EC-COUNCIL 312-49 問題集

質問 1：
All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?
A. Blackberry WAP gateway
B. Blackberry WEP gateway
C. Microsoft Exchange
D. Blackberry Message Center
正解：D

質問 2：
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?
A. Offset
B. Key escrow
C. Rootkit
D. Steganography
正解：D

質問 3：
The use of warning banners helps a company avoid litigation by overcoming an employees assumed _________ when connecting to the company intranet, network, or virtual private network (VPN) and will allow the company investigators to monitor, search, and retrievecompany? intranet, network, or virtual private network (VPN) and will allow the company? investigators to monitor, search, and retrieve information stored within the network.
A. Right of free speech
B. Right of privacy
C. Right to Internet access
D. Right to work
正解：B

質問 4：
You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question wheather evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?
A. Sign a statement attesting that the evidence is the same as it was when it entered the lab
B. Make MD5 hashes of the evidence and compare it to the standard database developed by NIST
C. Make MD5 hashes of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
D. There is no reason to worry about this possible claim because state labs are certified
正解：C

質問 5：
What feature of Windows is the following command trying to utilize?

A. Slack file
B. AFS
C. ADS
D. White space
正解：C

質問 6：
A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

What can the investigator infer from the screenshot seen below?
A. Network intrusion has occurred
B. Buffer overflow attempt on the firewall.
C. A smurf attack has been attempted
D. A denial of service has been attempted
正解：A

質問 7：
What happens when a file is deleted by a Microsoft operating system using the FAT file system?
A. The file is erased and cannot be recovered
B. The file is erased but can be recovered partially
C. A copy of the file is stored and the original file is erased
D. Only the reference to the file is removed from the FAT and can be recovered
正解：D

質問 8：
What should you do when approached by a reporter about a case that you are working on or have worked on?
A. Say, o comment?Say, ?o comment
B. Answer only the questions that help your case
C. Answer all the reporter questions as completely as possibleAnswer all the reporter? questions as completely as possible
D. Refer the reporter to the attorney that retained you
正解：A

質問 9：
What will the following Linux command accomplish? dd if=/dev/mem
of=/home/sam/mem.bin bs=1024
A. Copy the contents of the system folder em?to a fileCopy the contents of the system folder ?em?to a file
B. Copy the master boot record to a file
C. Copy the running memory to a file
D. Copy the memory dump file to an image file
正解：C