EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 211:

  What encryption technology is used on Blackberry devices?Password Keeper?

  A. 3DES

  B. AES

  C. Blowfish

  D. RC5

  Correct Answer: B

• Question 212:

  What is the first step taken in an investigation for laboratory forensic staff members?

  A. Packaging the electronic evidence

  B. Securing and evaluating the electronic crime scene

  C. Conducting preliminary interviews

  D. Transporting the electronic evidence

  Correct Answer: B

• Question 213:

  Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate. He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT. Which firewall would be most appropriate for Harold? needs?

  A. Packet filtering firewall

  B. Circuit-level proxy firewall

  C. Application-level proxy firewall

  D. Data link layer firewall

  Correct Answer: C

• Question 214:

  George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time- based induction machine" be used. What IDS feature must George implement to meet this requirement?

  A. Pattern matching

  B. Statistical-based anomaly detection

  C. Real-time anomaly detection

  D. Signature-based anomaly detection

  Correct Answer: C

• Question 215:

  In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

  A. The change in the routing fabric to bypass the affected router

  B. More RESET packets to the affected router to get it to power back up

  C. STOP packets to all other routers warning of where the attack originated

  D. RESTART packets to the affected router to get it to power back up

  Correct Answer: A

• Question 216:

  You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

  A. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

  B. make an MD5 hash of the evidence and compare it to the standard database developed by NIST

  C. there is no reason to worry about this possible claim because state labs are certified

  D. sign a statement attesting that the evidence is the same as it was when it entered the lab

  Correct Answer: A

• Question 217:

  At what layer of the OSI model do routers function on?

  A. 4

  B. 3

  C. 1

  D. 5

  Correct Answer: B

• Question 218:

  This organization maintains a database of hash signatures for known software

  A. International Standards Organization

  B. Institute of Electrical and Electronics Engineers

  C. National Software Reference Library

  D. American National standards Institute

  Correct Answer: C

• Question 219:

  During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:

  A. Inculpatory evidence

  B. mandatory evidence

  C. exculpatory evidence

  D. Terrible evidence

  Correct Answer: C

• Question 220:

  When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________

  A. Automate collection from image files

  B. Avoiding copying data from the boot partition

  C. Acquire data from the host-protected area on a disk

  D. Prevent contamination to the evidence drive

  Correct Answer: D