EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 171:

  This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.

  A. Civil litigation testimony

  B. Expert testimony

  C. Victim advocate testimony

  D. Technical testimony

  Correct Answer: D

• Question 172:

  On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

  A. SAM

  B. AMS

  C. Shadow file

  D. Password.conf

  Correct Answer: A

• Question 173:

  Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

  A. The data is still present until the original location of the file is used

  B. The data is moved to the Restore directory and is kept there indefinitely

  C. The data will reside in the L2 cache on a Windows computer until it is manually deleted

  D. It is not possible to recover data that has been emptied from the Recycle Bin

  Correct Answer: A

• Question 174:

  When is it appropriate to use computer forensics?

  A. If copyright and intellectual property theft/misuse has occurred

  B. If employees do not care for their boss management techniques

  C. If sales drop off for no apparent reason for an extended period of time

  D. If a financial institution is burglarized by robbers

  Correct Answer: A

• Question 175:

  Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison lawyer trying to prove the police violated?

  A. The 10th Amendment

  B. The 5th Amendment

  C. The 1st Amendment

  D. The 4th Amendment

  Correct Answer: D

• Question 176:

  Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

  A. Search for disk errors within an image file

  B. Backup a disk to an image file

  C. Copy a partition to an image file

  D. Restore a disk from an image file

  Correct Answer: D

• Question 177:

  A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

  

  What can the investigator infer from the screenshot seen below?

  A. A smurf attack has been attempted

  B. A denial of service has been attempted

  C. Network intrusion has occurred

  D. Buffer overflow attempt on the firewall.

  Correct Answer: C

• Question 178:

  When investigating a wireless attack, what information can be obtained from the DHCP logs?

  A. The operating system of the attacker and victim computers

  B. IP traffic between the attacker and the victim

  C. MAC address of the attacker

  D. If any computers on the network are running in promiscuous mode

  Correct Answer: C

• Question 179:

  Which program is the bootloader when Windows XP starts up?

  A. KERNEL.EXE

  B. NTLDR

  C. LOADER

  D. LILO

  Correct Answer: B

• Question 180:

  What encryption technology is used on Blackberry devices Password Keeper?

  A. 3DES

  B. AES

  C. Blowfish

  D. RC5

  Correct Answer: B