EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

• Question 481:

  What does the superblock in Linux define?

  A. filesynames

  B. diskgeometr

  C. location of the firstinode

  D. available space

  Correct Answer: C

• Question 482:

  Diskcopy is:

  A. a utility by AccessData

  B. a standard MS-DOS command

  C. Digital Intelligence utility

  D. dd copying tool

  Correct Answer: B

  diskcopy is a STANDARD DOS utility. C:\WINDOWS>diskcopy / - Copies the contents of one floppy disk to another.

• Question 483:

  You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

  A. 8

  B. 1

  C. 4

  D. 2

  Correct Answer: C

• Question 484:

  When obtaining a warrant, it is important to:

  A. particularlydescribe the place to be searched and particularly describe the items to be seized

  B. generallydescribe the place to be searched and particularly describe the items to be seized

  C. generallydescribe the place to be searched and generally describe the items to be seized

  D. particularlydescribe the place to be searched and generally describe the items to be seized

  Correct Answer: A

• Question 485:

  If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

  A. deltree command

  B. CMOS

  C. Boot.sys

  D. Scandisk utility

  Correct Answer: C

• Question 486:

  During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

  A. Inculpatory evidence

  B. Mandatory evidence

  C. Exculpatory evidence

  D. Terrible evidence

  Correct Answer: C

• Question 487:

  If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

  A. true

  B. false

  Correct Answer: A

• Question 488:

  What binary coding is used most often for e-mail purposes?

  A. MIME

  B. Uuencode

  C. IMAP

  D. SMTP

  Correct Answer: A

• Question 489:

  If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  A. The system files have been copied by a remote attacker

  B. The system administrator has created an incremental backup

  C. The system has been compromised using a t0rnrootkit

  D. Nothing in particular as these can be operational files

  Correct Answer: D

• Question 490:

  From the following spam mail header, identify the host IP that sent this spam?

  From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT) Message-Id: >[email protected] From: "china hotel web" To: "Shlam" Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal Reply-To: "china hotel web"

  A. 137.189.96.52

  B. 8.12.1.0

  C. 203.218.39.20

  D. 203.218.39.50

  Correct Answer: C