EC-COUNCIL 312-49 問題集

質問 1：
Where is the startup configuration located on a router?
A. Dynamic RAM
B. BootROM
C. NVRAM
D. Static RAM
正解：C

質問 2：
Why should you never power on a computer that you need to acquire digital evidence from?
A. When the computer boots up, data in the memory buffer is cleared which could destroy evidenceWhen the computer boots up, data in the memory? buffer is cleared which could destroy evidence
B. When the computer boots up, files are written to the computer rendering the data nclean?When the computer boots up, files are written to the computer rendering the data
?nclean
C. Powering on a computer has no affect when needing to acquire digital evidence from it
D. When the computer boots up, the system cache is cleared which could destroy evidence
正解：B

質問 3：
Why would a company issue a dongle with the software they sell?
A. To provide copyright protection
B. To provide source code protection
C. To provide wireless functionality with the software
D. To ensure that keyloggers cannot be used
正解：A

質問 4：
This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.
A. Victim advocate testimony
B. Technical testimony
C. Civil litigation testimony
D. Expert testimony
正解：B

質問 5：
The offset in a hexadecimal code is:
A. The last byte after the colon
B. The 0x at the beginning of the code
C. The 0x at the end of the code
D. The first byte after the colon
正解：B

質問 6：
What binary coding is used most often for e-mail purposes?
A. MIME
B. Uuencode
C. IMAP
D. SMTP
正解：A

質問 7：
What type of analysis helps to identify the time and sequence of events in an investigation?
A. Functional
B. Temporal
C. Time-based
D. Relational
正解：B

質問 8：
Jones had been trying to penetrate a remote production system for the past two weeks.
This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones. What is a virtual environment?
A. An environment set up after the user logs in
B. An environment set up before an user logs in
C. A honeypot that traps hackers
D. A system using Trojaned commands
正解：C

質問 9：
A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?
A. Blu-Ray dual-layer
B. HD-DVD
C. DVD-18
D. Blu-Ray single-layer
正解：A