EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 411:

  When cataloging digital evidence, the primary goal is to

  A. Make bit-stream images of all hard drives

  B. Preserve evidence integrity

  C. Not remove the evidence from the scene

  D. Not allow the computer to be turned off

  Correct Answer: B

• Question 412:

  A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

  A. Mere Suspicion

  B. A preponderance of the evidence

  C. Probable cause D. Beyond a reasonable doubt

  Correct Answer: C

• Question 413:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire

  B. Run the powerful magnets over the hard disk

  C. Format the hard disk multiple times using a low level disk utility

  D. Overwrite the contents of the hard disk with Junk data

  Correct Answer: A

• Question 414:

  You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

  A. The X509 Address

  B. The SMTP reply Address

  C. The E-mail Header

  D. The Host Domain Name

  Correct Answer: C

• Question 415:

  You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:

  A. Violate your contract

  B. Cause network congestion

  C. Make you an agent of law enforcement

  D. Write information to the subject's hard drive

  Correct Answer: C

• Question 416:

  Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

  A. Globally unique ID

  B. Microsoft Virtual Machine Identifier

  C. Personal Application Protocol

  D. Individual ASCII string

  Correct Answer: A

• Question 417:

  An Expert witness give an opinion if:

  A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

  B. To define the issues of the case for determination by the finder of fact

  C. To stimulate discussion between the consulting expert and the expert witness

  D. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

  Correct Answer: A

• Question 418:

  When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

  A. Automate Collection from image files

  B. Avoiding copying data from the boot partition

  C. Acquire data from host-protected area on a disk

  D. Prevent Contamination to the evidence drive

  Correct Answer: D

• Question 419:

  Printing under a Windows Computer normally requires which one of the following files types to be created?

  A. EME

  B. MEM

  C. EMF

  D. CME

  Correct Answer: C

• Question 420:

  To preserve digital evidence, an investigator should ____________________.

  A. Make two copies of each evidence item using a single imaging tool

  B. Make a single copy of each evidence item using an approved imaging tool

  C. Make two copies of each evidence item using different imaging tools

  D. Only store the original evidence item

  Correct Answer: C