EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 301:

  An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

  A. Smurf

  B. Ping of death

  C. Fraggle

  D. Nmap scan

  Correct Answer: B

• Question 302:

  An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are _________ media used to store large amounts of data and are not affected by the magnet.

  A. Magnetic

  B. Optical

  C. Anti-Magnetic

  D. Logical

  Correct Answer: B

• Question 303:

  When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

  A. Write-blocker

  B. Protocol analyzer

  C. Firewall

  D. Disk editor

  Correct Answer: A

• Question 304:

  What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

  A. NTOSKRNL.EXE

  B. NTLDR

  C. LSASS.EXE

  D. NTDETECT.COM

  Correct Answer: C

• Question 305:

  Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated. When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?

  A. IT personnel

  B. Employees themselves

  C. Supervisors

  D. Administrative assistant in charge of writing policies

  Correct Answer: C

• Question 306:

  The following is a log file screenshot from a default installation of IIS 6.0.

  

  What time standard is used by IIS as seen in the screenshot?

  A. UTC

  B. GMT

  C. TAI

  D. UT

  Correct Answer: A

• Question 307:

  If the partition size Is 4 GB, each cluster will be 32 K. Even If a file needs only 10 K, the entire 32 K will be allocated, resulting In 22 K of___________.

  A. Slack space

  B. Deleted space

  C. Cluster space

  D. Sector space

  Correct Answer: A

• Question 308:

  The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin.

  Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

  A. INFO2 file

  B. INFO1 file

  C. LOGINFO2 file

  D. LOGINFO1 file

  Correct Answer: A

• Question 309:

  Which of the following commands shows you the NetBIOS name table each?

  A. nbtstat -n

  B. nbtstat -c

  C. nbtstat -r

  D. nbtstat -s

  Correct Answer: A

• Question 310:

  Operating System logs are most beneficial for Identifying or Investigating suspicious activities involving a particular host. Which of the following Operating System logs contains information about operational actions performed by OS components?

  A. Event logs

  B. Audit logs

  C. Firewall logs

  D. IDS logs

  Correct Answer: A