EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 201:

  You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?

  A. To control the room temperature

  B. To strengthen the walls, ceilings, and floor

  C. To avoid electromagnetic emanations

  D. To make the lab sound proof

  Correct Answer: D

  Reference: https://info-savvy.com/physical-security-recommendations-of-computer-forensics-lab/

• Question 202:

  What does the Rule 101 of Federal Rules of Evidence states?

  A. Scope of the Rules, where they can be applied

  B. Purpose of the Rules

  C. Limited Admissibility of the Evidence

  D. Rulings on Evidence

  Correct Answer: A

  Reference: https://law.indiana.edu/instruction/tanford/b723/02obj/R02.pdf

• Question 203:

  What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

  A. Jump instruction and the OEM ID

  B. BIOS Parameter Block (BPB) and the OEM ID

  C. BIOS Parameter Block (BPB) and the extended BPB

  D. Bootstrap code and the end of the sector marker

  Correct Answer: C

  Reference: http://ntfs.com/ntfs-partition-boot-sector.htm

• Question 204:

  Which program uses different techniques to conceal a malware's code, thereby making it difficult for security mechanisms to detect or remove it?

  A. Dropper

  B. Packer

  C. Injector

  D. Obfuscator

  Correct Answer: D

  Reference: https://www.sciencedirect.com/topics/computer-science/obfuscation-technique

• Question 205:

  Which forensic investigation methodology believes that criminals commit crimes solely to benefit their criminal enterprises?

  A. Scientific Working Group on Digital Evidence

  B. Daubert Standard

  C. Enterprise Theory of Investigation

  D. Fyre Standard

  Correct Answer: C

  Reference: https://info-savvy.com/rules-of-forensics-investigation/

• Question 206:

  Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot

  records, or memory with a known and trusted baseline?

  A. Signature-Based Detection

  B. Integrity-Based Detection

  C. Cross View-Based Detection

  D. Heuristic/Behavior-Based Detection

  Correct Answer: B

  Reference: https://info-savvy.com/anti-forensics-techniques-rootkits/

• Question 207:

  Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?

  A. pstree

  B. pgrep

  C. ps

  D. grep

  Correct Answer: B

  Reference: https://askubuntu.com/questions/180336/how-to-find-the-process-id-pid-of-a-running-terminalprogram

• Question 208:

  Which of these ISO standards define the file system for optical storage media, such as CD-ROM and DVDROM?

  A. ISO 9660

  B. ISO 13346

  C. ISO 9960

  D. ISO 13490

  Correct Answer: A

  Reference: https://en.wikipedia.org/wiki/ISO_9660#:~:text=ISO%209660%20is%20a%20file%20system% 20for%20optical%20disc%20media

• Question 209:

  Which of the following hives in Windows registry contain configuration information related to the application type that is used to open various files on the system?

  A. HKEY_CURRENT_CONFIG

  B. HKEY_CLASSES_ROOT

  C. HKEY_CURRENT_USER

  D. HKEY_LOCAL MACHINE

  Correct Answer: B

  Reference: https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensicanalysis-part-1/#:~:text=Each%20of%20these%20hives%20plays,the%20function%20of%20the% 20system.andtext=The%20HKEY_CURRENT_CONFIG%20hive%20contains%20the,various%20files%20on %20the%20system

• Question 210:

  In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file var/log/ dmesg?

  A. Kernel ring buffer information

  B. All mail server message logs

  C. Global system messages

  D. Debugging log messages

  Correct Answer: A

  Reference: https://superuser.com/questions/565927/differences-in-var-log-syslog-dmesg-messages-logfiles#:~:text=%2Fvar%2Flog%2Fdmesg%20%E2%80%93,kernel%20detects%20during%20boot% 20process