EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 391:

  In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

  A. Network Forensics

  B. Data Recovery

  C. Disaster Recovery

  D. Computer Forensics

  Correct Answer: D

• Question 392:

  How many sectors will a 125 KB file use in a FAT32 file system?

  A. 32

  B. 16

  C. 250

  D. 25

  Correct Answer: C

• Question 393:

  George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation?

  A. Nessus cannot perform wireless testing

  B. Nessus is too loud

  C. There are no ways of performing a "stealthy" wireless scan

  D. Nessus is not a network scanner

  Correct Answer: B

• Question 394:

  When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?

  A. 202

  B. 404

  C. 505

  D. 909

  Correct Answer: B

• Question 395:

  You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?

  A. Oligomorhic

  B. Transmorphic

  C. Polymorphic

  D. Metamorphic

  Correct Answer: D

• Question 396:

  Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/ usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

  A. Search for disk errors within an image file

  B. Backup a disk to an image file

  C. Copy a partition to an image file

  D. Restore a disk from an image file

  Correct Answer: D

• Question 397:

  When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

  A. Time-Sync Protocol

  B. SyncTime Service

  C. Network Time Protocol

  D. Universal Time Set

  Correct Answer: C

• Question 398:

  Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

  A. CVE

  B. IANA

  C. RIPE

  D. APIPA

  Correct Answer: A

• Question 399:

  With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ______

  B. 1

  C. 10

  D. 100

  Correct Answer: A

• Question 400:

  What stage of the incident handling process involves reporting events?

  A. Containment

  B. Follow-up

  C. Identification

  D. Recovery

  Correct Answer: C