http://https://www.lead1pass.com/EC-COUNCIL/312-49-practice-exam-dumps.html (150 Q&As Dumps, 30%OFF Special Discount: 30free )

NEW QUESTION NO: 6
What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?
A. E-mail header
B. Internet service provider information
C. Username and password
D. Firewall log
Answer: A

NEW QUESTION NO: 7
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
A. The logic, formatting and elegance of the code used in the attack
B. The vulnerability exploited in the incident
C. The manufacturer of the system compromised
D. The nature of the attack
Answer: A

NEW QUESTION NO: 8
What file is processed at the end of a Windows XP boot to initialize the logon dialog box?
A. NTOSKRNL.EXE
B. NTLDR
C. NTDETECT.COM
D. LSASS.EXE
Answer: A

NEW QUESTION NO: 9
George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network.
What filter should George use in Ethereal?
A. net port 22
B. udp port 22 and host 172.16.28.1/24
C. src port 22 and dst port 22
D. src port 23 and dst port 23
Answer: C

NEW QUESTION NO: 10
Paraben Lockdown device uses which operating system to write hard drive data?
A. Mac OS
B. Red Hat
C. Windows
D. Unix
Answer: C

NEW QUESTION NO: 11
In the following email header, where did the email first originate from?

A. David1.state.ok.gov.us
B. Somedomain.com
C. Smtp1.somedomain.com
D. Simon1.state.ok.gov.us
Answer: D

NEW QUESTION NO: 12
Before performing a logical or physical search of a drive in Encase, what must be added to the program?
A. Keywords
B. Hash sets
C. File signatures
D. Bookmarks
Answer: A

NEW QUESTION NO: 13
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?
A. Nmap scan
B. Ping of death
C. Fraggle
D. Smurf
Answer: B

NEW QUESTION NO: 14
If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.
A. Boot.sys
B. CMOS
C. deltree command
D. Scandisk utility
Answer: A

NEW QUESTION NO: 15
If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?
A. Time-loss compression
B. Lossy compression
C. Lossless compression
D. Lossful compression
Answer: B

NEW QUESTION NO: 16
What does the acronym POST mean as it relates to a PC?
A. PowerOn Self Test
B. Pre Operational Situation Test
C. Primary Operating System Test
D. Primary Operations Short Test
Answer: A