EC-COUNCIL 312-49 問題集

質問 1：
What advantage does the tool Evidor have over the built-in Windows search?
A. It can find bad sectors on the hard drive
B. It can find files hidden within ADS
C. It can search slack space
D. It can find deleted files even after they have been physically removed
正解：C

質問 2：
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
A. Write-blocker
B. Firewall
C. Protocol analyzer
D. Disk editor
正解：A

質問 3：
You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?
A. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container
B. All forms should be placed in the report file because they are now primary evidence in the case
C. The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file
D. All forms should be placed in an approved secure container because they are now primary evidence in the case
正解：A

質問 4：
Why should you never power on a computer that you need to acquire digital evidence from?
A. When the computer boots up, data in the memory buffer is cleared which could destroy evidenceWhen the computer boots up, data in the memory? buffer is cleared which could destroy evidence
B. When the computer boots up, files are written to the computer rendering the data nclean?When the computer boots up, files are written to the computer rendering the data
?nclean
C. Powering on a computer has no affect when needing to acquire digital evidence from it
D. When the computer boots up, the system cache is cleared which could destroy evidence
正解：B

質問 5：
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?
A. Chain of custody
B. Law of probability
C. Policy of separation
D. Rules of evidence
正解：A

質問 6：
How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?
A. 48
B. 32
C. 16
D. 64
正解：B

質問 7：
What type of attack sends SYN requests to a target system with spoofed IP addresses?
A. Ping of death
B. Cross site scripting
C. Land
D. SYN flood
正解：D

質問 8：
Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?
A. Search warrant
B. Wire tap
C. Subpoena
D. Bench warrant
正解：A

質問 9：
How often must a company keep log files for them to be admissible in a court of law?
A. All log files are admissible in court no matter their frequency
B. Weekly
C. Monthly
D. Continuously
正解：D