Instant Download EC-COUNCIL 312-49v9 Free Updated Test Dumps [Q70-Q93]

Rate this post

Instant Download EC-COUNCIL: 312-49v9 Free Updated Test Dumps

Valid 312-49v9 FREE EXAM DUMPS QUESTIONS & ANSWERS

NO.70 In a FAT32 system, a 123 KB file will use how many sectors?

246

NO.71 What is the investigator trying to analyze if the system gives the following image as output?

All the logon sessions

Details of users who can logon

Currently active logon sessions

Inactive logon sessions

NO.72 Which of the following files stores information about local Dropbox installation and account, email IDs linked with the account, current version/build for the local application, the host_id, and local path information?

config.db

sigstore.db

host.db

filecache.db

NO.73 Wireless network discovery tools use two different methodologies to detect, monitor and log a WLAN device (i.e. active scanning and passive scanning). Active scanning methodology involves ____________and waiting for responses from available wireless networks.

Broadcasting a probe request frame

Sniffing the packets from the airwave

Scanning the network

Inspecting WLAN and surrounding networks

NO.74 Which of the following is a device monitoring tool?

Capsa

Driver Detective

Regshot

RAM Capturer

NO.75 What does ICMP Type 3/Code 13 mean?

Host Unreachable

Administratively Blocked

Port Unreachable

Protocol Unreachable

NO.76 What will the following URL produce in an unpatched IIS Web Server?
http://www.thetargetsite.com/scripts/..%
co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:

Directory listing of C: drive on the web server

Insert a Trojan horse into the C: drive of the web server

Execute a buffer flow in the C: drive of the web server

Directory listing of the C:windowssystem32 folder on the web server

NO.77 While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

Windows 10

Windows 8

Windows 7

Windows 8.1

NO.78 George was recently fired from his job as an IT analyst at Pitts and Company in Dallas
Texas. His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company network by cracking some ofcompany? Active Directory structure and to create network polices. George now wants to break into the company? network by cracking some of the service accounts he knows about. Which password cracking technique should George use in this situation?

Brute force attack

Syllable attack

Rule-based attack

Dictionary attack

NO.79 Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce.

All the values in this subkey run when specific user logs on, as this setting is user-specific

The string specified in the value run executes when user logs on

All the values in this key are executed at system start-up

All values in this subkey run when specific user logs on and then the values are deleted

NO.80 SMTP (Simple Mail Transfer protocol) receives outgoing mail from clients and validates source and destination addresses, and also sends and receives emails to and from other SMTP servers.

True

False

NO.81 George is a senior security analyst working for a state agency in Florida. His state’s congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a “time-based induction machine” be used.
What IDS feature must George implement to meet this requirement?

Signature-based anomaly detection

Pattern matching

Real-time anomaly detection

Statistical-based anomaly detection

NO.82 You are called in to assist the police in an investigation involving a suspected drug dealer.
The police searched the suspect house after aYou are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect? house after a warrant was obtained and they located a floppy disk in the suspect bedroom. The disk contains several files, but they appear to be passwordwarrant was obtained and they located a floppy disk in the suspect? bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you could use to obtain the password?

Limited force and library attack

Brute force and dictionary attack

Maximum force and thesaurus attack

Minimum force and appendix attack

NO.83 Which of the following Event Correlation Approaches is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

Route Correlation

Bayesian Correlation

Vulnerability-Based Approach

Rule-Based Approach

NO.84 Which file is a sequence of bytes organized into blocks understandable by the system’s linker?

None of these

source file

Object file

executable file

NO.85 If an attacker’s computer sends an IPID of 31400 to a zombie computer on an open port in
IDLE scanning, what will be the response?

31402

The zombie will not send a response

31401

31399

NO.86 An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s”,” -E as part of collecting the primary data file and logs from a database. What does the “WINCQQMK62867E” represent?

Operating system of the system

Network credentials of the database

Name of SQL Server

Name of the Database

NO.87 An executive had leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?

Real-Time Analysis

Packet Analysis

Postmortem Analysis

Malware Analysis

NO.88 In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence must be handled in the same way regardless of the type of case

evidence procedures are not important unless you work for a law enforcement agency

evidence in a criminal case must be secured more tightly than in a civil case

evidence in a civil case must be secured more tightly than in a criminal case

NO.89 System software password cracking is defined as cracking the operating system and all other utilities that enable a computer to function

True

False

NO.90 Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox, or overwhelm the server where the email address is hosted, to cause a denial-of-service attack?

Email spamming

Mail bombing

Phishing

Email spoofing

NO.91 When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

on the individual computer’s ARP cache

in the Web Server log files

in the DHCP Server log files

there is no way to determine the specific IP address

NO.92 You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company’s network. How would you answer?

Microsoft Methodology

Google Methodology

IBM Methodology

LPT Methodology

NO.93 Which device in a wireless local area network (WLAN) determines the next network point to which a packet should be forwarded toward its destination?

Wireless router

Wireless modem

Antenna

Mobile station