EC0-349試験無料問題集（490題）「EC-COUNCIL Computer Hacking Forensic Investigator 認定」

出題：1

Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges. Which of the following vulnerability/exploitation is referred above?

A. I/O exploitation

B. Timeout Exploitation

C. Session ID in URLs

D. Password Exploitation

正解：B 解答を投票する

出題：2

After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts responds to your ICMP pings; definitely not the number of hosts you were expecting. Why did this ping sweep only produce a few responses?

A. Only IBM AS/400 will reply to this scan

B. Only Windows systems will reply to this scan

C. Only Unix and Unix-like systems will reply to this scan

D. A switched network will not respond to packets sent to the broadcast address

正解：C 解答を投票する

出題：3

The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux.
Identify the Apache error log from the following logs.

A. http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0% af./..%c0%af./../winnt/system32/cmd.exe?/c+dir+c:\wintt\system32\Logfiles\W3SVC1

B. 127.0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200

C. 127.0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200

D. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration:
/export/home/live/ap/htdocs/test

正解：D 解答を投票する

出題：4

Which one of the following is not a consideration in a forensic readiness planning checklist?

A. Take permission from all employees of the organization

B. Identify the potential evidence available

C. Define the business states that need digital evidence

D. Decide the procedure for securely collecting the evidence that meets the requirement fn a forensically sound manner

正解：A 解答を投票する

出題：5

File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file

A. First 10 bytes

B. First 20 bytes

C. First 30 bytes

D. First 40 bytes

正解：B 解答を投票する

出題：6

An image is an artifact that reproduces the likeness of some subject. These are produced by optical devices (i.e. cameras, mirrors, lenses, telescopes, and microscopes).
Which property of the image shows you the number of colors available for each pixel in an image?

A. Image File Size

B. Pixel

C. File Formats

D. Bit Depth

正解：D 解答を投票する

出題：7

When you carve an image, recovering the image depends on which of the following skills?

A. Recovering the image from a tape backup

B. Recognizing the pattern of a corrupt file

C. Recovering the image from the tape backup

D. Recognizing the pattern of the header content

正解：D 解答を投票する

出題：8

You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:
http://172.168.4.131/level/99/exec/show/config
After typing in this URL, you are presented with the entire configuration file for that router.
What have you discovered?

A. HTTP Configuration Arbitrary Administrative Access Vulnerability

B. HTML Configuration Arbitrary Administrative Access Vulnerability

C. Cisco IOS Arbitrary Administrative Access Online Vulnerability

D. URL Obfuscation Arbitrary Administrative Access Vulnerability

正解：A 解答を投票する

出題：9

In an echo data hiding technique, the secret message is embedded into a __________as an echo.

A. Cover audio signal

B. Pseudo-random signal

C. Phase spectrum of a digital signal

D. Pseudo- spectrum signal

正解：A 解答を投票する

出題：10

Which of the following Wi-Fi chalking methods refers to drawing symbols in public places to advertise open Wi-Fi networks?

A. WarFlying

B. WarWalking

C. WarChalking

D. WarDhving

正解：C 解答を投票する

出題：11

What should you do when approached by a reporter about a case that you are working on or have worked on?

A. Answer only the questions that help your case

B. Answer all the reporter questions as completely as possibleAnswer all the reporter? questions as completely as possible

C. Refer the reporter to the attorney that retained you

D. Say, o comment?Say, ?o comment

正解：D 解答を投票する

出題：12

If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

A. CMOS

B. Boot.sys

C. Scandisk utility

D. boot.ini

E. deltree command

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：13

What will the following command accomplish?
C:\> nmap -v -sS -Po 172.16.28.251 - data_length 66000 - packet_trace

A. Test ability of a router to handle over-sized packets

B. Test the ability of a router to handle fragmented packets

C. Test the ability of a router to handle under-sized packets

D. Test the ability of a WLAN to handle fragmented packets

正解：A 解答を投票する

出題：14

SIM is a removable component that contains essential information about the subscriber. It has both volatile and non-volatile memory. The file system of a SIM resides in _____________ memory.

A. Non-volatile

B. Volatile

正解：A 解答を投票する

EC0-349試験無料問題集「EC-COUNCIL Computer Hacking Forensic Investigator 認定」