EC-COUNCIL 312-49 問題集

質問 1：
What feature of Windows is the following command trying to utilize?

A. Slack file
B. AFS
C. ADS
D. White space
正解：C

質問 2：
What file is processed at the end of a Windows XP boot to initialize the logon dialog box?
A. LSASS.EXE
B. NTDETECT.COM
C. NTLDR
D. NTOSKRNL.EXE
正解：A

質問 3：
During the course of a corporate investigation, you find that an employee is committing a federal crime. Can the employer file a criminal complain with the police?
A. Yes, and all evidence can be turned over to the police
B. No, because the investigation was conducted without a warrant
C. Yes, but only if you turn the evidence over to a district judge
D. No, because the investigation was conducted without following standard police procedures
正解：A

質問 4：
Using Internet logging software to investigate a case of malicious use of computers, the investigator comes across some entries that appear odd.

From the log, the investigator can see where the person in question went on the Internet.
From the log, it appears that the user was manually typing in different user ID numbers.
What technique this user was trying?
A. Parameter tampering
B. Cross site scripting
C. SQL injection
D. Cookie Poisoning
正解：A

質問 5：
When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages?view the website? collection of pages?
A. Samspade.org
B. Dnsstuff.com
C. Proxify.net
D. Archive.org
正解：D

質問 6：
Why would you need to find out the gateway of a device when investigating a wireless attack?
A. The gateway will be the IP of the proxy server used by the attacker to launch the attack
B. The gateway will be the IP used to manage the RADIUS server
C. The gateway will be the IP used to manage the access point
D. The gateway will be the IP of the attacker computerThe gateway will be the IP of the attacker? computer
正解：C

質問 7：
What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?
A. ARP redirect
B. Denial of service
C. Physical attack
D. Digital attack
正解：B

質問 8：
Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror
A. Search for disk errors within an image file
B. Backup a disk to an image file
C. Restore a disk from an image file
D. Copy a partition to an image file
正解：C

質問 9：
Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for.
Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report?
A. TIFF-8
B. DOC
C. WPD
D. PDF
正解：D