New 2021 Latest Questions 312-49v9 Dumps - Use Updated EC-COUNCIL Exam
Latest 312-49v9 Exam Dumps EC-COUNCIL Exam from Training Expert Pass4suresVCE
EC-COUNCIL 312-49v9 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION 265
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where "x" represents the
___________________.
- A. Drive name
- B. Sequential number
- C. Original file name
- D. Original file name's extension
Answer: A
NEW QUESTION 266
The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?
- A. All running processes will be lost
- B. The /tmp directory will be flushed
- C. Power interruption will corrupt the pagefile
- D. Any data not yet flushed to the system will be lost
Answer: A,D
Explanation:
Volitile memory will be lost.
Data is not flushed to the system, it is flushed to the disk.
NEW QUESTION 267
During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:
- A. Inculpatory evidence
- B. mandatory evidence
- C. exculpatory evidence
- D. Terrible evidence
Answer: C
NEW QUESTION 268
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything.
What is the reason for this?
- A. The Recycle Bin does not exist on the hard drive
- B. The files are hidden and he must use switch to view them
- C. Only FAT system contains RECYCLED folder and not NTFS
- D. He should search in C:\Windows\System32\RECYCLED folder
Answer: B
NEW QUESTION 269
Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?
dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync
- A. Fill the disk with zeros
- B. Low-level format
- C. Copy files from the master disk to the slave disk on the secondary IDE controller
- D. Fill the disk with 4096 zeros
Answer: A
NEW QUESTION 270
Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader?
- A. Technical steganography
- B. Text semagrams steganography
- C. Visual semagrams steganography
- D. Open code steganography
Answer: D
NEW QUESTION 271
When reviewing web logs, you see an entry for resource not found in the HTTP status code field.
What is the actual error code that you would see in the log for resource not found?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 272
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
- A. Every byte of the file(s) is copied to three different hard drives
- B. Every byte of the file(s) is given an MD5 hash to match against a master file
- C. Every byte of the file(s) is verified using 32-bit CRC
- D. Every byte of the file(s) is encrypted using three different methods
Answer: C
NEW QUESTION 273
A packet is sent to a router that does not have the packet destination address in its route table.
How will the packet get to its proper destination?
- A. Gateway of last resort
- B. Border Gateway Protocol
- C. Reverse DNS
- D. Root Internet servers
Answer: A
NEW QUESTION 274
When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:
- A. Automate Collection from image files
- B. Acquire data from host-protected area on a disk
- C. Avoiding copying data from the boot partition
- D. Prevent Contamination to the evidence drive
Answer: D
NEW QUESTION 275
When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?
- A. Active IDS
- B. Passive IDS
- C. NIPS
- D. Progressive IDS
Answer: A
NEW QUESTION 276
What is the role of Alloc.c in Apache core?
- A. It handles allocation of resource pools
- B. It is useful for reading and handling of the configuration files
- C. It handles server start-ups and timeouts
- D. It takes care of all the data exchange and socket connections between the client and the server
Answer: A
NEW QUESTION 277
An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:
- A. Integrated Circuit Code (ICC)
- B. Device Origin Code (DOC)
- C. Type Allocation Code (TAC)
- D. Manufacturer Identification Code (MIC)
Answer: C
NEW QUESTION 278
You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?
- A. 0:1709-1858
- B. 0:1000, 150
- C. 0:1709, 150
- D. 1:1709, 150
Answer: C
NEW QUESTION 279
While looking through the IIS log file of a web server, you find the following entries:
What is evident from this log file?
- A. Hidden fields
- B. SQL injection is possible
- C. Web bugs
- D. Cross site scripting
Answer: B
NEW QUESTION 280
The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data.
- A. True
- B. False
Answer: B
NEW QUESTION 281
Which of the following commands shows you the names of all open shared files on a server and number of file locks on each file?
- A. Net sessions
- B. Netconfig
- C. Net share
- D. Net file
Answer: D
NEW QUESTION 282
First responder is a person who arrives first at the crime scene and accesses the victim's computer system after the incident. He or She is responsible for protecting, integrating, and preserving the evidence obtained from the crime scene.
Which of the following is not a role of first responder?
- A. Identify and analyze the crime scene
- B. Protect and secure the crime scene
- C. Package and transport the electronic evidence to forensics lab
- D. Prosecute the suspect in court of law
Answer: D
NEW QUESTION 283
Sectors in hard disks typically contain how many bytes?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION 284
You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?
- A. The tool hasn't been tested by the International Standards Organization (ISO)
- B. The total has not been reviewed and accepted by your peers
- C. Only the local law enforcement should use the tool
- D. You are not certified for using the tool
Answer: B
NEW QUESTION 285
Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?
- A. Transport
- B. Sessi
- C. Physical
- D. Network
Answer: C
NEW QUESTION 286
Which of the following filesystem is used by Mac OS X?
- A. EFS
- B. NFS
- C. HFS+
- D. EXT2
Answer: C
Explanation:
EFS (Encrypting File System) is part of NTFS and used on Windows
EXT2 is used on Linux
NFS (Network File System) is for access to a network file system over TCP/IP
NEW QUESTION 287
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
- A. Remove any memory cards immediately
- B. Keep the device powered on
- C. Turn off the device immediately
- D. Remove the battery immediately
Answer: B
NEW QUESTION 288
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords.
After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour.
Why were these passwords cracked so Quickly?
- A. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
- B. The passwords that were cracked are local accounts on the Domain Controller
- C. Passwords of 14 characters or less are broken up into two 7-character hashes
- D. Networks using Active Directory never use SAM databases so the SAM database pulled was empty
Answer: C
NEW QUESTION 289
Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully.
Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?
- A. Three
- B. Four
- C. One
- D. Two
Answer: D
NEW QUESTION 290
......
Updated Test Engine to Practice 312-49v9 Dumps & Practice Exam: https://www.pass4suresvce.com/312-49v9-pass4sure-vce-dumps.html