When cataloging digital evidence, the primary goal is to

Make bit-stream images of all hard drives

Not remove the evidence from the scene

Not allow the computer to be turned off

As a CHFI professional, which of the following is the most important to your professional reputation?

The correct, successful management of each and every case

The friendship of local law enforcement officers

In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

The ISP can investigate anyone using their service and can provide you with assistance

The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant

The ISP can't conduct any type of investigations on anyone and therefore can't assist you

ISP's never maintain log files so they would be of no use to your investigation

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?

Any data not yet flushed to the system will be lost

All running processes will be lost

The /tmp directory will be flushed

Power interruption will corrupt the pagefile

Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run

HKEY_LOCAL_MACHINE\hardware\windows\start

HKEY_LOCAL_USERS\Software\Microsoft\old\Version\Load

HKEY_CURRENT_USER\Microsoft\Default

HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run

Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?

Send DOS commands to crash the DNS servers

Enumerate all the users in the domain

What will the following command produce on a website login page? SELECT email, passwd, login_id, full_name FROM members WHERE email = 'someone@somehwere.com'; DROP TABLE members; --'

Deletes the entire members table

Inserts the Error! Reference source not found.email address into the members table

Retrieves the password for the first user in the members table

This command will not produce anything since the syntax is incorrect

You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test." What is the result of this test?

Your website is vulnerable to CSS

Your website is vulnerable to SQL injection

Your website is vulnerable to web bugs

If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

The zombie will not send a response

You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?

Application-level proxy firewall

You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers: http://172.168.4.131/level/99/exec/show/configAfter typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

HTTP Configuration Arbitrary Administrative Access Vulnerability

HTML Configuration Arbitrary Administrative Access Vulnerability

Cisco IOS Arbitrary Administrative Access Online Vulnerability

URL Obfuscation Arbitrary Administrative Access Vulnerability

What is the following command trying to accomplish?

Verify that UDP port 445 is open for the 192.168.0.0 network

Verify that TCP port 445 is open for the 192.168.0.0 network

Verify that NETBIOS is running for the 192.168.0.0 network

Verify that UDP port 445 is closed for the 192.168.0.0 network

You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it.Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?

Passwords of 14 characters or less are broken up into two 7-character hashes

A password Group Policy change takes at least 3 weeks to completely replicate throughout a network

Networks using Active Directory never use SAM databases so the SAM database pulled was empty

The passwords that were cracked are local accounts on the Domain Controller

An "idle" system is also referred to as what?

PC not connected to the Internet

John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sendsHillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

Hillary network username and password hash

The SID of Hillary network account

The SAM file from Hillary computer

The network shares that Hillary has permissions

Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers.Bill protects the PDF documents with a password and sends them to their intended recipients.Why PDF passwords do not offer maximum protection?

PDF passwords can easily be cracked by software brute force tools

PDF passwords are converted to clear text when sent through E-mail

PDF passwords are not considered safe by Sarbanes-Oxley

When sent through E-mail, PDF passwords are stripped from the document completely

What is the target host IP in the following command?

Firewalk does not scan target hosts

This command is using FIN packets, which cannot scan target hosts

George is a senior security analyst working for a state agency in Florid a. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time-based induction machine" be used.What IDS feature must George implement to meet this requirement?

Signature-based anomaly detection

Statistical-based anomaly detection

John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced byFirewalk. Why is that?

Firewalk sets all packets with a TTL of one

Firewalk cannot pass through Cisco firewalls

Firewalk sets all packets with a TTL of zero

Firewalk cannot be detected by network sniffers

Firewalk sets all packets with a TTL of one

George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation?

Nessus cannot perform wireless testing

Nessus is not a network scanner

There are no ways of performing a "stealthy" wireless scan

ECCouncil 312-49v10 Practice Test 4 - Free Online Exam Prep & Questions

A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

Mere Suspicion

A preponderance of the evidence

Probable cause

Beyond a reasonable doubt

Comment (0)

ECCouncil 312-49v10 Practice Test 4

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests