EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 161:

  Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he

  has been working on for over six months. He is trying to find the right term to use in his report to describe

  network-enabled spying.

  What term should Harold use?

  A. Spycrack

  B. Spynet

  C. Netspionage

  D. Hackspionage

  Correct Answer: C

• Question 162:

  What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

  A. Copyright

  B. Design patent

  C. Trademark

  D. Utility patent

  Correct Answer: D

• Question 163:

  Where is the startup configuration located on a router?

  A. Static RAM

  B. BootROM

  C. NVRAM

  D. Dynamic RAM

  Correct Answer: C

• Question 164:

  While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?

  A. The files have been marked as hidden

  B. The files have been marked for deletion

  C. The files are corrupt and cannot be recovered

  D. The files have been marked as read-only

  Correct Answer: B

• Question 165:

  While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?

  A. Technical material related to forensics

  B. No particular field

  C. Judging the character of defendants/victims

  D. Legal issues

  Correct Answer: B

• Question 166:

  When operating systems mark a cluster as used but not allocated, the cluster is considered as _________

  A. Corrupt

  B. Bad

  C. Lost

  D. Unallocated

  Correct Answer: C

• Question 167:

  In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

  A. Security Administrator

  B. Network Administrator

  C. Director of Information Technology

  D. Director of Administration

  Correct Answer: B

• Question 168:

  What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024

  A. Copy the master boot record to a file

  B. Copy the contents of the system folder to a file

  C. Copy the running memory to a file

  D. Copy the memory dump file to an image file

  Correct Answer: C

• Question 169:

  Before performing a logical or physical search of a drive in Encase, what must be added to the program?

  A. File signatures

  B. Keywords

  C. Hash sets

  D. Bookmarks

  Correct Answer: B

• Question 170:

  When a router receives an update for its routing table, what is the metric value change to that path?

  A. Increased by 2

  B. Decreased by 1

  C. Increased by 1

  D. Decreased by 2

  Correct Answer: C