EC-Council 312-49v10 問題練習

Question No : 1
When obtaining a warrant, it is important to:

• A.particularlydescribe the place to be searched and particularly describe the items to be seized
• B.generallydescribe the place to be searched and particularly describe the items to be seized
• C.generallydescribe the place to be searched and generally describe the items to be seized
• D.particularlydescribe the place to be searched and generally describe the items to be seized

答えを確認する

正解:

Question No : 2
Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers.
Bill protects the PDF documents with a password and sends them to their intended recipients.
Why PDF passwords do not offer maximum protection?

• A.PDF passwords can easily be cracked by software brute force tools
• B.PDF passwords are converted to clear text when sent through E-mail
• C.PDF passwords are not considered safe by Sarbanes-Oxley
• D.When sent through E-mail, PDF passwords are stripped from the document completely

答えを確認する

正解:

Question No : 3
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document .
What is that code called?

• A.the Microsoft Virtual Machine Identifier
• B.the Personal Application Protocol
• C.the Globally Unique ID
• D.the Individual ASCII String

答えを確認する

正解:

Question No : 4
Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

• A.Linux/Unix computers are easier to compromise
• B.Linux/Unix computers are constantly talking
• C.Windows computers are constantly talking
• D.Windows computers will not respond to idle scans

答えを確認する

正解:

Question No : 5
After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts respond to your ICMP pings; definitely not the number of hosts you were expecting .
Why did this ping sweep only produce a few responses?

• A.Only IBM AS/400 will reply to this scan
• B.Only Windows systems will reply to this scan
• C.A switched network will not respond to packets sent to the broadcast address
• D.Only Unix and Unix-like systems will reply to this scan

答えを確認する

正解:

Question No : 6
You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected .
What are two common methods used by password cracking software that you can use to obtain the password?

• A.Limited force and library attack
• B.Brute Force and dictionary Attack
• C.Maximum force and thesaurus Attack
• D.Minimum force and appendix Attack

答えを確認する

正解:

Question No : 7
What file structure database would you expect to find on floppy disks?

• A.NTFS
• B.FAT32
• C.FAT16
• D.FAT12

答えを確認する

正解:

Question No : 8
You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive .
Which of the following formats correctly specifies these sectors?

• A.0:1000, 150
• B.0:1709, 150
• C.1:1709, 150
• D.0:1709-1858

答えを確認する

正解:

Question No : 9
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

• A.a write-blocker
• B.a protocol analyzer
• C.a firewall
• D.a disk editor

答えを確認する

正解:

Question No : 10
What are the security risks of running a "repair" installation for Windows XP?

• A.Pressing Shift+F10gives the user administrative rights
• B.Pressing Shift+F1gives the user administrative rights
• C.Pressing Ctrl+F10 gives the user administrative rights
• D.There are no security risks when running the "repair" installation for Windows XP

答えを確認する

正解:

Question No : 11
How many bits is Source Port Number in TCP Header packet?

• A.16
• B.32
• C.48
• D.64

答えを確認する

正解:

Question No : 12
When examining a file with a Hex Editor, what space does the file header occupy?

• A.the last several bytes of the file
• B.the first several bytes of the file
• C.none, file headers are contained in the FAT
• D.one byte at the beginning of the file

答えを確認する

正解:

Question No : 13
How many sectors will a 125 KB file use in a FAT32 file system?

• A.32
• B.16
• C.256
• D.25

答えを確認する

正解:

Question No : 14
To preserve digital evidence, an investigator should ____________________.

• A.Make two copies of each evidence item using a single imaging tool
• B.Make a single copy of each evidence item using an approved imaging tool
• C.Make two copies of each evidence item using different imaging tools
• D.Only store the original evidence item

答えを確認する

正解:

Question No : 15
E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

• A.user account that was used to send the account
• B.attachments sent with the e-mail message
• C.unique message identifier
• D.contents of the e-mail message
• E.date and time the message was sent

答えを確認する

正解: