Item 2If you come across a sheepdip machine at your client site, what would you infer?

A sheepdip computer is used only for virus-checking.

A sheepdip coordinates several honeypots

A sheepdip computer is another name for a honeypot

A sheepdip computer is used only for virus-checking.

A sheepdip computer defers a denial of service attack

A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32TCP Options (3) => NOP NOP TS: 23678634 2878772=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84Len: 6401 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................00 00 00 11 00 00 00 00 ........=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 47 F79F 63 00 00 00 00 00 00 00 02 00 01 86 B8

The attacker has conducted a network sweep on port 111

The attacker has scanned and exploited the system using Buffer Overflow

The attacker has used a Trojan on port 32773

The attacker has installed a backdoor

Before you are called to testify as an expert, what must an attorney do first?

qualify you as an expert witness

prove that the tools you used to conduct your examination are perfect

read your curriculum vitae to the jury

qualify you as an expert witness

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data.What method would be most efficient for you to acquire digital evidence from this network?

make a bit-stream disk-to-image file

create a compressed copy of the file with DoubleSpace

create a sparse data copy of a folder or file

make a bit-stream disk-to-image file

make a bit-stream disk-to-disk file

When examining a file with a Hex Editor, what space does the file header occupy?

one byte at the beginning of the file

the last several bytes of the file

the first several bytes of the file

none, file headers are contained in the FAT

one byte at the beginning of the file

In the context of file deletion process, which of the following statement holds true?

While booting, the machine may create temporary files that can delete evidence

When files are deleted, the data is overwritten and the cluster marked as available

The longer a disk is in use, the less likely it is that deleted files will be overwritten

While booting, the machine may create temporary files that can delete evidence

Secure delete programs work by completely overwriting the file in one go

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

Image the disk and try to recover deleted files

Seek the help of co-workers who are eye-witnesses

Check the Windows registry for connection data (you may or may not recover)

Approach the websites for evidence

The offset in a hexadecimal code is:

The 0x at the beginning of the code

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

the same log is used at all times

a new log file is created everyday

a new log file is created each week

a new log is created each time the Web Server is started

Lance wants to place a honeypot on his network. Which of the following would be your recommendations?

It doesn't matter as all replies are faked

Use a system that has a dynamic addressing on the network

Use a system that is not directly interacting with the router

Use it on a system in an external DMZ in front of the firewall

It doesn't matter as all replies are faked

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.

All forms should be placed in an approved secure container because they are now primary evidence in the case.

The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.

The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file.

All forms should be placed in the report file because they are now primary evidence in the case.

The MD5 program is used to:

verify that a disk is not altered when you examine it

wipe magnetic media before recycling it

make directories on an evidence disk

view graphics files on an evidence drive

verify that a disk is not altered when you examine it

Which is a standard procedure to perform during all computer forensics investigations?

with the hard drive removed from the suspect PC, check the date and time in the system's CMOS

with the hard drive in the suspect PC, check the date and time in the File Allocation Table

with the hard drive removed from the suspect PC, check the date and time in the system's RAM

with the hard drive in the suspect PC, check the date and time in the system's CMOS

E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

user account that was used to send the account

date and time the message was sent

user account that was used to send the account

attachments sent with the e-mail message

date and time the message was sent

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

one who has lots of allocation units per block or cluster

one who has NTFS 4 or 5 partitions

one who uses dynamic swap file capability

one who uses hard disk writes on IRQ 13 and 21

one who has lots of allocation units per block or cluster

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence in a criminal case must be secured more tightly than in a civil case

evidence must be handled in the same way regardless of the type of case

evidence procedures are not important unless you work for a law enforcement agency

evidence in a criminal case must be secured more tightly than in a civil case

evidence in a civil case must be secured more tightly than in a criminal case

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab

make an MD5 hash of the evidence and compare it to the standard database developed by NIST

there is no reason to worry about this possible claim because state labs are certified

sign a statement attesting that the evidence is the same as it was when it entered the lab

Study the log given below and answer the following question:Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0)Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506)Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

Disallow UDP53 in from outside to DNS server

Allow UDP53 in from DNS server to outside

Disallow TCP53 in from secondaries or ISP server to DNS server

When investigating a potential e-mail crime, what is your first step in the investigation?

Trace the IP address to its origin

Determine whether a crime was actually committed

If a suspect computer is located in an area that may have toxic chemicals, you must:

coordinate with the HAZMAT team

determine a way to obtain the suspect computer

assume the suspect machine is contaminated

The following excerpt is taken from a honeypot log. The log captures activities across three days.There are several intrusion attempts; however, a few are successful.(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.)Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0)Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506)Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558From the options given below choose the one which best interprets the following entry:Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

Data being retrieved from 63.226.81.13

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

only the reference to the file is removed from the FAT

the file is erased and cannot be recovered

a copy of the file is stored and the original file is erased

the file is erased but can be recovered

ECCouncil 312-49v10 Practice Test 1 - Free Online Exam Prep & Questions

When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

Title 18, Section 1030

Title 18, Section 2703(d)

Title 18, Section Chapter 90

Title 18, Section 2703(f)

Comment (0)

ECCouncil 312-49v10 Practice Test 1

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests