EC-COUNCIL 312-49 問題集

質問 1：
How many times can data be written to a DVD+R disk?
A. Infinite
B. Once
C. Twice
D. Zero
正解：B

質問 2：
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
A. All virtual memory will be deleted
B. The computer will be set in a constant reboot state
C. This action can corrupt the disk
D. The wrong partition may be set to active
正解：C

質問 3：
You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the
Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?
A. Bit-stream copy
B. Full backup copy
C. Incremental backup copy
D. Robust copy
正解：A

質問 4：
What does the acronym POST mean as it relates to a PC?
A. Primary Operations Short Test
B. Primary Operating System Test
C. Power On Self Test
D. Pre Operational Situation Test
正解：C

質問 5：
What layer of the OSI model do TCP and UDP utilize?
A. Session
B. Transport
C. Network
D. Data Link
正解：B

質問 6：
If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?
A. Time-loss compression
B. Lossless compression
C. Lossy compression
D. Lossful compression
正解：C

質問 7：
What will the following command accomplish in Linux? fdisk /dev/hda
A. Format the hard drive
B. Fill the disk with zeros
C. Partition the hard drive
D. Delete all files under the /dev/hda folder
正解：C

質問 8：
What happens when a file is deleted by a Microsoft operating system using the FAT file system?
A. The file is erased and cannot be recovered
B. The file is erased but can be recovered partially
C. A copy of the file is stored and the original file is erased
D. Only the reference to the file is removed from the FAT and can be recovered
正解：D

質問 9：
What will the following command accomplish? dd if=/dev/xxx of=mbr.backup bs=512 count=1
A. Back up the master boot record
B. Restore the master boot record
C. Mount the master boot record on the first partition of the hard drive
D. Restore the first 512 bytes of the first partition of the hard drive
正解：A