EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 151:

  Item 2If you come across a sheepdip machine at your client site, what would you infer?

  A. A sheepdip coordinates several honeypots

  B. A sheepdip computer is another name for a honeypot

  C. A sheepdip computer is used only for virus-checking.

  D. A sheepdip computer defers a denial of service attack

  Correct Answer: C

• Question 152:

  In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

  A. rules of evidence

  B. law of probability

  C. chain of custody

  D. policy of separation

  Correct Answer: C

• Question 153:

  How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

  A. 128

  B. 64

  C. 32

  D. 16

  Correct Answer: C

• Question 154:

  When reviewing web logs, you see an entry for resource not found in the HTTP status code field. What is the actual error code that you would see in the log for resource not found?

  A. 202

  B. 404

  C. 606

  D. 999

  Correct Answer: B

• Question 155:

  What stage of the incident handling process involves reporting events?

  A. Containment

  B. Follow-up

  C. Identification

  D. Recovery

  Correct Answer: C

• Question 156:

  While looking through the IIS log file of a web server, you find the following entries:

  

  What is evident from this log file?

  A. Web bugs

  B. Cross site scripting

  C. Hidden fields

  D. SQL injection is possible

  Correct Answer: D

• Question 157:

  Why would you need to find out the gateway of a device when investigating a wireless attack?

  A. The gateway will be the IP of the proxy server used by the attacker to launch the attack

  B. The gateway will be the IP of the attacker computer

  C. The gateway will be the IP used to manage the RADIUS server

  D. The gateway will be the IP used to manage the access point

  Correct Answer: D

• Question 158:

  Using Internet logging software to investigate a case of malicious use of computers, the investigator comes across some entries that appear odd.

  

  From the log, the investigator can see where the person in question went on the Internet. From the log, it appears that the user was manually typing in different user ID numbers. What technique this user was trying?

  A. Parameter tampering

  B. Cross site scripting

  C. SQL injection

  D. Cookie Poisoning

  Correct Answer: A

• Question 159:

  Why would a company issue a dongle with the software they sell?

  A. To provide source code protection

  B. To provide wireless functionality with the software

  C. To provide copyright protection

  D. To ensure that keyloggers cannot be used

  Correct Answer: C

• Question 160:

  What feature of Windows is the following command trying to utilize?

  

  A. White space

  B. AFS

  C. ADS

  D. Slack file

  Correct Answer: C