EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 191:

  Which of the following is a federal law enacted in the US to control the ways that financial institutions deal with the private information of individuals?

  A. SOX

  B. HIPAA 1996

  C. GLBA

  D. PCI DSS

  Correct Answer: C

• Question 192:

  An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E” represent?

  A. Name of the Database

  B. Name of SQL Server

  C. Operating system of the system

  D. Network credentials of the database

  Correct Answer: B

• Question 193:

  In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?

  A. RAID 1

  B. The images will always be identical because data is mirrored for redundancy

  C. RAID 0

  D. It will always be different

  Correct Answer: D

• Question 194:

  One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

  A. The file header

  B. The File Allocation Table

  C. The file footer

  D. The sector map

  Correct Answer: A

• Question 195:

  An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?

  A. Cloud as a subject

  B. Cloud as a tool

  C. Cloud as an object

  D. Cloud as a service

  Correct Answer: A

• Question 196:

  Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer's log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies’ domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords. What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?

  A. Syllable attack

  B. Hybrid attack

  C. Brute force attack

  D. Dictionary attack

  Correct Answer: D

• Question 197:

  Which Event Correlation approach assumes and predicts what an attacker can do next after the attack by studying statistics and probability?

  A. Profile/Fingerprint-Based Approach

  B. Bayesian Correlation

  C. Time (Clock Time) or Role-Based Approach

  D. Automated Field Correlation

  Correct Answer: B

  Reference: https://info-savvy.com/summarize-the-event-correlation/#:~:text=Bayesian%20Correlation% 20Approach,by%20studying%20statistics%20and%20probability

• Question 198:

  Which of the following stand true for BIOS Parameter Block?

  A. The BIOS Partition Block describes the physical layout of a data storage volume

  B. The BIOS Partition Block is the first sector of a data storage device

  C. The length of BIOS Partition Block remains the same across all the file systems

  D. The BIOS Partition Block always refers to the 512-byte boot sector

  Correct Answer: A

  Reference: https://handwiki.org/wiki/BIOS_parameter_block

• Question 199:

  James is dealing with a case regarding a cybercrime that has taken place in Arizona, USA. James needs to lawfully seize the evidence from an electronic device without affecting the user's anonymity. Which of the following law should he comply with, before retrieving the evidence?

  A. First Amendment of the U.S. Constitution

  B. Fourth Amendment of the U.S. Constitution

  C. Third Amendment of the U.S. Constitution

  D. Fifth Amendment of the U.S. Constitution

  Correct Answer: D

  Reference: https://www.law.cornell.edu/constitution/fifth_amendment

• Question 200:

  What document does the screenshot represent?

  

  A. Expert witness form

  B. Search warrant form

  C. Chain of custody form

  D. Evidence collection form

  Correct Answer: D