無料312-49試験ブレーン問題集認定ガイド問題と解答 [Q201-Q223]

無料312-49試験ブレーン問題集認定ガイド問題と解答

312-49認定概要最新の312-49PDF問題集

EC-COUNCIL 312-49 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Windows Forensics: This domain includes collecting and analyzing volatile and non-volatile data, registry analysis, event logs, user artifacts (LNK, jump lists), memory forensics, and Windows application artifacts.
トピック 2	IoT Forensics: Studies forensic investigation of Internet of Things devices, embedded systems, networked sensors, smart home devices, and artifacts from IoT ecosystems.
トピック 3	Email and Social Media Forensics: Examines email protocols, header analysis, social media data investigation, artifacts from messaging platforms, and legal aspects of digital correspondence.
トピック 4	Mobile Forensics: Includes forensic acquisition and analysis of mobile devices (Android, iOS), file systems, app data, call logs, SMS, rooting jailbreaking, and mobile OS artifacts.
トピック 5	Defeating Anti-Forensics Techniques: Covers anti-forensic methods such as data hiding, steganography, file wiping, encryption, metadata tampering, trail obfuscation, and countermeasures.
トピック 6	Dark Web Forensics: Focuses on forensic strategies for the dark web: understanding Tor networks, analyzing dark web artifacts, tracing hidden transactions, and dark web investigation best practices.
トピック 7	Linux and Mac Forensics: This domain examines forensic investigation in Unix Linux and macOS systems, volatile memory capture, file systems (e.g., ext, APFS), logs, and operating system-specific artifacts.
トピック 8	Understanding Hard Disks and File Systems: Deals with disk structure, partitioning, file systems (NTFS, FAT, ext, HFS), boot process of different OS (Windows, Linux, macOS), and low-level file system behaviors.
トピック 9	Cloud Forensics: Explores forensic methods in cloud environments (AWS, Azure, GCP), cloud storage, virtual machine artifacts, and challenges in multi-tenant environments.
トピック 10	Network Forensics: Covers capturing and analyzing network traffic, event correlation, investigating intrusions, identifying indicators of compromise (IoCs), and wireless forensics.
トピック 11	Malware Forensics: Covers static & dynamic malware analysis, behavior and network behavior analysis, ransomware, code analysis, and linking malware to forensic evidence.
トピック 12	Data Acquisition and Duplication: This domain focuses on techniques for acquiring forensic images, live vs dead acquisition, order of volatility, forensic duplication, and ensuring the integrity of data.
トピック 13	Investigating Web Attacks: Deals with the analysis of web application logs, web server artifacts (IIS, Apache), examining attack vectors on websites, and related forensic techniques.

質問 # 201
How many possible sequence number combinations are there in TCP/IP protocol?

A. 320 billion
B. 1 billion
C. 4 billion
D. 32 million

正解：C

質問 # 202
Which of the following technique creates a replica of an evidence media?

A. Data Deduplication
B. Data Extraction
C. Bit Stream Imaging
D. Backup

正解：C

質問 # 203
Which code does the FAT file system use to mark the file as deleted?

A. 5EH
B. H5E
C. E5H
D. ESH

正解：C

質問 # 204
Paraben Lockdown device uses which operating system to write hard drive data?Paraben?
Lockdown device uses which operating system to write hard drive data?

A. Windows
B. Unix
C. Red Hat
D. Mac OS

正解：A

質問 # 205
You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing?

A. List weak points on their network
B. Show outdated equipment so it can be replaced
C. Demonstrate that no system can be protected against DoS attacks
D. Use attack as a launching point to penetrate deeper into the network

正解：A

質問 # 206
Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\<USER SID>\ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?

A. It is a doc file deleted in seventh sequential order
B. RIYG6VR.doc is the name of the doc file deleted from the system
C. It is file deleted from R drive
D. It is a deleted doc file

正解：D

質問 # 207
When investigating a wireless attack, what information can be obtained from the DHCP logs?

A. The operating system of the attacker and victim computers
B. MAC address of the attacker
C. If any computers on the network are running in promiscuous mode
D. IP traffic between the attacker and the victim

正解：B

質問 # 208
Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to findThese 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather? responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused. In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples?desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other. What type of cipher was used by the accused in this case?

A. Text semagram
B. Grill cipher
C. Visual semagram
D. Null cipher

正解：B

質問 # 209
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h.?What does this indicate on the computer?replaced by the hex code byte ?5h.?What does this indicate on the computer?

A. The files have been marked for deletion
B. The files are corrupt and cannot be recovered
C. The files have been marked as read-only
D. The files have been marked as hidden

正解：A

質問 # 210
John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they shouldJohn is working on his company? policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should
John write in the guidelines to be used when destroying documents?

A. Strip-cut shredder
B. Cross-hatch shredder
C. Cross-cut shredder
D. Cris-cross shredder

正解：C

質問 # 211
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to
1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?

A. There is no way to always prevent an anonymous null session from establishing
B. RestrictAnonymous must be set to "2" for complete security
C. RestrictAnonymous must be set to "3" for complete security
D. RestrictAnonymous must be set to "10" for complete security

正解：B

質問 # 212
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

A. The Underscore Symbol
B. A Capital X
C. A Blank Space
D. The lowercase Greek Letter Sigma (s)

正解：D

質問 # 213
What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

A. Trademark
B. Utility patent
C. Design patent
D. Copyright

正解：B

質問 # 214
You are running through a series of tests on your network to check for any security vulnerabilities.
After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?

A. The firewall ACL has been purged
B. The firewall failed-bypass
C. The firewall failed-closed
D. The firewall failed-open

正解：D

質問 # 215
What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

A. Automatically created restore points
B. Restore point interval
C. Restore point functions
D. System CheckPoints required for restoring

正解：D

質問 # 216
Lynne receives the following email:
Dear [email protected]! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24 You have 24 hours to fix this problem or risk to be closed permanently!
To proceed Please Connect >> My Apple ID
Thank You The link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/ What type of attack is this?

A. Email Spoofing
B. Email Spamming
C. Mail Bombing
D. Phishing

正解：D

質問 # 217
When examining a file with a Hex Editor, what space does the file header occupy?

A. the first several bytes of the file
B. the last several bytes of the file
C. none, file headers are contained in the FAT
D. one byte at the beginning of the file

正解：D

質問 # 218
Where are files temporarily written in Unix when printing?

A. /var/print
B. /var/spool
C. /usr/spool
D. /spool

正解：B

質問 # 219
Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

A. Physical
B. Transport
C. Network
D. Data Link

正解：A

質問 # 220
Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?

A. Strings search
B. Identifying File Dependencies
C. File obfuscation
D. Dynamic analysis

正解：A

解説：
Explanation/Reference:

質問 # 221
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

A. The wrong partition may be set to active
B. This action can corrupt the disk
C. All virtual memory will be deleted
D. The computer will be set in a constant reboot state

正解：B

質問 # 222
You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?