EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 151:

  Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

  A. Windows computers will not respond to idle scans

  B. Linux/Unix computers are easier to compromise

  C. Windows computers are constantly talking

  D. Linux/Unix computers are constantly talking

  Correct Answer: C

• Question 152:

  What will the following URL produce in an unpatched IIS Web Server? http://www.thetargetsite.com/

  scripts/..%

  co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\

  A. Directory listing of C: drive on the web server

  B. Execute a buffer flow in the C: drive of the web server

  C. Directory listing of the C:\windows\system32 folder on the web server

  D. Insert a Trojan horse into the C: drive of the web server

  Correct Answer: A

• Question 153:

  When investigating a Windows System, it is important to view the contents of the page or swap file because:

  A. Windows stores all of the systems configuration information in this file

  B. This is file that windows use to communicate directly with Registry

  C. A Large volume of data can exist within the swap file of which the computer user has no knowledge

  D. This is the file that windows use to store the history of the last 100 commands that were run from the command line

  Correct Answer: C

• Question 154:

  What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

  A. ARP redirect

  B. Physical attack

  C. Digital attack

  D. Denial of service

  Correct Answer: D

• Question 155:

  What TCP/UDP port does the toolkit program netstat use?

  A. Port 7

  B. Port 15

  C. Port 23

  D. Port 69

  Correct Answer: B

• Question 156:

  A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?

  A. They examined the actual evidence on an unrelated system

  B. They attempted to implicate personnel without proof

  C. They tampered with evidence by using it

  D. They called in the FBI without correlating with the fingerprint data

  Correct Answer: C

• Question 157:

  When investigating a potential e-mail crime, what is your first step in the investigation?

  A. Trace the IP address to its origin

  B. Write a report

  C. Determine whether a crime was actually committed

  D. Recover the evidence

  Correct Answer: A

• Question 158:

  When examining the log files from a Windows IIS Web Server, how often is a new log file created?

  A. the same log is used at all times

  B. a new log file is created everyday

  C. a new log file is created each week

  D. a new log is created each time the Web Server is started

  Correct Answer: B

• Question 159:

  Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?

  A. Send DOS commands to crash the DNS servers

  B. Perform DNS poisoning

  C. Enumerate all the users in the domain

  D. Perform a zone transfer

  Correct Answer: D

• Question 160:

  To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software ?

  A. Computer Forensics Tools and Validation Committee (CFTVC)

  B. Association of Computer Forensics Software Manufactures (ACFSM)

  C. National Institute of Standards and Technology (NIST)

  D. Society for Valid Forensics Tools and Testing (SVFTT)

  Correct Answer: C