EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 221:

  You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

  A. Packet filtering firewall

  B. Application-level proxy firewall

  C. Statefull firewall

  D. Circuit-level proxy firewall

  Correct Answer: C

• Question 222:

  After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?

  A. RestrictAnonymous must be set to "2" for complete security

  B. There is no way to always prevent an anonymous null session from establishing

  C. RestrictAnonymous must be set to "10" for complete security

  D. RestrictAnonymous must be set to "3" for complete security

  Correct Answer: A

• Question 223:

  Which of the following should a computer forensics lab used for investigations have?

  A. isolation

  B. restricted access

  C. open access

  D. an entry log

  Correct Answer: B

• Question 224:

  Where are files temporarily written in Unix when printing?

  A. /usr/spool

  B. /var/print

  C. /spool

  D. /var/spool

  Correct Answer: D

• Question 225:

  On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

  A. SAM

  B. AMS

  C. Shadow file

  D. Password.conf

  Correct Answer: A

• Question 226:

  ____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

  A. Network Forensics

  B. Computer Forensics

  C. Incident Response

  D. Event Reaction

  Correct Answer: B

• Question 227:

  This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

  A. Master Boot Record (MBR)

  B. Master File Table (MFT)

  C. File Allocation Table (FAT)

  D. Disk Operating System (DOS)

  Correct Answer: C

• Question 228:

  What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

  A. SD memory

  B. CF memory

  C. MMC memory

  D. SM memory

  Correct Answer: B

• Question 229:

  You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

  A. 0:1000, 150

  B. 0:1709, 150

  C. 1:1709, 150

  D. 0:1709-1858

  Correct Answer: B

• Question 230:

  You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

  A. The tool hasn't been tested by the International Standards Organization (ISO)

  B. Only the local law enforcement should use the tool

  C. The total has not been reviewed and accepted by your peers

  D. You are not certified for using the tool

  Correct Answer: C