EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 21:

  When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?

  A. File Size

  B. File origin and modification

  C. Time and date of deletion

  D. File Name

  Correct Answer: B

• Question 22:

  Raw data acquisition format creates _________ of a data set or suspect drive.

  A. Segmented image files

  B. Simple sequential flat files

  C. Compressed image files

  D. Segmented files

  Correct Answer: B

• Question 23:

  Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob's testimony in this case?

  A. Certification

  B. Justification

  C. Reiteration

  D. Authentication

  Correct Answer: D

• Question 24:

  Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

  A. Mime-Version header

  B. Content-Type header

  C. Content-Transfer-Encoding header

  D. Errors-To header

  Correct Answer: D

• Question 25:

  What malware analysis operation can the investigator perform using the jv16 tool?

  A. Files and Folder Monitor

  B. Installation Monitor

  C. Network Traffic Monitoring/Analysis

  D. Registry Analysis/Monitoring

  Correct Answer: D

• Question 26:

  Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

  A. Same-platform correlation

  B. Network-platform correlation

  C. Cross-platform correlation

  D. Multiple-platform correlation

  Correct Answer: C

• Question 27:

  Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.

  A. Physical block

  B. Operating system block

  C. Hard disk block

  D. Logical block

  Correct Answer: A

• Question 28:

  Which of the following standard represents a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases?

  A. SWGDE and SWGIT

  B. Daubert

  C. Frye

  D. IOCE

  Correct Answer: C

• Question 29:

  Which one of the following is not a first response procedure?

  A. Preserve volatile data

  B. Fill forms

  C. Crack passwords

  D. Take photos

  Correct Answer: C

• Question 30:

  Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

  A. 8-bit

  B. 32-bit

  C. 16-bit

  D. 24-bit

  Correct Answer: A