EC-COUNCIL 312-49 問題集

質問 1：
Where are files temporarily written in Unix when printing?
A. /var/print
B. /var/spool
C. /spool
D. /usr/spool
正解：B

質問 2：
Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?
22,164 cylinders/disk
80 heads/cylinder
63 sectors/track
A. 53.26 GB
B. 57.19 GB
C. 11.17 GB
D. 10 GB
正解：B

質問 3：
While looking through the IIS log file of a web server, you find the following entries:

What is evident from this log file?
A. Cross site scripting
B. SQL injection is possible
C. Web bugs
D. Hidden fields
正解：B

質問 4：
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h.?What does this indicate on the computer?replaced by the hex code byte ?5h.?What does this indicate on the computer?
A. The files are corrupt and cannot be recovered
B. The files have been marked as hidden
C. The files have been marked as read-only
D. The files have been marked for deletion
正解：D

質問 5：
What technique is used by JPEGs for compression?
A. TIFF-8
B. ZIP
C. TCD
D. DCT
正解：D

質問 6：
Davidson Trucking is a small transportation company that has three local offices in Detroit
Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated. When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?
A. Employees themselves
B. Supervisors
C. IT personnel
D. Administrative assistant in charge of writing policies
正解：B

質問 7：
You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company? IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?
A. Session
B. Transport
C. Network
D. Data Link
正解：C

質問 8：
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf?John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce?
A. It contains the times and dates of when the system was last patched
B. Hidden running processes
C. It is not necessary to scan the virtual memory of a computer
D. It contains the times and dates of all the system files
正解：B

質問 9：
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?
A. Offset
B. Key escrow
C. Rootkit
D. Steganography
正解：D