EC-COUNCIL EC0-349 問題集

質問 1：
With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.
A. 0
B. 10
C. 1
D. 100
正解：A

質問 2：
You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would:
A. Cause network congestion
B. Write information to the subject hard driveWrite information to the subject? hard drive
C. Violate your contract
D. Make you an agent of law enforcement
正解：D

質問 3：
What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?
A. Internet service provider information
B. Username and password
C. E-mail header
D. Firewall log
正解：C

質問 4：
What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?
A. Fraggle
B. Teardrop
C. Smurf scan
D. SYN flood
正解：A

質問 5：
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
A. The manufacturer of the system compromised
B. The vulnerability exploited in the incident
C. The logic, formatting and elegance of the code used in the attack
D. The nature of the attack
正解：C

質問 6：
When using an iPod and the host computer is running Windows, what file system will be used?
A. FAT32
B. iPod+
C. HFS
D. FAT16
正解：A

質問 7：
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?
A. ISPs never maintain log files so they would be of no use to your investigation
B. The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant
C. The ISP can investigate anyone using their service and can provide you with assistance
D. The ISP cannot conduct any type of investigations on anyone and therefore cannot assist you
正解：B

質問 8：
When investigating a potential e-mail crime, what is your first step in the investigation?
A. Determine whether a crime was actually committed
B. Write a report
C. Trace the IP address to its origin
D. Recover the evidence
正解：C