Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

Photograph and document the peripheral devices

Place PDA, including all devices, in an antistatic bag

Power off all devices if currently on

Photograph and document the peripheral devices

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled.Where could the investigator search to find the message tracking log file on the Exchange server?

C:\Program Files\Exchsrvr\servername.log

D:\Exchsrvr\Message Tracking\servername.log

C:\Exchsrvr\Message Tracking\servername.log

C:\Program Files\Microsoft Exchange\srvr\servername.log

John is working as a computer forensics investigator for a consulting firm in Canad a. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce?

It contains the times and dates of when the system was last patched

It is not necessary to scan the virtual memory of a computer

It contains the times and dates of all the system files

Where is the default location for Apache access logs on a Linux computer?

usr/local/apache/logs/access_log

bin/local/home/apache/logs/access_log

How often must a company keep log files for them to be admissible in a court of law?

All log files are admissible in court no matter their frequency

When should an MD5 hash check be performed when processing evidence?

Before and after evidence examination

After the evidence examination has been completed

On an hourly basis during the evidence examination

Before and after evidence examination

Before the evidence examination has been completed

Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan.Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem.Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated. When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?

Administrative assistant in charge of writing policies

Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus. He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

Those connections are in listening mode

Those connections are established

Those connections are in listening mode

Those connections are in closed/waiting mode

Those connections are in timed out/waiting mode

What is the first step taken in an investigation for laboratory forensic staff members?

Securing and evaluating the electronic crime scene

Packaging the electronic evidence

Securing and evaluating the electronic crime scene

Conducting preliminary interviews

Transporting the electronic evidence

What will the following command accomplish in Linux? fdisk /dev/hda

Delete all files under the /dev/hda folder

A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week. What can the investigator infer from the screenshot seen below?

A smurf attack has been attempted

A denial of service has been attempted

Buffer overflow attempt on the firewall.

When investigating a wireless attack, what information can be obtained from the DHCP logs?

The operating system of the attacker and victim computers

IP traffic between the attacker and the victim

If any computers on the network are running in promiscuous mode

ECCouncil 312-49v10 Practice Test 7 - Free Online Exam Prep & Questions

Question 1 / 40

Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgi a. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

Text semagram

Visual semagram

Grill cipher

Visual cipher

Comment (0)

ECCouncil 312-49v10 Practice Test 7

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests