EC0-349 Exam Training Practice Tests (EC-COUNCIL Computer Hacking Forensic Investigator)]

Question 1

Computer security logs contain information about the events occurring within an organization's systems and networks. Application and Web server log files are useful in detecting web attacks.
The source, nature, and time of the attack can be determined by _________of the compromised system.

A. Analyzing log files B. Analyzing rainbow tables C. Analyzing SAM file D. Analyzing hard disk boot records

Correct Answer: A

Question 2

When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

A. Overzealous marketing B. Scope Creep C. Unauthorized expenses D. Hard Drive Failure

Correct Answer: B

Question 3

What binary coding is used most often for e-mail purposes?

A. Uuencode B. MIME C. IMAP D. SMTP

Correct Answer: B

Question 4

A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

A. Searching could possibly crash the machine or device B. Searching creates cache files, which would hinder the investigation C. Searching for evidence themselves would not have any ill effects D. Searching can change date/time stamps

Correct Answer: D

Question 5

When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

A. Two B. Three C. Four D. One

Correct Answer: A

Question 6

After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts responds to your ICMP pings; definitely not the number of hosts you were expecting. Why did this ping sweep only produce a few responses?

A. Only Unix and Unix-like systems will reply to this scan B. Only IBM AS/400 will reply to this scan C. Only Windows systems will reply to this scan D. A switched network will not respond to packets sent to the broadcast address

Correct Answer: A

Question 7

Which program is the oot loader?when Windows XP starts up?Which program is the ?oot loader?when Windows XP starts up?

A. LILO B. NTLDR C. LOADER D. KERNEL.EXE

Correct Answer: B

Question 8

Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

A. Content-Type header B. Mime-Version header C. Content-Transfer-Encoding header D. Errors-To header

Correct Answer: D

Question 9

Jones had been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones. What is a virtual environment?

A. A system using Trojaned commands B. An environment set up after the user logs in C. An environment set up before an user logs in D. A honeypot that traps hackers

Correct Answer: D

Question 10

Where does Encase search to recover NTFS files and folders?

A. MFT B. MBR C. Slack space D. HAL

Correct Answer: A

Question 11

During the course of a corporate investigation, you find that an employee is committing a federal crime. Can the employer file a criminal complain with the police?

A. No, because the investigation was conducted without a warrant B. No, because the investigation was conducted without following standard police procedures C. Yes, and all evidence can be turned over to the police D. Yes, but only if you turn the evidence over to a district judge

Correct Answer: C

Question 12

When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.
What is the actual error code that you would see in the log for resource not found?

A. 909 B. 505 C. 404 D. 202

Correct Answer: C

Question 13

While working for a prosecutor, What do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense ?

A. Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge B. Present the evidence to the defense attorney C. Destroy the evidence D. Keep the information of file for later review

Correct Answer: A

Question 14

You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

A. The E-mail Header B. The X509 Address C. The Host Domain Name D. The SMTP reply Address

Correct Answer: A

EC-COUNCIL Computer Hacking Forensic Investigator - EC0-349 Exam Practice Test