EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 291:

  How many times can data be written to a DVD+R disk?

  A. Twice

  B. Once

  C. Zero

  D. Infinite

  Correct Answer: B

• Question 292:

  What type of attack sends SYN requests to a target system with spoofed IP addresses?

  A. SYN flood

  B. Ping of death

  C. Cross site scripting

  D. Land

  Correct Answer: A

• Question 293:

  Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

  A. Text semagram

  B. Visual semagram

  C. Grill cipher

  D. Visual cipher

  Correct Answer: B

• Question 294:

  An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the team have to respond to the incident?

  A. One working day

  B. Two working days

  C. Immediately

  D. Four hours

  Correct Answer: A

• Question 295:

  A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file. What kind of picture is this file?

  A. Raster image

  B. Vector image

  C. Metafile image

  D. Catalog image

  Correct Answer: B

• Question 296:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed

  B. It can find bad sectors on the hard drive

  C. It can search slack space

  D. It can find files hidden within ADS

  Correct Answer: C

• Question 297:

  Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

  A. Fill the disk with zeros

  B. Low-level format

  C. Fill the disk with 4096 zeros

  D. Copy files from the master disk to the slave disk on the secondary IDE controller

  Correct Answer: A

• Question 298:

  What is the slave device connected to the secondary IDE controller on a Linux OS referred to?

  A. hda

  B. hdd

  C. hdb

  D. hdc

  Correct Answer: B

• Question 299:

  What will the following command accomplish? dd if=/dev/xxx of=mbr.backup bs=512 count=1

  A. Back up the master boot record

  B. Restore the master boot record

  C. Mount the master boot record on the first partition of the hard drive

  D. Restore the first 512 bytes of the first partition of the hard drive

  Correct Answer: A

• Question 300:

  Why should you never power on a computer that you need to acquire digital evidence from?

  A. When the computer boots up, files are written to the computer rendering the data nclean

  B. When the computer boots up, the system cache is cleared which could destroy evidence

  C. When the computer boots up, data in the memory buffer is cleared which could destroy evidence

  D. Powering on a computer has no affect when needing to acquire digital evidence from it

  Correct Answer: A