Free Practice Questions for Eccouncil 312-49 Exam

Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

• Civil Investigation
• Administrative Investigation
• Both Civil and Criminal Investigations
• Criminal Investigation

Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?

• Written Formal Report
• Verbal Formal Report
• Verbal Informal Report
• Written Informal Report

Which among the following laws emphasizes the need for each Federal agency to develop, document, and implement an organization-wide program to provide information security for the information systems that support its operations and assets?

• FISMA
• HIPAA
• GLBA
• SOX

When is it appropriate to use computer forensics?

• If copyright and intellectual property theft/misuse has occurred
• If employees do not care for their boss management techniques
• If sales drop off for no apparent reason for an extended period of time
• If a financial institution is burglarized by robbers

Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?

• ParentIDPrefix
• LastWrite
• UserAssist key
• MRUListEx key

A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32TCP Options (3) => NOP TS: 23678634 2878772=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84Len: 6401 0A 8A 0A 00 00 00 00 02 00 01 86 A0 ................00 00 02 00 00 03 00 00 00 00 ................00 00 00 00 00 01 86 B8 00 00 01 ................00 00 11 00 00 ........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104Len: 108447 F7 9F 63 00 00 00 00 02 00 01 86 B8

• The attacker has conducted a network sweep on port 111
• The attacker has scanned and exploited the system using Buffer Overflow
• The attacker has used a Trojan on port 32773
• The attacker has installed a backdoor

Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?

• Identifying File Dependencies
• Strings search
• Dynamic analysis
• File obfuscation

An Expert witness give an opinion if:

• The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
• To define the issues of the case for determination by the finder of fact
• To stimulate discussion between the consulting expert and the expert witness
• To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

• Closed
• Open
• Stealth
• Filtered

Which of the following is a tool to reset Windows admin password?

• R-Studio
• Windows Password Recovery Bootdisk
• Windows Data Recovery Software
• TestDisk for Windows