312-49v9 EC-Council Exam Questions and Free Practice Test

Question 13

- (Topic 3)
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document.
What is that code called?

A. the Microsoft Virtual Machine Identifier

B. the Personal Application Protocol

C. the Globally Unique ID

D. the Individual ASCII String

Correct Answer:C

Question 14

- (Topic 3)
All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

A. Blackberry Message Center

B. Microsoft Exchange

C. Blackberry WAP gateway

D. Blackberry WEP gateway

Correct Answer:A

Question 15

- (Topic 3)
What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?

A. ICMP header field

B. TCP header field

C. IP header field

D. UDP header field

Correct Answer:A
The Ping of Death occurs when the ICMP Header field contains a packet size lager than 65507 bytes.

Question 16

- (Topic 1)
Which Is a Linux journaling file system?

A. Ext3

B. HFS

C. FAT

D. BFS

Correct Answer:A

Question 17

- (Topic 3)
Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

A. Point-to-point

B. End-to-end

C. Thorough

D. Complete event analysis

Correct Answer:B

Question 18

- (Topic 3)
Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?

A. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media

B. Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence

C. Connect the target media; Delete the system for acquisition; Secure the evidence; Copy the media

D. Secure the evidence; Prepare the system for acquisition; Connect the target media; Copy the media

Correct Answer:B

START 312-49v9 EXAM