EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 361:

  You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

  A. Throw the hard disk into the fire

  B. Run the powerful magnets over the hard disk

  C. Format the hard disk multiple times using a low level disk utility

  D. Overwrite the contents of the hard disk with Junk data

  Correct Answer: AC

• Question 362:

  Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

  A. A disk imaging tool would check for CRC32s for internal self checking and validation and have MD5 checksum

  B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file

  C. A simple DOS copy will not include deleted files, file slack and other information

  D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

  Correct Answer: C

• Question 363:

  Lance wants to place a honeypot on his network. Which of the following would be your recommendations?

  A. Use a system that has a dynamic addressing on the network

  B. Use a system that is not directly interacing with the router

  C. Use it on a system in an external DMZ in front of the firewall

  D. It doesn't matter as all replies are faked

  Correct Answer: D

• Question 364:

  Before performing a logical or physical search of a drive in Encase, what must be added to the program?

  A. File signatures

  B. Keywords

  C. Hash sets

  D. Bookmarks

  Correct Answer: B

• Question 365:

  If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  A. The system has been compromised using a t0rnrootkit

  B. The system administrator has created an incremental backup

  C. The system files have been copied by a remote attacker

  D. Nothing in particular as these can be operational files

  Correct Answer: D

• Question 366:

  As a CHFI professional, which of the following is the most important to your professional reputation?

  A. Your Certifications

  B. The correct, successful management of each and every case

  C. The free that you charge

  D. The friendship of local law enforcement officers

  Correct Answer: B

• Question 367:

  A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

  A. Mere Suspicion

  B. A preponderance of the evidence

  C. Probable cause

  D. Beyond a reasonable doubt

  Correct Answer: C

• Question 368:

  You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:

  http://172.168.4.131/level/99/exec/show/config

  After typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

  A. URL Obfuscation Arbitrary Administrative Access Vulnerability

  B. HTML Configuration Arbitrary Administrative Access Vulnerability

  C. Cisco IOS Arbitrary Administrative Access Online Vulnerability

  D. HTTP Configuration Arbitrary Administrative Access Vulnerability

  Correct Answer: D

• Question 369:

  You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

  A. Stringsearch

  B. grep

  C. dir

  D. vim

  Correct Answer: B

• Question 370:

  In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

  A. Security Administrator

  B. Network Administrator

  C. Director of Information Technology

  D. Director of Administration

  Correct Answer: B