EC-COUNCIL EC-COUNCIL Certifications EC0-349 Questions & Answers

• Question 51:

  What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?

  A. Internet service provider information

  B. E-mail header

  C. Username and password

  D. Firewall log

  Correct Answer: B

• Question 52:

  The use of warning banners helps a company avoid litigation by overcoming an employee assumed __________________________. When connecting to the company's intranet, network or Virtual Private Network(VPN) and will allow the company's investigators to monitor, search and retrieve information stored within the network.

  A. Right to work

  B. Right of free speech

  C. Right to Internet Access

  D. Right of Privacy

  Correct Answer: D

• Question 53:

  What does mactime, an essential part of the coroner's toolkit do?

  A. It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

  B. It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

  C. The tools scans for i-node information, which is used by other tools in the tool kit

  D. It is too specific to the MAC OS and forms a core component of the toolkit

  Correct Answer: A

• Question 54:

  A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?

  A. They examined the actual evidence on an unrelated system

  B. They attempted to implicate personnel without proof

  C. They tampered with evidence by using it

  D. They called in the FBI without correlating with the fingerprint data

  Correct Answer: C

• Question 55:

  When investigating a Windows System, it is important to view the contents of the page or swap file because:

  A. Windows stores all of the systems configuration information in this file

  B. This is file that windows use to communicate directly with Registry

  C. A Large volume of data can exist within the swap file of which the computer user has no knowledge

  D. This is the file that windows use to store the history of the last 100 commands that were run from the command line

  Correct Answer: C

• Question 56:

  Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?

  A. Connect the target media; prepare the system for acquisition; Secure the evidence; Copy the media

  B. Prepare the system for acquisition; Connect the target media; copy the media; Secure the evidence

  C. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media

  D. Secure the evidence; prepare the system for acquisition; Connect the target media; copy the media

  Correct Answer: B

• Question 57:

  When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

  A. Recycle Bin

  B. MSDOS.sys

  C. BIOS

  D. Case files

  Correct Answer: A

• Question 58:

  You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you can use to obtain the password?

  A. Limited force and library attack

  B. Brute Force and dictionary Attack

  C. Maximum force and thesaurus Attack

  D. Minimum force and appendix Attack

  Correct Answer: B

• Question 59:

  When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?

  A. 202

  B. 404

  C. 505

  D. 909

  Correct Answer: B

• Question 60:

  Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  A. Use VMware to be able to capture the data in memory and examine it

  B. Give the Operating System a minimal amount of memory, forcing it to use a swap file

  C. Create a Separate partition of several hundred megabytes and place the swap file there

  D. Use intrusion forensic techniques to study memory resident infections

  Correct Answer: C