence of hidden partitions on a suspect? hard drive is to:

  A. Add up the total size of all known partitions and compare it to the total size of the hard drive
  B. Examine the FAT and identify hidden partitions by noting an ?in the artition Type?fieldExamine the FAT and identify hidden partitions by noting an ??in the ?artition Type?field
  C. Examine the LILO and note an ?in the artition Type?fieldExamine the LILO and note an ??in the ?artition Type?field It is not possible to have hidden partitions on a hard drive
  A. Add up the total size of all known partitions and compare it to the total size of the hard drive

• Question 70:

  First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for collecting, preserving, and packaging electronic evidence?

  A. System administrators
  B. Local managers or other non-forensic staff
  C. Forensic laboratory staff
  D. Lawyers
  C. Forensic laboratory staff