素晴らしいEC0-349試験問題集試そうEC0-349問題集PDF
EC0-349問題集PDFでEC0-349リアル試験問題解答
質問 # 234
Why would a company issue a dongle with the software they sell?
- A. To provide copyright protection
- B. To provide source code protection
- C. To ensure that keyloggers cannot be used
- D. To provide wireless functionality with the software
正解：A
質問 # 235
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?
- A. It is not possible to recover data that has been emptied from the Recycle Bin
- B. The data is still present until the original location of the file is used
- C. The data will reside in the L2 cache on a Windows computer until it is manually deleted
- D. The data is moved to the Restore directory and is kept there indefinitely
正解：B
質問 # 236
George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network.
What filter should George use in Ethereal?
- A. src port 23 and dst port 23
- B. src port 22 and dst port 22
- C. net port 22
- D. udp port 22 and host 172.16.28.1/24
正解：B
質問 # 237
Which of the following statements is not a part of securing and evaluating electronic crime scene checklist?
- A. Request additional help at the scene if needed
- B. Blog about the incident on the internet
- C. Locate and help the victim
- D. Transmit additional flash messages to other responding units
正解：B
質問 # 238
Which of the following Steganography techniques allows you to encode information that ensures creation of cover for secret communication?
- A. Transform domain techniques
- B. Spread spectrum techniques
- C. Substitution techniques
- D. Cover generation techniques
正解：D
質問 # 239
The following is a log file screenshot from a default installation of IIS 6.0.
What time standard is used by IIS as seen in the screenshot?
- A. UT
- B. GMT
- C. UTC
- D. TAI
正解：C
質問 # 240
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures, such as AP MAC filters and Wi-Fi port access controls.
Which of the following wireless access control attacks allows the attacker to set up a rogue access point outside the corporate perimeter, and then lure the employees of the organization to connect to it?
- A. War driving
- B. Client mis-association
- C. Rogue access points
- D. MAC spoofing
正解：B
質問 # 241
Physical security recommendations: There should be only one entrance to a forensics lab
- A. False
- B. True
正解：B
質問 # 242
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.
He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?
- A. Those connections are in timed out/waiting mode
- B. Those connections are established
- C. Those connections are in listening mode
- D. Those connections are in closed/waiting mode
正解：C
質問 # 243
When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages?
- A. Archive.org
- B. Samspade.org
- C. Dnsstuff.com
- D. Proxify.net
正解：A
質問 # 244
Digital photography helps in correcting the perspective of the Image which Is used In taking the measurements of the evidence. Snapshots of the evidence and incident-prone areas need to be taken to help in the forensic process. Is digital photography accepted as evidence in the court of law?
- A. No
- B. Yes
正解：B
質問 # 245
You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?
- A. Stateful firewall
- B. Application-level proxy firewall
- C. Circuit-level proxy firewall
- D. Packet filtering firewall
正解：A
質問 # 246
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
- A. Every byte of the file(s) is encrypted using three different methods
- B. Every byte of the file(s) is copied to three different hard drives
- C. Every byte of the file(s) is verified using 32-bit CRC
- D. Every byte of the file(s) is given an MD5 hash to match against a master file
正解：C
質問 # 247
The use of warning banners helps a company avoid litigation by overcoming an employee assumed
__________________________. When connecting to the company's intranet, network or Virtual Private Network(VPN) and will allow the company's investigators to monitor, search and retrieve information stored within the network.
- A. Right of Privacy
- B. Right of free speech
- C. Right to Internet Access
- D. Right to work
正解：A
質問 # 248
What will the following URL produce in an unpatched IIS Web Server?
http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\
- A. Directory listing of C: drive on the web server
- B. Insert a Trojan horse into the C: drive of the web server
- C. Execute a buffer flow in the C: drive of the web server
- D. Directory listing of the C:\windows\system32 folder on the web server
正解：A
質問 # 249
Buffer Overflow occurs when an application writes more data to a block of memory, or buffer, than the buffer is allocated to hold. Buffer overflow attacks allow an attacker to modify the
_______________in order to control the process execution, crash the process and modify internal variables.
- A. Target SAM file
- B. Target remote access
- C. Target process's address space
- D. Target rainbow table
正解：C
質問 # 250
First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for collecting, preserving, and packaging electronic evidence?
- A. Local managers or other non-forensic staff
- B. Lawyers
- C. Forensic laboratory staff
- D. System administrators
正解：C
質問 # 251
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.
- A. A Capital X
- B. The lowercase Greek Letter Sigma (s)
- C. The Underscore Symbol
- D. A Blank Space
正解：B
解説：
When a file is deleted, the first byte is replaced with 0xE5 to marked the file as deleted or erased, and is the same for FAT12/16/32. An 0xE5 translates also to a ASCII 229, a "O" with a tilde.
However, using the greek alphabet (see: http://www.ascii.ca/iso8859.7.htm) the ASCII code 229 is "the lowercase Greek Letter Epsilon, and Ascii code 243 is Lower case Greek Letter Sigma.
http://chexed.com/ComputerTips/asciicodes.php says that Ascii 229 is Lowercase Greek Letter Sigma So, although D looks like the correct answer here, it may require more understanding of the underlying intent of the question.
質問 # 252
You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different.
What area of the law is the employee violating?
- A. Brandmark law
- B. Copyright law
- C. Printright law
- D. Trademark law
正解：D
質問 # 253
When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code
- A. First 12
- B. First 24
- C. First 22
- D. First 16
正解：D
質問 # 254
You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments.
What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?
- A. Full backup Copy
- B. Robust Copy
- C. Incremental Backup Copy
- D. Bit-stream Copy
正解：D
質問 # 255
How often must a company keep log files for them to be admissible in a court of law?
- A. All log files are admissible in court no matter their frequency
- B. Weekly
- C. Continuously
- D. Monthly
正解：C
質問 # 256
The newer Macintosh Operating System is based on:
- A. OS/2
- B. Microsoft Windows
- C. Linux
- D. BSD Unix
正解：D
質問 # 257
......
有効なEC0-349テスト解答とEC-COUNCIL EC0-349試験PDF：https://www.jpntest.com/shiken/EC0-349-mondaishu
実際に出るEC0-349試験問題集には正確で更新された問題：https://drive.google.com/open?id=1tJn5qUyrckzLXypNWRlh3uZRmoQBD_5q