312-49v9 EC-Council Exam Questions and Free Practice Test

Question 91

- (Topic 2)
With regard to using an antivirus scanner during a computer forensics investigation, you should:

A. Scan the suspect hard drive before beginning an investigation

B. Never run a scan on your forensics workstation because it could change your system configurationNever run a scan on your forensics workstation because it could change your system? configuration

C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation

D. Scan your forensics workstation before beginning an investigation

Correct Answer:D

Question 92

- (Topic 1)
An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers. Which of the following statement is true for NTP Stratum Levels?

A. Stratum-0 servers are used on the network; they are not directly connected to computers which then operate as stratum-1 servers

B. Stratum-1 time server is linked over a network path to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions

C. A stratum-2 server is directly linked (not over a network path) to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions

D. A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on

Correct Answer:D

Question 93

- (Topic 3)
You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

A. The attorney-work-product rule

B. Good manners

C. Trade secrets

D. ISO 17799

Correct Answer:A

Question 94

- (Topic 1)
Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

A. It is difficult to deal with the webmail as there is no offline archive in most case

B. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers

C. Local archives do not have evidentiary value as the email client may alter the message data

D. Local archives should be stored together with the server storage archives in order to be admissible in a court of law

E. Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server

Correct Answer:A

Question 95

- (Topic 3)
Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

A. Windows computers will not respond to idle scans

B. Linux/Unix computers are easier to compromise

C. Windows computers are constantly talking

D. Linux/Unix computers are constantly talking

Correct Answer:C

Question 96

- (Topic 3)
When investigating a potential e-mail crime, what is your first step in the investigation?

A. Trace the IP address to its origin

B. Write a report

C. Determine whether a crime was actually committed

D. Recover the evidence

Correct Answer:A

START 312-49v9 EXAM