EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 351:

  Shortcuts are the files with the extension .Ink that are created and are accessed by the users. These files provide you with information about:

  A. Files or network shares

  B. Running application

  C. Application logs

  D. System logs

  Correct Answer: A

• Question 352:

  How do you define forensic computing?

  A. It is the science of capturing, processing, and investigating data security incidents and making it acceptable to a court of law.

  B. It is a methodology of guidelines that deals with the process of cyber investigation

  C. It Is a preliminary and mandatory course necessary to pursue and understand fundamental principles of ethical hacking

  D. It is the administrative and legal proceeding in the process of forensic investigation

  Correct Answer: A

• Question 353:

  Determine the message length from following hex viewer record:

  

  A. 6E2F

  B. 13

  C. 27

  D. 810D

  Correct Answer: D

• Question 354:

  In Windows 7 system files, which file reads the Boot.ini file and loads Ntoskrnl.exe. Bootvid.dll. Hal.dll, and boot-start device drivers?

  A. Ntldr

  B. Gdi32.dll

  C. Kernel32.dll

  D. Boot.in

  Correct Answer: A

• Question 355:

  Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion.

  A. True

  B. False

  Correct Answer: A

• Question 356:

  All the Information about the user activity on the network, like details about login and logoff attempts, is collected in the security log of the computer. When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table.

  In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer?

  A. 528

  B. 529

  C. 530

  D. 531

  Correct Answer: A

• Question 357:

  Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time.

  Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network?

  A. Same-platform correlation

  B. Cross-platform correlation

  C. Multiple-platform correlation

  D. Network-platform correlation

  Correct Answer: B

• Question 358:

  Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack Jason can infer from his findings?

  A. DNS Poisoning

  B. Cookie Poisoning Attack

  C. DNS Redirection

  D. Session poisoning

  Correct Answer: A

• Question 359:

  Ron. a computer forensics expert, Is Investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in on condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner. Which of the following key combinations he can use to recover the IMEI number?

  A. #*06*#

  B. *#06#

  C. #06r

  D. *1MEI#

  Correct Answer: B

• Question 360:

  Physical security recommendations: There should be only one entrance to a forensics lab

  A. True

  B. False

  Correct Answer: A