EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 281:

  When using an iPod and the host computer is running Windows, what file system will be used?

  A. iPod+

  B. HFS

  C. FAT16

  D. FAT32

  Correct Answer: D

• Question 282:

  What is the slave device connected to the secondary IDE controller on a Linux OS referred to?

  A. hda

  B. hdd

  C. hdb

  D. hdc

  Correct Answer: B

• Question 283:

  What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

  A. Cracks every password in 10 minutes

  B. Distribute processing over 16 or fewer computers

  C. Support for Encrypted File System

  D. Support for MD5 hash verification

  Correct Answer: B

• Question 284:

  To check for POP3 traffic using Ethereal, what port should an investigator search by?

  A. 143

  B. 25

  C. 110

  D. 125

  Correct Answer: C

• Question 285:

  Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

  A. Text semagram

  B. Visual semagram

  C. Grill cipher

  D. Visual cipher

  Correct Answer: B

• Question 286:

  Where is the default location for Apache access logs on a Linux computer?

  A. usr/local/apache/logs/access_log

  B. bin/local/home/apache/logs/access_log

  C. usr/logs/access_log

  D. logs/usr/apache/access_log

  Correct Answer: A

• Question 287:

  Why should you never power on a computer that you need to acquire digital evidence from?

  A. When the computer boots up, files are written to the computer rendering the data nclean?When the computer boots up, files are written to the computer rendering the data ?nclean

  B. When the computer boots up, the system cache is cleared which could destroy evidence

  C. When the computer boots up, data in the memory buffer is cleared which could destroy evidenceWhen the computer boots up, data in the memory? buffer is cleared which could destroy evidence

  D. Powering on a computer has no affect when needing to acquire digital evidence from it

  Correct Answer: A

• Question 288:

  You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

  A. 70 years

  B. The life of the author

  C. The life of the author plus 70 years

  D. Copyrights last forever

  Correct Answer: C

• Question 289:

  What type of attack sends SYN requests to a target system with spoofed IP addresses?

  A. SYN flood

  B. Ping of death

  C. Cross site scripting

  D. Land

  Correct Answer: A

• Question 290:

  What is one method of bypassing a system BIOS password?

  A. Removing the processor

  B. Removing the CMOS battery

  C. Remove all the system memoryRemove all the system? memory

  D. Login to Windows and disable the BIOS password

  Correct Answer: B