Recently, an Internal web app that a government agency utilizes has become unresponsive, Betty, a network engineer for the government agency, has been tasked to determine the cause of the web application's unresponsiveness. Betty launches Wlreshark and begins capturing the traffic on the local network. While analyzing the results, Betty noticed that a syn flood attack was underway. How did Betty know a syn flood attack was occurring?

Wireshark capture shows multiple SYN requests and RST responses from single/multiple IP address(es)

Wireshark capture shows multiple ACK requests and SYN responses from single/multiple IP address(es)

Wireshark capture does not show anything unusual and the issue is related to the web application

Wireshark capture shows multiple SYN requests and RST responses from single/multiple IP address(es)

Wireshark capture shows multiple SYN requests and ACK responses from single/multiple IP address(es)

Edgar is part of the FBI's forensic media and malware analysis team; he Is analyzing a current malware and Is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar's approach Is to execute the malware code to know how It Interacts with the host system and Its Impacts on It. He is also using a virtual machine and a sandbox environment.What type of malware analysis is Edgar performing?

Dynamic malware analysis/behavioral analysis

A computer forensics Investigator or forensic analyst Is a specially trained professional who works with law enforcement as well as private businesses to retrieve Information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer. Which of the following is not a duty of the analyst during a criminal investigation?

To create an investigation report

To recover data from suspect devices

To enforce the security of all devices and software in the scene

Rule 1002 of Federal Rules of Evidence (US) talks about_____

Admissibility of other evidence of contents

Which of the following Ii considered as the starting point of a database and stores user data and database objects in an MS SQL server?

Transaction log data files (LDF)

Which of the following statements is true with respect to SSDs (solid-state drives)?

Faster data access, lower power usage, and higher reliability are some of the m<="" p="">

Like HDDs. SSDs also have moving parts

SSDs cannot store non-volatile data

SSDs contain tracks, clusters, and sectors to store data

Faster data access, lower power usage, and higher reliability are some of the m<="" p="">

The working of the Tor browser is based on which of the following concepts?

Both static and default routing

An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected Instance to perform further analysis and collected other data of evidentiary value. What should be their next step?

They should terminate the instance after taking necessary backup

They should pause the running instance

They should keep the instance running as it stores critical data

They should terminate all instances connected via the same VPC

They should terminate the instance after taking necessary backup

You are an information security analyst at a large pharmaceutical company. While performing a routine review of audit logs, you have noticed a significant amount of egress traffic to various IP addresses on destination port 22 during off- peak hours. You researched some of the IP addresses and found that many of them are in Eastern Europe. What is the most likely cause of this traffic?

Data is being exfiltrated by an advanced persistent threat (APT)

Malicious software on internal system is downloading research data from partner 5FTP servers in Eastern Europe

Internal systems are downloading automatic Windows updates

Data is being exfiltrated by an advanced persistent threat (APT)

The organization's primary internal DNS server has been compromised and is performing DNS zone transfers to malicious external entities

Data density of a disk drive is calculated by using_______

Track density, areal density, and bit density.

Slack space, bit density, and slack density.

Track space, bit area, and slack space.

Track density, areal density, and slack density.

Track density, areal density, and bit density.

For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?

SSN of the person collecting the evidence

Relevant circumstances surrounding the collection

General description of the evidence

Exact location the evidence was collected from

SSN of the person collecting the evidence

The information security manager at a national legal firm has received several alerts from the intrusion detection system that a known attack signature was detected against the organization's file server. What should the information security manager do first?

Disconnect the file server from the network

Report the incident to senior management

Update the anti-virus definitions on the file server

Disconnect the file server from the network

Manually investigate to verify that an incident has occurred

"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle Is advocated by which of the following?

The Association of Chief Police Officers (ACPO) Principles of Digital Evidence

Scientific Working Group on Imaging Technology (SWGIT)

A call detail record (CDR) provides metadata about calls made over a phone service. From the following data fields, which one Is not contained in a CDR.

A unique sequence number identifying the record

Phone number receiving the call

ECCouncil 312-49v10 Practice Test 17 - Free Online Exam Prep & Questions

Which of the following attacks refers to unintentional download of malicious software via the Internet? Here, an attacker exploits flaws in browser software to install malware merely by the user visiting the malicious website.

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 312-49v10 Practice Test 17

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests