EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 51:

  Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID “WIN-ABCDE12345F.” Which of the following log file will help Shane in tracking all the client connections and activities performed on the database server?

  A. WIN-ABCDE12345F.err

  B. WIN-ABCDE12345F-bin.n

  C. WIN-ABCDE12345F.pid

  D. WIN-ABCDE12345F.log

  Correct Answer: D

• Question 52:

  What must an attorney do first before you are called to testify as an expert?

  A. Qualify you as an expert witness

  B. Read your curriculum vitae to the jury

  C. Engage in damage control

  D. Prove that the tools you used to conduct your examination are perfect

  Correct Answer: A

• Question 53:

  Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

  A. ff d8 ff

  B. 25 50 44 46

  C. d0 0f 11 e0

  D. 50 41 03 04

  Correct Answer: A

• Question 54:

  Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

  A. A text file deleted from C drive in sixth sequential order

  B. A text file deleted from C drive in fifth sequential order

  C. A text file copied from D drive to C drive in fifth sequential order

  D. A text file copied from C drive to D drive in fifth sequential order

  Correct Answer: B

• Question 55:

  Andie, a network administrator, suspects unusual network services running on a windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?

  A. net serv

  B. netmgr

  C. lusrmgr

  D. net start

  Correct Answer: D

• Question 56:

  You are assigned a task to examine the log files pertaining to MyISAM storage engine. While examining, you are asked to perform a recovery operation on a MyISAM log file. Which among the following MySQL Utilities allow you to do so?

  A. mysqldump

  B. myisamaccess

  C. myisamlog D. myisamchk

  Correct Answer: C

• Question 57:

  Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?

  A. OpenGL/ES and SGL

  B. Surface Manager

  C. Media framework

  D. WebKit

  Correct Answer: A

• Question 58:

  Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

  A. Speculation or opinion as to the cause of the incident

  B. Purpose of the report

  C. Author of the report

  D. Incident summary

  Correct Answer: A

• Question 59:

  A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect's available information but without any success. Which of the following tool can help the investigator to solve this issue?

  A. Cain and Abel

  B. Xplico

  C. Recuva

  D. Colasoft's Capsa

  Correct Answer: A

• Question 60:

  Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

  A. Tokenmon

  B. PSLoggedon

  C. TCPView

  D. Process Monitor

  Correct Answer: B