[Mar 04, 2022] ValidDumps 312-49v10 Exam Practice Test Questions (Updated 598 Questions)
Pass EC-COUNCIL 312-49v10 Exam Info and Free Practice Test
EC-COUNCIL 312-49v10 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION 109
At what layer of the OSI model do routers function on?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 110
When investigating a wireless attack, what information can be obtained from the DHCP logs?
- A. If any computers on the network are running in promiscuous mode
- B. MAC address of the attacker
- C. IP traffic between the attacker and the victim
- D. The operating system of the attacker and victim computers
Answer: B
NEW QUESTION 111
What is the slave device connected to the secondary IDE controller on a Linux OS referred to?
- A. hdd
- B. hda
- C. hdb
- D. hdc
Answer: A
NEW QUESTION 112
In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?
- A. Chosen-message attack
- B. Known-stego attack
- C. Known-message attack
- D. Known-cover attack
Answer: A
NEW QUESTION 113
Select the tool appropriate for examining the dynamically linked libraries of an application or malware.
- A. DependencyWalker
- B. PEiD
- C. SysAnalyzer
- D. ResourcesExtract
Answer: A
NEW QUESTION 114
A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect's available information but without any success. Which of the following tool can help the investigator to solve this issue?
- A. Cain & Abel
- B. Recuva
- C. Xplico
- D. Colasoft's Capsa
Answer: A
NEW QUESTION 115
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?
- A. Passwords of 14 characters or less are broken up into two 7-character hashes
- B. The passwords that were cracked are local accounts on the Domain Controller
- C. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
- D. Networks using Active Directory never use SAM databases so the SAM database pulled was empty
Answer: A
NEW QUESTION 116
Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?
- A. Nikto
- B. Kismet
- C. Accunetix
- D. Snort
Answer: D
NEW QUESTION 117
Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison lawyer trying to prove the police violated?
- A. The 4th Amendment
- B. The 1st Amendment
- C. The 5th Amendment
- D. The 10th Amendment
Answer: A
NEW QUESTION 118
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?
- A. It is not possible to recover data that has been emptied from the Recycle Bin
- B. The data is still present until the original location of the file is used
- C. The data is moved to the Restore directory and is kept there indefinitely
- D. The data will reside in the L2 cache on a Windows computer until it is manually deleted
Answer: B
NEW QUESTION 119
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?
- A. The Recycle Bin does not exist on the hard drive
- B. Only FAT system contains RECYCLED folder and not NTFS
- C. He should search in C:\Windows\System32\RECYCLED folder
- D. The files are hidden and he must use switch to view them
Answer: D
NEW QUESTION 120
When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?
- A. Time-Sync Protocol
- B. Network Time Protocol
- C. SyncTime Service
- D. Universal Time Set
Answer: B
NEW QUESTION 121
Which rule requires an original recording to be provided to prove the content of a recording?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 122
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?
- A. The files have been marked as hidden
- B. The files have been marked for deletion
- C. The files have been marked as read-only
- D. The files are corrupt and cannot be recovered
Answer: B
NEW QUESTION 123
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?
- A. The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant
- B. The ISP can't conduct any type of investigations on anyone and therefore can't assist you
- C. The ISP can investigate anyone using their service and can provide you with assistance
- D. ISP's never maintain log files so they would be of no use to your investigation
Answer: A
NEW QUESTION 124
What will the following command accomplish in Linux?
fdisk /dev/hda
- A. Partition the hard drive
- B. Delete all files under the /dev/hda folder
- C. Format the hard drive
- D. Fill the disk with zeros
Answer: A
NEW QUESTION 125
When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?
- A. Title 18, Section 2703(f)
- B. Title 18, Section 1030
- C. Title 18, Section 2703(d)
- D. Title 18, Section Chapter 90
Answer: A
NEW QUESTION 126
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?
- A. Errors-To header
- B. Mime-Version header
- C. Content-Type header
- D. Content-Transfer-Encoding header
Answer: A
NEW QUESTION 127
What is the smallest physical storage unit on a hard drive?
- A. Sector
- B. Track
- C. Platter
- D. Cluster
Answer: A
NEW QUESTION 128
In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.
- A. Network Forensics
- B. Computer Forensics
- C. Data Recovery
- D. Disaster Recovery
Answer: B
NEW QUESTION 129
......
Pass Your EC-COUNCIL Exam with 312-49v10 Exam Dumps: https://pass4sure.validdumps.top/312-49v10-exam-torrent.html