Which of the following information is displayed when Netstat is used with -ano switch?

Details of TCP and UDP connections

While collecting Active Transaction Logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file. Here, assigning NULL values implies?

Start and end points for log files are not specified

Start and end points for log sequence numbers are specified

Start and end points for log files are not specified

Start and end points for log files are specified

Start and end points for log sequence numbers are not specified

Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\.

All values in this subkey run when specific user logs on and then the values are deleted

All the values in this subkey run when specific user logs on, as this setting is user-specific

The string specified in the value run executes when user logs on

All the values in this key are executed at system start-up

All values in this subkey run when specific user logs on and then the values are deleted

An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine. What would he do to achieve this?

Set the registry value ofHKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1

Set the registry value ofHKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 0

Run the command fsutil behavior set disablelastaccess 0

Set the registry value ofHKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1

Run the command fsutil behavior set enablelastaccess 0

Which U.S. law sets the rules for sending emails for commercial purposes, establishes the minimum requirements for commercial messaging, gives the recipients of emails the right to ask the senders to stop emailing them, and spells out the penalties in case the above said rules are violated?

American: NAVSO P-5239-26 (RLL)

Which of the following statements is TRUE about SQL Server error logs?

Forensic investigator uses SQL Server Profiler to view error log files

SQL Server error logs record all the events occurred on the SQL Server and its databases

Forensic investigator uses SQL Server Profiler to view error log files

Error logs contain IP address of SQL Server client connections

Trace files record, user-defined events, and specific system events

Consider that you are investigating a machine running an Windows OS released prior to Windows Vist a. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:\Recycler\\. You read an entry named "Dd5.exe". What does Dd5.exe mean?

D drive, fourth file restored, a .exe file

D drive. fifth file deleted, a .exe file

D drive, fourth file restored, a .exe file

D drive, fourth file deleted, a .exe file

D drive, sixth file deleted, a .exe file

Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the icon in the checkpoint logs represent?

The firewall dropped a connection

The firewall rejected a connection

A virus was detected in an email

The firewall dropped a connection

An email was marked as potential spam

Which among the following web application threats is resulted when developers expose various internal implementation objects, such as files, directories, database records, or key-through references?

Insecure Direct Object References

What does Locard's Exchange Principle state?

Anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave

Any information of probative value that is either stored or transmitted in a digital form

Digital evidence must have some characteristics to be disclosed in the court of law

Anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave

Forensic investigators face many challenges during forensics investigation of a digital crime, such as extracting, preserving, and analyzing the digital evidence

Smith is an IT technician that has been appointed to his company's network vulnerability assessment team. He is the only IT employee on the team. The other team members include employees from Accounting, Management, Shipping, and Marketing. Smith and the team members are having their first meeting to discuss how they will proceed. What is the first step they should do to create the network vulnerability assessment plan?

Their first step is the acquisition of required documents, reviewing of security policies and compliance.

Their first step is to make a hypothesis of what their final findings will be.

Their first step is to create an initial Executive report to show the management team.

Their first step is to analyze the data they have currently gathered from the company or interviews.

Their first step is the acquisition of required documents, reviewing of security policies and compliance.

Which forensic investigation methodology believes that criminals commit crimes solely to benefit their criminal enterprises?

Enterprise Theory of Investigation

Scientific Working Group on Digital Evidence

Enterprise Theory of Investigation

Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

Heuristic/Behavior-Based Detection

What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

BIOS Parameter Block (BPB) and the extended BPB

Jump instruction and the OEM ID

BIOS Parameter Block (BPB) and the OEM ID

BIOS Parameter Block (BPB) and the extended BPB

Bootstrap code and the end of the sector marker

What does the Rule 101 of Federal Rules of Evidence states?

Scope of the Rules, where they can be applied

Limited Admissibility of the Evidence

You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?

To control the room temperature

To strengthen the walls, ceilings, and floor

To avoid electromagnetic emanations

James is dealing with a case regarding a cybercrime that has taken place in Arizona, US

Third Amendment of the U.S. Constitution

James needs to lawfully seize the evidence from an electronic device without affecting the user's anonymity. Which of the following law should he comply with, before retrieving the evidence?

First Amendment of the U.S. Constitution

Fourth Amendment of the U.S. Constitution

Third Amendment of the U.S. Constitution

Fifth Amendment of the U.S. Constitution

Which of the following stand true for BIOS Parameter Block?

The BIOS Partition Block describes the physical layout of a data storage volume

The BIOS Partition Block is the first sector of a data storage device

The length of BIOS Partition Block remains the same across all the file systems

The BIOS Partition Block always refers to the 512-byte boot sector

Which Event Correlation approach assumes and predicts what an attacker can do next after the attack by studying statistics and probability?

Profile/Fingerprint-Based Approach

Time (Clock Time) or Role-Based Approach

ECCouncil 312-49v10 Practice Test 15 - Free Online Exam Prep & Questions

In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 312-49v10 Practice Test 15

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests