EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 61:

  Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

  A. Civil Investigation

  B. Administrative Investigation

  C. Both Civil and Criminal Investigations

  D. Criminal Investigation

  Correct Answer: B

• Question 62:

  An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?

  A. SysAnalyzer

  B. PEiD

  C. Comodo Programs Manager

  D. Dependency Walker

  Correct Answer: B

• Question 63:

  Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

  A. NTFS

  B. FAT

  C. EXT

  D. FAT32

  Correct Answer: A

• Question 64:

  BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

  A. Information header

  B. Image data

  C. The RGBQUAD array

  D. Header

  Correct Answer: A

• Question 65:

  To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

  A. Post-investigation Phase

  B. Reporting Phase

  C. Pre-investigation Phase

  D. Investigation Phase

  Correct Answer: C

• Question 66:

  Which tool does the investigator use to extract artifacts left by Google Drive on the system?

  A. PEBrowse Professional

  B. RegScanner

  C. RAM Capturer

  D. Dependency Walker

  Correct Answer: C

• Question 67:

  Which of the following is NOT a part of pre-investigation phase?

  A. Building forensics workstation

  B. Gathering information about the incident

  C. Gathering evidence data

  D. Creating an investigation team

  Correct Answer: C

• Question 68:

  Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."

  A. Man-in-the-Middle Attack

  B. Sniffer Attack

  C. Buffer Overflow

  D. DDoS

  Correct Answer: D

• Question 69:

  Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?

  A. Microsoft Outlook

  B. Eudora

  C. Mozilla Thunderbird

  D. Microsoft Outlook Express

  Correct Answer: D

• Question 70:

  Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute in determining the addresses of data?

  A. Sectors

  B. Interface

  C. Cylinder

  D. Heads

  Correct Answer: B