EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 191:

  Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America. What crime should Julie focus on?

  A. Physical theft

  B. Copyright infringement

  C. Industrial espionage

  D. Denial of Service attacks

  Correct Answer: C

• Question 192:

  A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?

  A. Blu-Ray single-layer

  B. HD-DVD

  C. Blu-Ray dual-layer

  D. DVD-18

  Correct Answer: C

• Question 193:

  Steven has been given the task of designing a computer forensics lab for the company he works for. He has found documentation on all aspects of how to design a lab except the number of exits needed. How many exits should Steven include in his design for the computer forensics lab?

  A. Three

  B. One

  C. Two

  D. Four

  Correct Answer: B

• Question 194:

  You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?

  A. Network

  B. Transport

  C. Data Link

  D. Session

  Correct Answer: A

• Question 195:

  When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?

  A. FF D8 FF E0 00 10

  B. FF FF FF FF FF FF

  C. FF 00 FF 00 FF 00

  D. EF 00 EF 00 EF 00

  Correct Answer: A

• Question 196:

  Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.

  

  He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

  A. Those connections are established

  B. Those connections are in listening mode

  C. Those connections are in closed/waiting mode

  D. Those connections are in timed out/waiting mode

  Correct Answer: B

• Question 197:

  How often must a company keep log files for them to be admissible in a court of law?

  A. All log files are admissible in court no matter their frequency

  B. Weekly

  C. Monthly

  D. Continuously

  Correct Answer: D

• Question 198:

  What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

  A. NTOSKRNL.EXE

  B. NTLDR

  C. LSASS.EXE

  D. NTDETECT.COM

  Correct Answer: A

• Question 199:

  John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents?

  A. Strip-cut shredder

  B. Cross-cut shredder

  C. Cross-hatch shredder

  D. Cris-cross shredder

  Correct Answer: B

• Question 200:

  To check for POP3 traffic using Ethereal, what port should an investigator search by?

  A. 143

  B. 25

  C. 110

  D. 125

  Correct Answer: C