EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 251:

  When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

  A. One

  B. Two

  C. Three

  D. Four

  Correct Answer: B

• Question 252:

  When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

  A. On the individual computer ARP cacheOn the individual computer? ARP cache

  B. In the Web Server log files

  C. In the DHCP Server log files

  D. There is no way to determine the specific IP address

  Correct Answer: C

• Question 253:

  What method of copying should always be performed first before carrying out an investigation?

  A. Parity-bit copy

  B. Bit-stream copy

  C. MS-DOS disc copy

  D. System level copy

  Correct Answer: B

• Question 254:

  You are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect house after aYou are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect? house after a warrant was obtained and they located a floppy disk in the suspect bedroom. The disk contains several files, but they appear to be passwordwarrant was obtained and they located a floppy disk in the suspect? bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you could use to obtain the password?

  A. Limited force and library attack

  B. Brute force and dictionary attack

  C. Maximum force and thesaurus attack

  D. Minimum force and appendix attack

  Correct Answer: B

• Question 255:

  When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn? denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?

  A. The year the evidence was taken

  B. The sequence number for the parts of the same exhibit

  C. The initials of the forensics analyst

  D. The sequential number of the exhibits seized

  Correct Answer: D

• Question 256:

  What advantage does the tool Evidor have over the built-in Windows search?

  A. It can find deleted files even after they have been physically removed

  B. It can find bad sectors on the hard drive

  C. It can search slack space

  D. It can find files hidden within ADS

  Correct Answer: C

• Question 257:

  During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

  A. C:\Program Files\Exchsrvr\servername.log

  B. D:\Exchsrvr\Message Tracking\servername.log

  C. C:\Exchsrvr\Message Tracking\servername.log

  D. C:\Program Files\Microsoft Exchange\srvr\servername.log

  Correct Answer: A

• Question 258:

  A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file?its contents. The picture? quality is not degraded at all from this process. What kind of picture is this file?

  A. Raster image

  B. Vector image

  C. Metafile image

  D. Catalog image

  Correct Answer: B

• Question 259:

  Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

  A. Two

  B. One

  C. Three

  D. Four

  Correct Answer: A

• Question 260:

  The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term?

  A. Detection

  B. Hearsay

  C. Spoliation

  D. Discovery

  Correct Answer: D