EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 111:

  Which of the following statements is incorrect when preserving digital evidence?

  A. Verify if the monitor is in on, off, or in sleep mode

  B. Turn on the computer and extract Windows event viewer log files

  C. Remove the plug from the power router or modem

  D. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

  Correct Answer: B

• Question 112:

  Which of the following is a part of a Solid-State Drive (SSD)?

  A. Head

  B. Cylinder

  C. NAND-based flash memory

  D. Spindle

  Correct Answer: C

• Question 113:

  Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses' testimony during federal legal proceedings?

  A. SWGDE and SWGIT

  B. IOCE

  C. Frye

  D. Daubert

  Correct Answer: D

• Question 114:

  Buffer overflow vulnerability of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the_________. There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack.

  A. Adjacent memory locations

  B. Adjacent bit blocks

  C. Adjacent buffer locations

  D. Adjacent string locations

  Correct Answer: A

• Question 115:

  Which of the following is NOT a physical evidence?

  A. Removable media

  B. Cables

  C. Image file on a hard disk

  D. Publications

  Correct Answer: C

• Question 116:

  During forensics investigations, investigators tend to collect the system time at first and compare it with UTC. What does the abbreviation UTC stand for?

  A. Coordinated Universal Time

  B. Universal Computer Time

  C. Universal Time for Computers

  D. Correlated Universal Time

  Correct Answer: A

• Question 117:

  Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

  A. DevScan

  B. Devcon

  C. fsutil

  D. Reg.exe

  Correct Answer: B

• Question 118:

  What must an attorney do first before you are called to testify as an expert?

  A. Qualify you as an expert witness

  B. Read your curriculum vitae to the jury

  C. Engage in damage control

  D. Prove that the tools you used to conduct your examination are perfect

  Correct Answer: A

• Question 119:

  Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID "WIN-ABCDE12345F." Which of the following log file will help Shane in tracking all the client connections and activities performed on the database server?

  A. WIN-ABCDE12345F.err

  B. WIN-ABCDE12345F-bin.n

  C. WIN-ABCDE12345F.pid

  D. WIN-ABCDE12345F.log

  Correct Answer: D

• Question 120:

  Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

  A. ff d8 ff

  B. 25 50 44 46

  C. d0 0f 11 e0

  D. 50 41 03 04

  Correct Answer: A