EC-COUNCIL EC-COUNCIL Certifications 312-49V9 Questions & Answers

• Question 381:

  SMTP (Simple Mail Transfer protocol) receives outgoing mail from clients and validates source and destination addresses, and also sends and receives emails to and from other SMTP servers.

  A. True

  B. False

  Correct Answer: A

• Question 382:

  Raw data acquisition format creates ____________of a data set or suspect drive.

  A. Simple sequential flat files

  B. Segmented files

  C. Compressed image files

  D. Segmented image files

  Correct Answer: A

• Question 383:

  Which of the following statements is incorrect when preserving digital evidence?

  A. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

  B. Verily if the monitor is in on, off, or in sleep mode

  C. Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

  D. Turn on the computer and extract Windows event viewer log files

  Correct Answer: D

• Question 384:

  Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is:

  A. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion \ProfileList

  B. HKEY_LOCAL_MACHlNE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \NetworkList

  C. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentsVersion \setup

  D. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

  Correct Answer: A

• Question 385:

  When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on

  A. True

  B. False

  Correct Answer: B

• Question 386:

  Injection flaws are web application vulnerabilities that allow untrusted data to be Interpreted and executed as part of a command or query. Attackers exploit injection flaws by constructing malicious commands or queries that result in data loss or corruption, lack of accountability, or denial of access. Which of the following injection flaws involves the injection of malicious code through a web application?

  A. SQL Injection

  B. Password brute force

  C. Nmap Scanning

  D. Footprinting

  Correct Answer: A

• Question 387:

  During first responder procedure you should follow all laws while collecting the evidence, and contact a computer forensic examiner as soon as possible

  A. True

  B. False

  Correct Answer: A

• Question 388:

  Which one of the following is not a consideration in a forensic readiness planning checklist?

  A. Define the business states that need digital evidence

  B. Identify the potential evidence available

  C. Decide the procedure for securely collecting the evidence that meets the requirement fn a forensically sound manner

  D. Take permission from all employees of the organization

  Correct Answer: D

• Question 389:

  Which of the following password cracking techniques works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

  A. Brute forcing attack

  B. Hybrid attack

  C. Syllable attack

  D. Rule-based attack

  Correct Answer: B

• Question 390:

  Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software?

  A. Operating System (OS) logs

  B. Application logs

  C. Security software logs

  D. Audit logs

  Correct Answer: C