EC-COUNCIL EC0-349 問題集

質問 1：
What layer of the OSI model do TCP and UDP utilize?
A. Session
B. Transport
C. Network
D. Data Link
正解：B

質問 2：
Software firewalls work at which layer of the OSI model?
A. Application
B. Transport
C. Network
D. Data Link
正解：D

質問 3：
Which of the following is not a part of the technical specification of the laboratory-based imaging system?
A. very low image capture rate
B. High performance workstation PC
C. Anti-repudiation techniques
D. Remote preview and imaging pod
正解：A

質問 4：
When reviewing web logs, you see an entry for esource not found?in the HTTP status code field.
What is the actual error code that you wouldWhen reviewing web logs, you see an entry for ?esource not found?in the HTTP status code field. What is the actual error code that you would see in the log for esource not found?see in the log for ?esource not found?
A. 606
B. 202
C. 999
D. 404
正解：D

質問 5：
What will the following URL produce in an unpatched IIS Web Server?
http://www.thetargetsite.com/scripts/..%
co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\
A. Directory listing of the C:\windows\system32 folder on the web server
B. Execute a buffer flow in the C: drive of the web server
C. Directory listing of C: drive on the web server
D. Insert a Trojan horse into the C: drive of the web server
正解：C

質問 6：
Which device in a wireless local area network (WLAN) determines the next network point to which a packet should be forwarded toward its destination?
A. Antenna
B. Wireless modem
C. Mobile station
D. Wireless router
正解：D

質問 7：
You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments.
What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?
A. Bit-stream copy
B. Full backup copy
C. Incremental backup copy
D. Robust copy
正解：A

質問 8：
Which is a standard procedure to perform during all computer forensics investigations?
A. With the hard drive removed from the suspect PC, check the date and time in the system CMOS
B. With the hard drive removed from the suspect PC, check the date and time in the system RAM
C. With the hard drive in the suspect PC, check the date and time in the File Allocation Table
D. With the hard drive in the suspect PC, check the date and time in the system CMOS
正解：A