EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 241:

  The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created. Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?

  A. File Allocation Table (FAT)

  B. New Technology File System (NTFS)

  C. Hierarchical File System (HFS)

  D. Global File System (GFS)

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/windows/win32/sysinfo/file-times

• Question 242:

  Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?

  A. Data Rows store the actual data

  B. Data Rows present Page type. Page ID, and so on

  C. Data Rows point to the location of actual data

  D. Data Rows spreads data across multiple databases

  Correct Answer: B

• Question 243:

  In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?

  A. Determines the data associated with value EnablePrefetcher

  B. Monitors the first 10 seconds after the process is started

  C. Checks whether the data is processed

  D. Checks hard page faults and soft page faults

  Correct Answer: C

  Reference: https://resources.infosecinstitute.com/topic/windows-systems-artifacts-digital-forensics-part-iiiprefetch-files/

• Question 244:

  Self-Monitoring, Analysis, and Reporting Technology (SMART) is built into the hard drives to monitor and report system activity. Which of the following is included in the report generated by SMART?

  A. Power Off time

  B. Logs of high temperatures the drive has reached

  C. All the states (running and discontinued) associated with the OS

  D. List of running processes

  Correct Answer: B

  Reference: https://www.hdsentinel.com/smart/index.php

• Question 245:

  What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

  A. Windows Services Monitoring

  B. System Baselining

  C. Start-up Programs Monitoring

  D. Host integrity Monitoring

  Correct Answer: D

  Explanation:

  Host integrity monitoring is the process of studying the changes that have taken place across a system

  after a series of actions or incidents. Involves monitoring ports, processes, registry, event logs, etc.

• Question 246:

  Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

  A. Hex Editor

  B. Internet Evidence Finder

  C. Process Monitor

  D. Report Viewer

  Correct Answer: C

• Question 247:

  In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

  A. config.db

  B. install.db

  C. sigstore.db

  D. filecache.db

  Correct Answer: A

  Reference: http://ijettjournal.org/Special%20issue/CAT-2020-III/CATI3P207.pdf

• Question 248:

  For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

  A. Bypassing iPhone passcode

  B. Debugging iPhone

  C. Rooting iPhone

  D. Copying contents of iPhone

  Correct Answer: A

• Question 249:

  What is the name of the first reserved sector in File allocation table?

  A. Volume Boot Record

  B. Partition Boot Sector

  C. Master Boot Record

  D. BIOS Parameter Block

  Correct Answer: C

• Question 250:

  What does the command “C:\>wevtutil gl ” display?

  A. Configuration information of a specific Event Log

  B. Event logs are saved in .xml format

  C. Event log record structure

  D. List of available Event Logs

  Correct Answer: A