EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 311:

  Tracks numbering on a hard disk begins at 0 from the outer edge and moves towards the center, typically reaching a value of ___________.

  A. 1023

  B. 1020

  C. 1024

  D. 2023

  Correct Answer: A

• Question 312:

  Quality of a raster Image is determined by the _________________and the amount of information in each pixel.

  A. Total number of pixels

  B. Image file format

  C. Compression method

  D. Image file size

  Correct Answer: A

• Question 313:

  Ever-changing advancement or mobile devices increases the complexity of mobile device examinations. Which or the following is an appropriate action for the mobile forensic investigation?

  A. To avoid unwanted interaction with devices found on the scene, turn on any wireless interfaces such as Bluetooth and Wi-Fi radios

  B. Do not wear gloves while handling cell phone evidence to maintain integrity of physical evidence

  C. If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons

  D. If the phone is in a cradle or connected to a PC with a cable, then unplug the device from the computer

  Correct Answer: C

• Question 314:

  Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader?

  A. Open code steganography

  B. Visual semagrams steganography

  C. Text semagrams steganography

  D. Technical steganography

  Correct Answer: A

• Question 315:

  Which of the following approaches checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

  A. Graph-based approach

  B. Neural network-based approach

  C. Rule-based approach

  D. Automated field correlation approach

  Correct Answer: D

• Question 316:

  The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin.

  What is the size limit for Recycle Bin in Vista and later versions of the Windows?

  A. No size limit

  B. Maximum of 3.99 GB

  C. Maximum of 4.99 GB

  D. Maximum of 5.99 GB

  Correct Answer: A

• Question 317:

  When collecting evidence from the RAM, where do you look for data?

  A. Swap file

  B. SAM file

  C. Data file

  D. Log file

  Correct Answer: A

• Question 318:

  A system with a simple logging mechanism has not been given much attention during development, this system is now being targeted by attackers, if the attacker wants to perform a new line injection attack, what will he/she inject into the log file?

  A. Plaintext

  B. Single pipe character

  C. Multiple pipe characters

  D. HTML tags

  Correct Answer: A

• Question 319:

  P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails.

  A. Port 109

  B. Port 110

  C. Port 115

  D. Port 123

  Correct Answer: B

• Question 320:

  When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code

  A. First 12

  B. First 16

  C. First 22

  D. First 24

  Correct Answer: B