EC-COUNCIL Computer Hacking Forensic Investigator - EC0-349 Exam Practice Test
What must be obtained before an investigation is carried out at a location?
Correct Answer: A
Vote an answer
Which of the following commands shows you all of the network services running on Windows- based servers?
Correct Answer: C
Vote an answer
Smith, as a part his forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as
1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What Jason can do in this scenario to reset the PIN and access SIM data?
1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What Jason can do in this scenario to reset the PIN and access SIM data?
Correct Answer: A
Vote an answer
You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work through Firewalls (Select 2)
Correct Answer: A,B
Vote an answer
What TCP/UDP port does the toolkit program netstat use?
Correct Answer: A
Vote an answer
You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network.
Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?
Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?
Correct Answer: A
Vote an answer
One way to identify the presence of hidden partitions on a suspect hard drive is to:One way to identify the presence of hidden partitions on a suspect? hard drive is to:
Correct Answer: A
Vote an answer
What is the slave device connected to the secondary IDE controller on a Linux OS referred to?
Correct Answer: C
Vote an answer
All the Information about the user activity on the network, like details about login and logoff attempts, is collected in the security log of the computer.
When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table.
In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer?
When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table.
In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer?
Correct Answer: B
Vote an answer
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?
Correct Answer: A
Vote an answer
Who is responsible for the following tasks?
- Secure the scene and ensure that it is maintained In a secure state
until the Forensic Team advises
- Make notes about the scene that will eventually be handed over to the Forensic Team
- Secure the scene and ensure that it is maintained In a secure state
until the Forensic Team advises
- Make notes about the scene that will eventually be handed over to the Forensic Team
Correct Answer: B
Vote an answer