EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 461:

  When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

  A. on the individual computer's ARP cache

  B. in the Web Server log files

  C. in the DHCP Server log files

  D. there is no way to determine the specific IP address

  Correct Answer: C

• Question 462:

  When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

  A. a write-blocker

  B. a protocol analyzer

  C. a firewall

  D. a disk editor

  Correct Answer: A

• Question 463:

  How many sectors will a 125 KB file use in a FAT32 file system?

  A. 32

  B. 16

  C. 256

  D. 25

  Correct Answer: C

• Question 464:

  In a FAT32 system, a 123 KB file will use how many sectors?

  A. 34

  B. 25

  C. 11

  D. 56

  Correct Answer: B

• Question 465:

  You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

  A. The registry

  B. The swap file

  C. The recycle bin

  D. The metadata

  Correct Answer: B

• Question 466:

  What TCP/UDP port does the toolkit program netstat use?

  A. Port 7

  B. Port 15

  C. Port 23

  D. Port 69

  Correct Answer: B

• Question 467:

  Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?

  A. 18 U.S.C. 1029 Possession of Access Devices

  B. 18 U.S.C. 1030 Fraud and related activity in connection with computers

  C. 18 U.S.C. 1343 Fraud by wire, radio or television

  D. 18 U.S.C. 1361 Injury to Government Property

  E. 18 U.S.C. 1362 Government communication systems

  F. 18 U.S.C. 1831 Economic Espionage Act

  G. 18 U.S.C. 1832 Trade Secrets Act

  Correct Answer: B

• Question 468:

  Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

  A. 18 U.S.C. 1029

  B. 18 U.S.C. 1362

  C. 18 U.S.C. 2511

  D. 18 U.S.C. 2703

  Correct Answer: A

• Question 469:

  Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called?

  A. the Microsoft Virtual Machine Identifier

  B. the Personal Application Protocol

  C. the Globally Unique ID

  D. the Individual ASCII String

  Correct Answer: C

• Question 470:

  Which response organization tracks hoaxes as well as viruses?

  A. NIPC

  B. FEDCIRC

  C. CERT

  D. CIAC

  Correct Answer: D