EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 311:

  A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

  A. Searching for evidence themselves would not have any ill effects

  B. Searching could possibly crash the machine or device

  C. Searching creates cache files, which would hinder the investigation

  D. Searching can change date/time stamps

  Correct Answer: D

• Question 312:

  In the following directory listing,

  

  Which file should be used to restore archived email messages for someone using Microsoft Outlook?

  A. Outlook bak

  B. Outlook ost

  C. Outlook NK2

  D. Outlook pst

  Correct Answer: D

• Question 313:

  What must an investigator do before disconnecting an iPod from any type of computer?

  A. Unmount the iPod

  B. Mount the iPod

  C. Disjoin the iPod D. Join the iPod

  Correct Answer: A

• Question 314:

  The following is a log file screenshot from a default installation of IIS 6.0.

  

  What time standard is used by IIS as seen in the screenshot?

  A. UTC

  B. GMT

  C. TAI

  D. UT

  Correct Answer: A

• Question 315:

  What is one method of bypassing a system BIOS password?

  A. Removing the processor

  B. Removing the CMOS battery

  C. Remove all the system memory

  D. Login to Windows and disable the BIOS password

  Correct Answer: B

• Question 316:

  What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

  A. Every byte of the file(s) is given an MD5 hash to match against a master file

  B. Every byte of the file(s) is verified using 32-bit CRC

  C. Every byte of the file(s) is copied to three different hard drives

  D. Every byte of the file(s) is encrypted using three different methods

  Correct Answer: B

• Question 317:

  When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

  A. All virtual memory will be deleted

  B. The wrong partition may be set to active

  C. This action can corrupt the disk

  D. The computer will be set in a constant reboot state

  Correct Answer: C

• Question 318:

  When using an iPod and the host computer is running Windows, what file system will be used?

  A. iPod+

  B. HFS

  C. FAT16

  D. FAT32

  Correct Answer: D

• Question 319:

  If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

  A. Lossful compression

  B. Lossy compression

  C. Lossless compression

  D. Time-loss compression

  Correct Answer: B

• Question 320:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

  A. The year the evidence was taken

  B. The sequence number for the parts of the same exhibit

  C. The initials of the forensics analyst

  D. The sequential number of the exhibits seized

  Correct Answer: D