312-49v9 Exam Training Practice Tests (EC-COUNCIL ECCouncil Computer Hacking Forensic Investigator (V9))]

Question 1

When reviewing web logs, you see an entry for resource not found in the HTTP status code field.
What is the actual error code that you would see in the log for resource not found?

A. 999 B. 404 C. 202 D. 606

Correct Answer: B

Question 2

Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password?

A. Rule-based attack B. Syllable attack C. Brute force attack D. Hybrid attack

Correct Answer: A

Question 3

What does mactime, an essential part of the coroner's toolkit do?

A. It traverses the file system and produces a listing of all files based on the modification, access and change timestamps B. It is too specific to the MAC OS and forms a core component of the toolkit C. The tools scans for i-node information, which is used by other tools in the tool kit D. It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

Correct Answer: A

Question 4

How many sectors will a 125 KB file use in a FAT32 file system?

A. 256 B. 16 C. 25 D. 32

Correct Answer: A

Question 5

What must an attorney do first before you are called to testify as an expert?

A. Qualify you as an expert witness B. Read your curriculum vitae to the jury C. Prove that the tools you used to conduct your examination are perfect D. Engage in damage control

Correct Answer: A

Question 6

What does Locard's Exchange Principle state?

A. Any information of probative value that is either stored or transmitted in a digital form B. Forensic investigators face many challenges during forensics investigation of a digital crime, such as extracting, preserving, and analyzing the digital evidence C. Anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave D. Digital evidence must have some characteristics to be disclosed in the court of law

Correct Answer: C

Question 7

Which of the following tool enables a user to reset his/her lost admin password in a Windows system?

A. Active@ Password Changer B. Passware Kit Forensic C. Smartkey Password Recovery Bundle Standard D. Advanced Office Password Recovery

Correct Answer: A

Question 8

Amber, a black hat hacker, has embedded malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?

A. Click-jacking B. Compromising a legitimate site C. Malvertising D. Spearphishing

Correct Answer: C

Question 9

Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

A. The data is moved to the Restore directory and is kept there indefinitely B. It is not possible to recover data that has been emptied from the Recycle Bin C. The data will reside in the L2 cache on a Windows computer until it is manually deleted D. The data is still present until the original location of the file is used

Correct Answer: D

Question 10

How many times can data be written to a DVD+R disk?

A. Zero B. Twice C. Once D. Infinite

Correct Answer: C

Question 11

Which of the following is a responsibility of the first responder?

A. Share the collected information to determine the root cause B. Document the findings C. Determine the severity of the incident D. Collect as much information about the incident as possible

Correct Answer: D

Question 12

Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

A. Process Monitor B. Hex Editor C. Internet Evidence Finder D. Report Viewer

Correct Answer: A

Question 13

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

A. Microsoft Exchange B. Blackberry WAP gateway C. Blackberry WEP gateway D. Blackberry Message Center

Correct Answer: D

Question 14

While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?

A. No particular field B. Judging the character of defendants/victims C. Legal issues D. Technical material related to forensics

Correct Answer: A

EC-COUNCIL ECCouncil Computer Hacking Forensic Investigator (V9) - 312-49v9 Exam Practice Test