EC-COUNCIL EC-COUNCIL Certifications 312-49V10 Questions & Answers

• Question 731:

  You should always work with original evidence

  A. True

  B. False

  Correct Answer: B

• Question 732:

  When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.

  A. Lost clusters

  B. Bad clusters

  C. Empty clusters

  D. Unused clusters

  Correct Answer: A

• Question 733:

  You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

  A. HKEY_USERS

  B. HKEY_LOCAL_ADMIN

  C. HKEY_CLASSES_ADMIN

  D. HKEY_CLASSES_SYSTEM

  Correct Answer: A

• Question 734:

  Which is not a part of environmental conditions of a forensics lab?

  A. Large dimensions of the room

  B. Good cooling system to overcome excess heat generated by the work station

  C. Allocation of workstations as per the room dimensions

  D. Open windows facing the public road

  Correct Answer: D

• Question 735:

  Digital photography helps in correcting the perspective of the Image which Is used In taking the measurements of the evidence. Snapshots of the evidence and incident-prone areas need to be taken to help in the forensic process. Is digital photography accepted as evidence in the court of law?

  A. Yes

  B. No

  Correct Answer: A

• Question 736:

  Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?

  A. Sample banners are used to record the system activities when used by the unauthorized user

  B. In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring

  C. The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken

  D. At the time of seizing process, you need to shut down the computer immediately

  Correct Answer: D

• Question 737:

  What document does the screenshot represent?

  

  A. Chain of custody form

  B. Search warrant form

  C. Evidence collection form

  D. Expert witness form

  Correct Answer: A

• Question 738:

  Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible.

  A. True

  B. False

  Correct Answer: A

• Question 739:

  Hard disk data addressing is a method of allotting addresses to each ___________of data on a hard disk

  A. Physical block

  B. Logical block

  C. Operating system block

  D. Hard disk block

  Correct Answer: A

• Question 740:

  The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data.

  A. True

  B. False

  Correct Answer: B