EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 291:

  When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?

  A. FF D8 FF E0 00 10

  B. FF FF FF FF FF FF

  C. FF 00 FF 00 FF 00

  D. EF 00 EF 00 EF 00

  Correct Answer: A

• Question 292:

  What does the acronym POST mean as it relates to a PC?

  A. Power On Self Test

  B. Pre Operational Situation Test

  C. Primary Operating System Test

  D. Primary Operations Short Test

  Correct Answer: A

• Question 293:

  What is the CIDR from the following screenshot?

  

  A. /24A./24A./24

  B. /32 B./32 B./32

  C. /16 C./16 C./16

  D. /8D./8D./8

  Correct Answer: D

• Question 294:

  In the following directory listing, which file should be used to restore archived email messages for someone using Microsoft Outlook?

  

  A. Outlook bak

  B. Outlook ost

  C. Outlook NK2

  D. Outlook pst

  Correct Answer: D

• Question 295:

  George was recently fired from his job as an IT analyst at Pitts and Company in Dallas Texas. His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company network by cracking some ofcompany? Active Directory structure and to create network polices. George now wants to break into the company? network by cracking some of the service accounts he knows about. Which password cracking technique should George use in this situation?

  A. Brute force attack

  B. Syllable attack

  C. Rule-based attack

  D. Dictionary attack

  Correct Answer: C

• Question 296:

  Where does Encase search to recover NTFS files and folders?

  A. MBR

  B. MFT

  C. Slack space

  D. HAL

  Correct Answer: B

• Question 297:

  When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

  A. All virtual memory will be deleted

  B. The wrong partition may be set to active

  C. This action can corrupt the disk

  D. The computer will be set in a constant reboot state

  Correct Answer: C

• Question 298:

  The offset in a hexadecimal code is:

  A. The 0x at the beginning of the code

  B. The 0x at the end of the code

  C. The first byte after the colon

  D. The last byte after the colon

  Correct Answer: A

• Question 299:

  When should an MD5 hash check be performed when processing evidence?

  A. After the evidence examination has been completed

  B. On an hourly basis during the evidence examination

  C. Before and after evidence examination

  D. Before the evidence examination has been completed

  Correct Answer: C

• Question 300:

  What must be obtained before an investigation is carried out at a location?

  A. Search warrant

  B. Subpoena

  C. Habeas corpus

  D. Modus operandi

  Correct Answer: A