EC-COUNCIL 312-49v10 問題集

質問 1：
Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling It. the dates and times when it Is being handled, and the place of storage of the evidence. What do you call this document?
A. Chain of custody
B. Authorization form
C. Log book
D. Consent form
正解：A

質問 2：
Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer's log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies' domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords. What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?
A. Dictionary attack
B. Hybrid attack
C. Syllable attack
D. Brute force attack
正解：A

質問 3：
What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?
A. ARP redirect
B. digital attack
C. physical attack
D. denial of service
正解：D

質問 4：
Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What Is the next thing he should do as a security measure?
A. Delete the snapshot from the source resource group
B. Create another VM by using the snapshot
C. Recommend changing the access policies followed by the company
D. Delete the OS disk of the affected VM altogether
正解：A

質問 5：
Which among the following laws emphasizes the need for each Federal agency to develop, document, and implement an organization-wide program to provide information security for the information systems that support its operations and assets?
A. HIPAA
B. FISMA
C. SOX
D. GLBA
正解：B

質問 6：
Before you are called to testify as an expert, what must an attorney do first?
A. read your curriculum vitae to the jury
B. prove that the tools you used to conduct your examination are perfect
C. engage in damage control
D. qualify you as an expert witness
正解：D