EC0-349無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

質問 1

What is static executable file analysis?

（A）It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances

（B）It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment

（C）It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances

（D）It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment

正解：C 解答を投票する

質問 2

The need for computer forensics is highlighted by an exponential increase in the number of cybercrimes and litigations where large organizations were involved. Computer forensics plays an important role in tracking the cyber criminals. The main role of computer forensics is to:

（A）Maximize the investigative potential by maximizing the costs

（B）Harden organization perimeter security

（C）Document monitoring processes of employees of the organization

（D）Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court

正解：D 解答を投票する

質問 3

Which of the following attacks allows attacker to acquire access to the communication channels between the victim and server to extract the information?

（A）Man-in-the-middle (MITM) attack

（B）Replay attack

（C）Distributed network attack

（D）Rainbow attack

正解：A 解答を投票する

質問 4

Click on the Exhibit Button Paulette works for an IT security consulting company that is currently performing an audit for the firm ACE Unlimited. Paulette's duties include logging on to all the company's network equipment to ensure IOS versions are up-to-date and all the other security settings are as stringent as possible. Paulette presents the following screenshot to her boss so he can inform the client about necessary changes need to be made. From the screenshot, what changes should the client company make?

（A）The banner should not state "only authorized IT personnel may proceed"

（B）Remove any identifying numbers, names, or version information

（C）The banner should have more detail on the version numbers for the networkeQuipment

（D）The banner should include the Cisco tech support contact information as well

正解：B 解答を投票する

質問 5

Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

（A）Mime-Version header

（B）Content-Type header

（C）Errors-To header

（D）Content-Transfer-Encoding header

正解：C 解答を投票する

質問 6

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

（A）Chain of custody

（B）Rules of evidence

（C）Law of probability

（D）Policy of separation

正解：A 解答を投票する

質問 7

SMTP (Simple Mail Transfer protocol) receives outgoing mail from clients and validates source and destination addresses, and also sends and receives emails to and from other SMTP servers.

（A）False

（B）True

正解：B 解答を投票する

質問 8

The offset in a hexadecimal code is:

（A）The 0x at the beginning of the code

（B）The last byte after the colon

（C）The 0x at the end of the code

（D）The first byte after the colon

正解：A 解答を投票する

質問 9

Which one of the following statements is not correct while preparing for testimony?

（A）Substantiate the findings with documentation and by collaborating with other computer forensics professionals

（B）Establish early communication with the attorney

（C）Go through the documentation thoroughly

（D）Do not determine the basic facts of the case before beginning and examining the evidence

正解：D 解答を投票する

質問 10

Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

（A）Backup a disk to an image file

（B）Restore a disk from an image file

（C）Search for disk errors within an image file

（D）Copy a partition to an image file

正解：B 解答を投票する

質問 11

What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?

（A）Reserved file

（B）Data stream file

（C）Compressed file

（D）Encrypted file

正解：B 解答を投票する

質問 12

What is a chain of custody?

（A）A legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory

（B）It is a search warrant that is required for seizing evidence at a crime scene

（C）Chain of custody refers to obtaining preemptive court order to restrict further damage of evidence in electronic seizures

（D）It Is a document that lists chain of windows process events

正解：A 解答を投票する

質問 13

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

（A）He should search in C:\Windows\System32\RECYCLED folder

（B）The files are hidden and he must use switch to view themThe files are hidden and he must use ?
switch to view them

（C）Only FAT system contains RECYCLED folder and not NTFS

（D）The Recycle Bin does not exist on the hard drive

正解：B 解答を投票する

EC0-349 無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

弊社を連絡する

関連リンク

トップ試験