EC-COUNCIL Computer Hacking Forensic Investigator - 312-49 Exam Questions
QUESTION NO: 1
A(n) _____________________ is one that ' s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.
A(n) _____________________ is one that ' s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.
Correct Answer: D
QUESTION NO: 2
In Steganalysis, which of the following describes a Known-stego attack?
In Steganalysis, which of the following describes a Known-stego attack?
Correct Answer: C
QUESTION NO: 3
Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.
The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?
Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.
The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?
Correct Answer: D
QUESTION NO: 4
You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?
You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information?
Correct Answer: C
QUESTION NO: 5
Which tool does the investigator use to extract artifacts left by Google Drive on the system?
Which tool does the investigator use to extract artifacts left by Google Drive on the system?
Correct Answer: D
QUESTION NO: 6
Software firewalls work at which layer of the OSI model?
Software firewalls work at which layer of the OSI model?
Correct Answer: B
QUESTION NO: 7
Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.
Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.
Correct Answer: D
QUESTION NO: 8
Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:
Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:
Correct Answer: D
QUESTION NO: 9
Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.
Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.
Correct Answer: D
QUESTION NO: 10
You are running through a series of tests on your network to check for any security vulnerabilities.
After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?
You are running through a series of tests on your network to check for any security vulnerabilities.
After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?
Correct Answer: C
