EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 141:

  When examining a file with a Hex Editor, what space does the file header occupy?

  A. the last several bytes of the file

  B. the first several bytes of the file

  C. none, file headers are contained in the FAT

  D. one byte at the beginning of the file

  Correct Answer: D

• Question 142:

  In the context of file deletion process, which of the following statement holds true?

  A. When files are deleted, the data is overwritten and the cluster marked as available

  B. The longer a disk is in use, the less likely it is that deleted files will be overwritten

  C. While booting, the machine may create temporary files that can delete evidence

  D. Secure delete programs work by completely overwriting the file in one go

  Correct Answer: C

• Question 143:

  A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

  A. Image the disk and try to recover deleted files

  B. Seek the help of co-workers who are eye-witnesses

  C. Check the Windows registry for connection data (you may or may not recover)

  D. Approach the websites for evidence

  Correct Answer: A

• Question 144:

  You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?

  A. Web bug

  B. CGI code

  C. Trojan.downloader

  D. Blind bug

  Correct Answer: A

• Question 145:

  You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

  A. 0:1000, 150

  B. 0:1709, 150

  C. 1:1709, 150

  D. 0:1709-1858

  Correct Answer: B

• Question 146:

  A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

  03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84 Len: 64 01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................ 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................ 00 00 00 11 00 00 00 00 ........ =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8

  A. The attacker has conducted a network sweep on port 111

  B. The attacker has scanned and exploited the system using Buffer Overflow

  C. The attacker has used a Trojan on port 32773

  D. The attacker has installed a backdoor

  Correct Answer: A

• Question 147:

  When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?

  A. RIM Messaging center

  B. Blackberry Enterprise server

  C. Microsoft Exchange server

  D. Blackberry desktop redirector

  Correct Answer: C

• Question 148:

  What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

  A. Fraggle

  B. Smurf scan

  C. SYN flood

  D. Teardrop

  Correct Answer: A

• Question 149:

  How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

  A. 16

  B. 32

  C. 64

  D. 48

  Correct Answer: B

• Question 150:

  When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

  A. Title 18, Section 1030

  B. Title 18, Section 2703(d)

  C. Title 18, Section Chapter 90

  D. Title 18, Section 2703(f)

  Correct Answer: D