EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 91:

  What malware analysis operation can the investigator perform using the jv16 tool?

  A. Files and Folder Monitor

  B. Installation Monitor

  C. Network Traffic Monitoring/Analysis

  D. Registry Analysis/Monitoring

  Correct Answer: D

• Question 92:

  Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

  A. Mime-Version header

  B. Content-Type header

  C. Content-Transfer-Encoding header

  D. Errors-To header

  Correct Answer: D

• Question 93:

  Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

  A. Same-platform correlation

  B. Network-platform correlation

  C. Cross-platform correlation

  D. Multiple-platform correlation

  Correct Answer: C

• Question 94:

  Which of the following standard represents a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases?

  A. SWGDE and SWGIT

  B. Daubert

  C. Frye

  D. IOCE

  Correct Answer: C

• Question 95:

  Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.

  A. Physical block

  B. Operating system block

  C. Hard disk block

  D. Logical block

  Correct Answer: A

• Question 96:

  Which one of the following is not a first response procedure?

  A. Preserve volatile data

  B. Fill forms

  C. Crack passwords

  D. Take photos

  Correct Answer: C

• Question 97:

  Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

  A. 8-bit

  B. 32-bit

  C. 16-bit

  D. 24-bit

  Correct Answer: A

• Question 98:

  Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.

  A. Waffen FS

  B. RuneFS

  C. FragFS

  D. Slacker

  Correct Answer: D

• Question 99:

  Tasklist command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following tasklist commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

  A. tasklist /p

  B. tasklist /v

  C. tasklist /u

  D. tasklist /s

  Correct Answer: B

• Question 100:

  The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

  A. http://victim.com/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..% c0% af../..%c0%af../winnt/system32/cmd.exe?/c+dir+C:\Winnt\system32\Logfiles\W3SVC1

  B. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/ home/live/ap/htdocs/test

  C. 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326

  D. 127.0.0.1 - - [10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0" 200 2326

  Correct Answer: B