EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 191:

  It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

  A. by law, three

  B. quite a few

  C. only one

  D. at least two

  Correct Answer: C

• Question 192:

  A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.

  A. Image the disk and try to recover deleted files

  B. Seek the help of co-workers who are eye-witnesses

  C. Check the Windows registry for connection data (You may or may not recover)

  D. Approach the websites for evidence

  Correct Answer: A

• Question 193:

  Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to google.com and types in the following search. link:www.ghttech.net What will this search produce?

  A. All search engines that link to .net domains

  B. All sites that link to ghttech.net

  C. Sites that contain the code: link:www.ghttech.net

  D. All sites that ghttech.net links to

  Correct Answer: B

• Question 194:

  When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

  A. Hard Drive Failure

  B. Scope Creep

  C. Unauthorized expenses

  D. Overzealous marketing

  Correct Answer: B

• Question 195:

  Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?

  A. Spycrack

  B. Spynet

  C. Netspionage

  D. Hackspionage

  Correct Answer: C

• Question 196:

  You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

  A. Demonstrate that no system can be protected againstDoS attacks

  B. List weak points on their network

  C. Show outdatedeQuipment so it can be replaced

  D. Use attack as a launching point to penetrate deeper into the network

  Correct Answer: B

• Question 197:

  If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

  A. 31402

  B. The zombie will not send a response

  C. 31401

  D. 31399

  Correct Answer: C

• Question 198:

  You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?

  A. Passwords of 14 characters or less are broken up into two 7-character hashes

  B. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network

  C. Networks using Active Directory never use SAM databases so the SAM database pulled was empty

  D. The passwords that were cracked are local accounts on the Domain Controller

  Correct Answer: A

• Question 199:

  If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  A. The system files have been copied by a remote attacker

  B. The system administrator has created an incremental backup

  C. The system has been compromised using a t0rn rootkit

  D. Nothing in particular as these can be operational files

  Correct Answer: C

• Question 200:

  In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

  A. evidence must be handled in the same way regardless of the type of case

  B. evidence procedures are not important unless you work for a law enforcement agency

  C. evidence in a criminal case must be secured more tightly than in a civil case

  D. evidence in a civil case must be secured more tightly than in a criminal case

  Correct Answer: C