[Oct-2024] EC-COUNCIL EC0-349 Actual Questions and Braindumps
Pass EC0-349 Exam with Updated EC0-349 Exam Dumps PDF 2024
NEW QUESTION # 99
Which of the following is the certifying body of forensics labs that investigate criminal cases by analyzing evidence?
- A. International Society of Forensics Laboratory (ISFL)
- B. The American Forensics Laboratory Society (AFLS)
- C. The American Society of Crime Laboratory Directors (ASCLD)
- D. The American Forensics Laboratory for Computer Forensics (AFLCF)
Answer: C
NEW QUESTION # 100
After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks.
What countermeasures could he take to prevent DDoS attacks?
- A. Disable direct broadcasts
- B. Disable BGP
- C. Enable direct broadcasts
- D. Enable BGP
Answer: A
NEW QUESTION # 101
While looking through the IIS log file of a web server, you find the following entries:
What is evident from this log file?
- A. Hidden fields
- B. SQL injection is possible
- C. Web bugs
- D. Cross site scripting
Answer: B
NEW QUESTION # 102
JPEG is a commonly used method of compressing photographic Images. It uses a compression algorithm to minimize the size of the natural image, without affecting the quality of the image. The JPEG lossy algorithm divides the image in separate blocks of____________.
- A. 4x4 pixels
- B. 8x8 pixels
- C. 16x16 pixels
- D. 32x32 pixels
Answer: B
NEW QUESTION # 103
When using an iPod and the host computer is running Windows, what file system will be used?
- A. FAT16
- B. FAT32
- C. HFS
- D. iPod+
Answer: B
NEW QUESTION # 104
Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away.
Eventually the wireless signal shows back up, but drops intermittently. What could be Tyler issue with his home wireless network?
- A. CB radio
- B. Satellite television
- C. 2.4Ghz Cordless phones
- D. Computers on his wired network
Answer: C
NEW QUESTION # 105
Graphics Interchange Format (GIF) is a ___________RGB bitmap Image format for Images with up to 256 distinct colors per frame.
- A. 8-bit
- B. 24-bit
- C. 32-bit
- D. 16-bit
Answer: A
NEW QUESTION # 106
Chris has been called upon to investigate a hacking incident reported by one of his clients.
The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?
- A. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media
- B. Secure the evidence; Prepare the system for acquisition; Connect the target media; Copy the media
- C. Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence
- D. Connect the target media; Delete the system for acquisition; Secure the evidence; Copy the media
Answer: C
NEW QUESTION # 107
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?
- A. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
- B. The EFS Revoked Key Agent can be used on the computer to recover the information
- C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information
- D. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information
Answer: C
NEW QUESTION # 108
What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?
- A. Teardrop
- B. Fraggle
- C. Smurf scan
- D. SYN flood
Answer: B
NEW QUESTION # 109
A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.
What can the investigator infer from the screenshot seen below?
- A. Network intrusion has occurred
- B. A denial of service has been attempted
- C. A smurf attack has been attempted
- D. Buffer overflow attempt on the firewall.
Answer: A
NEW QUESTION # 110
With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION # 111
What happens when a file is deleted by a Microsoft operating system using the FAT file system?
- A. Only the reference to the file is removed from the FAT and can be recovered
- B. The file is erased but can be recovered partially
- C. A copy of the file is stored and the original file is erased
- D. The file is erased and cannot be recovered
Answer: A
NEW QUESTION # 112
To check for POP3 traffic using Ethereal, what port should an investigator search by?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION # 113
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?
- A. The Recycle Bin does not exist on the hard drive
- B. Only FAT system contains RECYCLED folder and not NTFS
- C. He should search in C:\Windows\System32\RECYCLED folder
- D. The files are hidden and he must use switch to view them
Answer: D
NEW QUESTION # 114
An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are _________ media used to store large amounts of data and are not affected by the magnet.
- A. Optical
- B. Magnetic
- C. Anti-Magnetic
- D. Logical
Answer: A
NEW QUESTION # 115
Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused.
In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other. What type of cipher was used by the accused in this case?
- A. Null cipher
- B. Grill cipher
- C. Text semagram
- D. Visual semagram
Answer: B
NEW QUESTION # 116
In the following directory listing,
Which file should be used to restore archived email messages for someone using Microsoft Outlook?
- A. Outlook ost
- B. Outlook pst
- C. Outlook NK2
- D. Outlook bak
Answer: B
NEW QUESTION # 117
In the following directory listing,
which file should be used to restore archived email messages for someone using Microsoft Outlook?
- A. Outlook ost
- B. Outlook pst
- C. Outlook NK2
- D. Outlook bak
Answer: B
NEW QUESTION # 118
Computer forensics report provides detailed information on complete computer forensics investigation process. It should explain how the incident occurred, provide technical details of the incident and should be clear to understand. Which of the following attributes of a forensics report can render it inadmissible in a court of law?
- A. It includes relevant extracts referred to In the report that support analysis or conclusions
- B. It is based on logical assumptions about the incident timeline
- C. It maintains a single document style throughout the text
- D. It includes metadata about the incident
Answer: B
NEW QUESTION # 119
You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?
- A. Incremental backup copy
- B. Robust copy
- C. Bit-stream copy
- D. Full backup copy
Answer: C
NEW QUESTION # 120
The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin.
What is the size limit for Recycle Bin in Vista and later versions of the Windows?
- A. Maximum of 4.99 GB
- B. No size limit
- C. Maximum of 5.99 GB
- D. Maximum of 3.99 GB
Answer: B
NEW QUESTION # 121
The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux.
Identify the Apache error log from the following logs.
- A. 127.0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200
- B. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration:
/export/home/live/ap/htdocs/test - C. 127.0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200
- D. http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0% af./..%c0%af./../winnt/system32/cmd.exe?/c+dir+c:\wintt\system32\Logfiles\W3SVC1
Answer: B
NEW QUESTION # 122
......
Latest EC0-349 Pass Guaranteed Exam Dumps with Accurate & Updated Questions: https://www.validvce.com/EC0-349-exam-collection.html
EC0-349 Exam Brain Dumps - Study Notes and Theory: https://drive.google.com/open?id=1M2KELsZAWHykCb8GEn8MqVAyYlyJVFxn
