EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 91:

  What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?

  A. ICMP header field

  B. TCP header field

  C. IP header field

  D. UDP header field

  Correct Answer: B

• Question 92:

  What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

  A. forensic duplication of hard drive

  B. analysis of volatile data

  C. comparison of MD5 checksums

  D. review of SIDs in the Registry

  Correct Answer: C

• Question 93:

  Which response organization tracks hoaxes as well as viruses?

  A. NIPC

  B. FEDCIRC

  C. CERT

  D. CIAC

  Correct Answer: D

• Question 94:

  Which of the following should a computer forensics lab used for investigations have?

  A. isolation

  B. restricted access

  C. open access

  D. an entry log

  Correct Answer: B

• Question 95:

  Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.

  Which organization coordinates computer crimes investigations throughout the United States?

  A. Internet Fraud Complaint Center

  B. Local or national office of the U.S. Secret Service

  C. National Infrastructure Protection Center

  D. CERT Coordination Center

  Correct Answer: B

• Question 96:

  Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?

  A. network-based IDS systems (NIDS)

  B. host-based IDS systems (HIDS)

  C. anomaly detection

  D. signature recognition

  Correct Answer: B

• Question 97:

  Corporate investigations are typically easier than public investigations because:

  A. the users have standard corporate equipment and software

  B. the investigator does not have to get a warrant

  C. the investigator has to get a warrant

  D. the users can load whatever they want on their machines

  Correct Answer: B

• Question 98:

  If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

  A. deltree command

  B. CMOS

  C. Boot.sys

  D. Scandisk utility

  Correct Answer: C

• Question 99:

  You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

  A. 8

  B. 1

  C. 4

  D. 2

  Correct Answer: C

• Question 100:

  When obtaining a warrant, it is important to:

  A. particularlydescribe the place to be searched and particularly describe the items to be seized

  B. generallydescribe the place to be searched and particularly describe the items to be seized

  C. generallydescribe the place to be searched and generally describe the items to be seized

  D. particularlydescribe the place to be searched and generally describe the items to be seized

  Correct Answer: A