312-49無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

質問 1

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

（A）A text file copied from C drive to D drive in fifth sequential order

（B）A text file copied from D drive to C drive in fifth sequential order

（C）A text file deleted from C drive in sixth sequential order

（D）A text file deleted from C drive in fifth sequential order

正解：D 解答を投票する

質問 2

What does ICMP Type 3/Code 13 mean?

（A）Protocol Unreachable

（B）Port Unreachable

（C）Administratively Blocked

（D）Host Unreachable

正解：C 解答を投票する

質問 3

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

（A）All virtual memory will be deleted

（B）This action can corrupt the disk

（C）The computer will be set in a constant reboot state

（D）The wrong partition may be set to active

正解：B 解答を投票する

質問 4

After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

（A）NAT does not work with IPSEC

（B）NAT does not work with stateful firewalls

（C）IPSEC does not work with packet filtering firewalls

（D）Stateful firewalls do not work with packet filtering firewalls

正解：A 解答を投票する

質問 5

Area density refers to:

（A）the amount of data per partition

（B）the amount of data per disk

（C）the amount of data per square inch

（D）the amount of data per platter

正解：B 解答を投票する

質問 6

Which of the following file contains the traces of the applications installed, run, or uninstalled from a system?

（A）Shortcut Files

（B）Image Files

（C）Virtual files

（D）Prefetch Files

正解：A 解答を投票する

質問 7

During forensics investigations, investigators tend to collect the system time at first and compare it with UTC.
What does the abbreviation UTC stand for?

（A）Universal Computer Time

（B）Correlated Universal Time

（C）Coordinated Universal Time

（D）Universal Time for Computers

正解：C 解答を投票する

質問 8

Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?

（A）Sparse or Logical Acquisition

（B）Bit-by-bit Acquisition

（C）Bit-stream disk-to-disk Acquisition

（D）Static Acquisition

正解：A 解答を投票する

質問 9

A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

What can the investigator infer from the screenshot seen below?

（A）Buffer overflow attempt on the firewall.

（B）A denial of service has been attempted

（C）Network intrusion has occurred

（D）A smurf attack has been attempted

正解：C 解答を投票する

質問 10

Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server. Why will Jonathan not succeed?

（A）Only an HTTPS session can be hijacked

（B）Only FTP traffic can be hijacked

（C）Only DNS traffic can be hijacked

（D）HTTP protocol does not maintain session

正解：D 解答を投票する

質問 11

Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not?

（A）RIPE

（B）APIPA

（C）IANA

（D）CVE

正解：D 解答を投票する

質問 12

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks.
Which of the following would that be?

（A）The /tmp directory will be flushed

（B）Power interruption will corrupt the pagefile

（C）Any data not yet flushed to the system will be lost

（D）All running processes will be lost

正解：C 解答を投票する

質問 13

How many bits is Source Port Number in TCP Header packet?

（A）64

（B）16

（C）32

（D）48

正解：B 解答を投票する

質問 14

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

（A）BIOS

（B）Case files

（C）MSDOS.sys

（D）Recycle Bin

正解：D 解答を投票する

312-49 無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

弊社を連絡する

関連リンク

トップ試験