EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 101:

  A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

  A. Mere Suspicion

  B. A preponderance of the evidence

  C. Probable cause

  D. Beyond a reasonable doubt

  Correct Answer: C

• Question 102:

  Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security. The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of. What step could you take to help secure SNMP on your network?

  A. Block access to TCP port 171

  B. Change the default community string names

  C. Block all internal MAC address from using SNMP

  D. Block access to UDP port 171

  Correct Answer: B

• Question 103:

  In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

  A. Security Administrator

  B. Network Administrator

  C. Director of Information Technology

  D. Director of Administration

  Correct Answer: B

• Question 104:

  You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

  A. Stringsearch

  B. grep

  C. dir

  D. vim

  Correct Answer: B

• Question 105:

  You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?

  A. allinurl:"exchange/logon.asp"

  B. intitle:"exchange server"

  C. outlook:"search"

  D. locate:"logon page"

  Correct Answer: A

• Question 106:

  What operating system would respond to the following command? C:\> nmap -sW 10.10.145.65

  A. Windows XP

  B. Mac OS X

  C. FreeBSD

  D. Windows 95

  Correct Answer: C

• Question 107:

  Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers. Bill protects the PDF documents with a password and sends them to their intended recipients. Why PDF passwords do not offer maximum protection?

  A. PDF passwords are converted to clear text when sent through E-mail

  B. PDF passwords are not considered safe by Sarbanes-Oxley

  C. When sent through E-mail, PDF passwords are stripped from the document completely

  D. PDF passwords can easily be cracked by software brute force tools

  Correct Answer: D

• Question 108:

  Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

  A. Point-to-point

  B. End-to-end

  C. Thorough

  D. Complete event analysis

  Correct Answer: B

• Question 109:

  As a security analyst you setup a false survey website that will reQuire users to create a username and a

  strong password. You send the link to all the employees of the company.

  What information will you be able to gather?

  A. The IP address of the employees computers

  B. Bank account numbers and the corresponding routing numbers

  C. The employees network usernames and passwords

  D. The MAC address of theemployees?computers

  Correct Answer: C

• Question 110:

  Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?

  A. network-based IDS systems (NIDS)

  B. host-based IDS systems (HIDS)

  C. anomaly detection

  D. signature recognition

  Correct Answer: BC