EC-COUNCIL EC1-349 Online Practice Questions and Exam Preparation

EC-COUNCIL EC1-349 Online Questions & Answers

• Question 71:

  What does the acronym POST mean as it relates to a PC?

  A. Power On Self Test
  B. Pre Operational Situation Test
  C. Primary Operating System Test
  D. Primary Operations Short Test
  A. Power On Self Test

• Question 72:

  If a suspect computer is located in an area that may have toxic chemicals, you must:

  A. coordinate with the HAZMAT team
  B. determine a way to obtain the suspect computer
  C. assume the suspect machine is contaminated
  D. do not enter alone
  A. coordinate with the HAZMAT team

• Question 73:

  File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file

  A. First 10 bytes
  B. First 20 bytes
  C. First 30 bytes
  D. First 40 bytes
  B. First 20 bytes

• Question 74:

  If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

  A. deltree command
  B. CMOS
  C. Boot.sys
  D. Scandisk utility
  E. boot.ini
  E. boot.ini

• Question 75:

  John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they shouldJohn is working on his company? policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents?

  A. Strip-cut shredder
  B. Cross-cut shredder
  C. Cross-hatch shredder
  D. Cris-cross shredder
  B. Cross-cut shredder

• Question 76:

  Which of the following is not a part of disk imaging tool requirements?

  A. The tool should not change the original content
  B. The tool should log I/O errors in an accessible and readable form, including the type and location of the error
  C. The tool must have the ability to be held up to scientific and peer review
  D. The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source
  D. The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source

• Question 77:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed
  B. It can find bad sectors on the hard drive
  C. It can search slack space
  D. It can find files hidden within ADS
  C. It can search slack space

• Question 78:

  George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time- based induction machine" be used. What IDS feature must George implement to meet this requirement?

  A. Pattern matching
  B. Statistical-based anomaly detection
  C. Real-time anomaly detection
  D. Signature-based anomaly detection
  C. Real-time anomaly detection

• Question 79:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire
  B. Run the powerful magnets over the hard disk
  C. Format the hard disk multiple times using a low level disk utility
  D. Overwrite the contents of the hard disk with Junk data
  A. Throw the hard disk into the fire
  C. Format the hard disk multiple times using a low level disk utility

• Question 80:

  You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

  A. The attorney-work-product rule
  B. Good manners
  C. Trade secrets
  D. ISO 17799
  A. The attorney-work-product rule