EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 31:

  Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.

  A. Waffen FS

  B. RuneFS

  C. FragFS

  D. Slacker

  Correct Answer: D

• Question 32:

  Tasklist command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following tasklist commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

  A. tasklist /p

  B. tasklist /v

  C. tasklist /u

  D. tasklist /s

  Correct Answer: B

• Question 33:

  The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

  A. http://victim.com/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..% c0% af../..%c0%af../winnt/system32/cmd.exe?/c+dir+C:\Winnt\system32\Logfiles\W3SVC1

  B. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/ home/live/ap/htdocs/test

  C. 127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326 D. 127.0.0.1 - - [10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0" 200 2326

  Correct Answer: B

• Question 34:

  Gary, a computer technician, is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation does this case require?

  A. Administrative Investigation

  B. Criminal Investigation

  C. Both Criminal and Administrative Investigation

  D. Civil Investigation

  Correct Answer: B

• Question 35:

  Rusty, a computer forensics apprentice, uses the command nbtstat –c while analyzing the network information in a suspect system. What information is he looking for?

  A. Contents of the network routing table

  B. Status of the network carrier

  C. Contents of the NetBIOS name cache

  D. Network connections

  Correct Answer: C

• Question 36:

  An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:

  A. Type Allocation Code (TAC)

  B. Integrated Circuit Code (ICC)

  C. Manufacturer Identification Code (MIC)

  D. Device Origin Code (DOC)

  Correct Answer: A

• Question 37:

  Which of the following is NOT an anti-forensics technique?

  A. Data Deduplication

  B. Steganography

  C. Encryption

  D. Password Protection

  Correct Answer: A

• Question 38:

  When analyzing logs, it is important that the clocks of all the network devices are synchronized. Which protocol will help in synchronizing these clocks?

  A. UTC

  B. PTP

  C. Time Protocol

  D. NTP

  Correct Answer: D

• Question 39:

  Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization's DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry keys will Smith check to find the above information?

  A. TypedURLs key

  B. MountedDevices key

  C. UserAssist Key

  D. RunMRU key

  Correct Answer: D

• Question 40:

  Which of the following is a MAC-based File Recovery Tool?

  A. VirtualLab

  B. GetDataBack

  C. Cisdem DataRecovery 3

  D. Smart Undeleter

  Correct Answer: C