EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 271:

  You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

  A. The X509 Address

  B. The SMTP reply Address

  C. The E-mail Header

  D. The Host Domain Name

  Correct Answer: C

• Question 272:

  You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are reQuired MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?

  A. Trade secret

  B. Social engineering exploit

  C. Competitive exploit

  D. Information vulnerability

  Correct Answer: D

• Question 273:

  Which program is the oot loader?when Windows XP starts up?Which program is the ?oot loader?when Windows XP starts up?

  A. KERNEL.EXE

  B. NTLDR

  C. LOADER

  D. LILO

  Correct Answer: B

• Question 274:

  Microsoft Outlook maintains email messages in a proprietary format in what type of file?

  A. .email

  B. .mail

  C. .pst

  D. .doc

  Correct Answer: C

• Question 275:

  John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?

  A. Firewalk sets all packets with a TTL of one

  B. Firewalk sets all packets with a TTL of zero

  C. Firewalk cannot pass through Cisco firewalls

  D. Firewalk cannot be detected by network sniffers

  Correct Answer: A

• Question 276:

  An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

  A. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information

  B. The EFS Revoked Key Agent can be used on the computer to recover the information

  C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information

  D. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information

  Correct Answer: C

• Question 277:

  Why would a company issue a dongle with the software they sell?

  A. To provide source code protection

  B. To provide wireless functionality with the software

  C. To provide copyright protection

  D. To ensure that keyloggers cannot be used

  Correct Answer: C

• Question 278:

  You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?

  A. Copyright law

  B. Brandmark law

  C. Trademark law

  D. Printright law

  Correct Answer: C

• Question 279:

  What is the target host IP in the following command? C:\> firewalk -F 80 10.10.150.1 172.16.28.95 -p UDP

  A. 10.10.150.1

  B. This command is using FIN packets, which cannot scan target hosts

  C. Firewalk does not scan target hosts

  D. 172.16.28.95

  Correct Answer: D

• Question 280:

  George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

  A. src port 23 and dst port 23

  B. src port 22 and dst port 22

  C. udp port 22 and host 172.16.28.1/24

  D. net port 22

  Correct Answer: B