312-49無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

質問 1

An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

（A）Fraggle

（B）Smurf

（C）Ping of death

（D）Nmap scan

正解：C 解答を投票する

質問 2

A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

（A）Searching for evidence themselves would not have any ill effects

（B）Searching could possibly crash the machine or device

（C）Searching can change date/time stamps

（D）Searching creates cache files, which would hinder the investigation

正解：C 解答を投票する

質問 3

What type of analysis helps to identify the time and sequence of events in an investigation?

（A）Functional

（B）Temporal

（C）Relational

（D）Time-based

正解：B 解答を投票する

質問 4

How often must a company keep log files for them to be admissible in a court of law?

（A）Continuously

（B）Monthly

（C）Weekly

（D）All log files are admissible in court no matter their frequency

正解：A 解答を投票する

質問 5

The use of warning banners helps a company avoid litigation by overcoming an employees assumed _________ when connecting to the company intranet, network, or virtual private network (VPN) and will allow the company investigators to monitor, search, and retrievecompany? intranet, network, or virtual private network (VPN) and will allow the company? investigators to monitor, search, and retrieve information stored within the network.

（A）Right to work

（B）Right to Internet access

（C）Right of privacy

（D）Right of free speech

正解：C 解答を投票する

質問 6

What type of file is represented by a colon (:) with a name following it in the Master File
Table (MFT) of an NTFS disk?

（A）Reserved file

（B）Data stream file

（C）Compressed file

（D）Encrypted file

正解：B 解答を投票する

質問 7

John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they shouldJohn is working on his company? policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should
John write in the guidelines to be used when destroying documents?

（A）Cris-cross shredder

（B）Cross-hatch shredder

（C）Strip-cut shredder

（D）Cross-cut shredder

正解：D 解答を投票する

質問 8

In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the
ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

（A）The ISP can investigate anyone using their service and can provide you with assistance

（B）The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

（C）The ISP cannot conduct any type of investigations on anyone and therefore cannot assist you

（D）ISPs never maintain log files so they would be of no use to your investigation

正解：B 解答を投票する

質問 9

One way to identify the presence of hidden partitions on a suspect hard drive is to:One way to identify the presence of hidden partitions on a suspect? hard drive is to:

（A）It is not possible to have hidden partitions on a hard drive

（B）Add up the total size of all known partitions and compare it to the total size of the hard drive

（C）Examine the LILO and note an ?in the artition Type?fieldExamine the LILO and note an
??in the ?artition Type?field

（D）Examine the FAT and identify hidden partitions by noting an ?in the artition
Type?fieldExamine the FAT and identify hidden partitions by noting an ??in the ?artition
Type?field

正解：B 解答を投票する

質問 10

A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

What can the investigator infer from the screenshot seen below?

（A）Buffer overflow attempt on the firewall.

（B）A denial of service has been attempted

（C）Network intrusion has occurred

（D）A smurf attack has been attempted

正解：C 解答を投票する

312-49 無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator」

弊社を連絡する

関連リンク

トップ試験