EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 131:

  With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ______

  B. 1

  C. 10

  D. 100

  Correct Answer: A

• Question 132:

  Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

  A. CVE

  B. IANA

  C. RIPE

  D. APIPA

  Correct Answer: A

• Question 133:

  What stage of the incident handling process involves reporting events?

  A. Containment

  B. Follow-up

  C. Identification

  D. Recovery

  Correct Answer: C

• Question 134:

  While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h.?What does this indicate on the computer?replaced by the hex code byte ?5h.?What does this indicate on the computer?

  A. The files have been marked as hidden

  B. The files have been marked for deletion

  C. The files are corrupt and cannot be recovered

  D. The files have been marked as read-only

  Correct Answer: B

• Question 135:

  Kyle is performing the final testing of an application he developed for the accounting department. His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command. What is he testing at this point? #include #include int main(int argc, char *argv[]) { char buffer[10]; if (argc < 2) { fprintf (stderr, "USAGE: %s string\n", argv[0]); return 1; } strcpy(buffer, argv[1]); return 0; }

  A. SQL injection

  B. Format string bug

  C. Buffer overflow

  D. Kernal injection

  Correct Answer: C

• Question 136:

  What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

  A. Fraggle

  B. Smurf scan

  C. SYN flood

  D. Teardrop

  Correct Answer: A

• Question 137:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question wheather evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. Sign a statement attesting that the evidence is the same as it was when it entered the lab

  B. There is no reason to worry about this possible claim because state labs are certified

  C. Make MD5 hashes of the evidence and compare it to the standard database developed by NIST

  D. Make MD5 hashes of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

  Correct Answer: D

• Question 138:

  Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet?

  A. Poison the switch's MAC address table by flooding it with ACK bits

  B. Crash the switch with aDoS attack since switches cannot send ACK bits

  C. Enable tunneling feature on the switch

  D. Trick the switch into thinking it already has a session with Terri's computer

  Correct Answer: D

• Question 139:

  What file structure database would you expect to find on floppy disks?

  A. NTFS

  B. FAT32

  C. FAT16

  D. FAT12

  Correct Answer: D

• Question 140:

  When reviewing web logs, you see an entry for esource not found?in the HTTP status code field. What is the actual error code that you wouldWhen reviewing web logs, you see an entry for ?esource not found?in the HTTP status code field. What is the actual error code that you would see in the log for esource not found?see in the log for ?esource not found?

  A. 202

  B. 404

  C. 606

  D. 999

  Correct Answer: B