EC-COUNCIL 312-49V8 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V8 Online Questions & Answers

• Question 1:

  Router log files provide detailed Information about the network traffic on the Internet. It gives information about the attacks to and from the networks. The router stores log files in the____________.

  A. Router cache
  B. Application logs
  C. IDS logs
  D. Audit logs
  A. Router cache

• Question 2:

  What is the smallest allocation unit of a hard disk?

  A. Cluster
  B. Spinning tracks
  C. Disk platters
  D. Slack space
  A. Cluster

• Question 3:

  Tracks numbering on a hard disk begins at 0 from the outer edge and moves towards the center, typically reaching a value of ___________.

  A. 1023
  B. 1020
  C. 1024
  D. 2023
  A. 1023

• Question 4:

  Which of the following password cracking techniques works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

  A. Brute forcing attack
  B. Hybrid attack
  C. Syllable attack
  D. Rule-based attack
  B. Hybrid attack

• Question 5:

  First responder is a person who arrives first at the crime scene and accesses the victim's computer system after the incident. He or She is responsible for protecting, integrating, and preserving the evidence obtained from the crime scene. Which of the following is not a role of first responder?

  A. Identify and analyze the crime scene
  B. Protect and secure the crime scene
  C. Package and transport the electronic evidence to forensics lab
  D. Prosecute the suspect in court of law
  D. Prosecute the suspect in court of law

• Question 6:

  Ever-changing advancement or mobile devices increases the complexity of mobile device examinations. Which or the following is an appropriate action for the mobile forensic investigation?

  A. To avoid unwanted interaction with devices found on the scene, turn on any wireless interfaces such as Bluetooth and Wi-Fi radios
  B. Do not wear gloves while handling cell phone evidence to maintain integrity of physical evidence
  C. If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons
  D. If the phone is in a cradle or connected to a PC with a cable, then unplug the device from the computer
  C. If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons

• Question 7:

  Web applications provide an Interface between end users and web servers through a set of web pages that are generated at the server-end or contain script code to be executed dynamically within the client Web browser.

  A. True
  B. False
  A. True

• Question 8:

  What is the "Best Evidence Rule"?

  A. It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy
  B. It contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, and command history
  C. It contains hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, hidden partitions, registry settings, and event logs
  D. It contains information such as open network connection, user logout, programs that reside in memory, and cache data
  A. It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy

• Question 9:

  Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion.

  A. True
  B. False
  A. True

• Question 10:

  Buffer Overflow occurs when an application writes more data to a block of memory, or buffer, than the buffer is allocated to hold. Buffer overflow attacks allow an attacker to modify the _______________in order to control the process execution, crash the process and modify internal variables.

  A. Target process's address space
  B. Target remote access
  C. Target rainbow table
  D. Target SAM file
  A. Target process's address space