[Oct-2021] Pass EC-COUNCIL 312-49 Exam in First Attempt Guaranteed!
Full 312-49 Practice Test and 150 unique questions with explanations waiting just for you, get it now!
NEW QUESTION 14
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it?
- A. Client mis-association
- B. Rogue access points
- C. Ad hoc associations
- D. MAC spoofing
Answer: A
NEW QUESTION 15
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?
- A. Networks using Active Directory never use SAM databases so the SAM database pulled was empty
- B. The passwords that were cracked are local accounts on the Domain Controller
- C. Passwords of 14 characters or less are broken up into two 7-character hashes
- D. A password Group Policy change takes at least 3 weeks to completely replicate throughout a network
Answer: C
NEW QUESTION 16
When using an iPod and the host computer is running Windows, what file system will be used?
- A. HFS
- B. FAT16
- C. iPod+
- D. FAT32
Answer: D
NEW QUESTION 17
What will the following command accomplish in Linux? fdisk /dev/hda
- A. Format the hard drive
- B. Delete all files under the /dev/hda folder
- C. Fill the disk with zeros
- D. Partition the hard drive
Answer: D
NEW QUESTION 18
What file structure database would you expect to find on floppy disks?
- A. FAT16
- B. NTFS
- C. FAT12
- D. FAT32
Answer: C
NEW QUESTION 19
George was recently fired from his job as an IT analyst at Pitts and Company in Dallas
Texas. His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company network by cracking some ofcompany? Active Directory structure and to create network polices. George now wants to break into the company? network by cracking some of the service accounts he knows about. Which password cracking technique should George use in this situation?
- A. Syllable attack
- B. Brute force attack
- C. Rule-based attack
- D. Dictionary attack
Answer: C
NEW QUESTION 20
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything.
What is the reason for this?
- A. He should search in C:\Windows\System32\RECYCLED folder
- B. The Recycle Bin does not exist on the hard drive
- C. The files are hidden and he must use switch to view them
- D. Only FAT system contains RECYCLED folder and not NTFS
Answer: C
NEW QUESTION 21
If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?
- A. Lossy compression
- B. Lossful compression
- C. Time-loss compression
- D. Lossless compression
Answer: A
NEW QUESTION 22
Which of the following tasks DOES NOT come under the investigation phase of a cybercrime forensics investigation case?
- A. Data analysis
- B. Secure the evidence
- C. Data collection
- D. First response
Answer: D
NEW QUESTION 23
In Linux, what is the smallest possible shellcode?
- A. 80 bytes
- B. 800 bytes
- C. 24 bytes
- D. 8 bytes
Answer: C
NEW QUESTION 24
Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?
- A. Bench warrant
- B. Subpoena
- C. Wire tap
- D. Search warrant
Answer: D
NEW QUESTION 25
What method of copying should always be performed first before carrying out an investigation?
- A. Bit-stream copy
- B. Parity-bit copy
- C. MS-DOS disc copy
- D. System level copy
Answer: A
NEW QUESTION 26
One way to identify the presence of hidden partitions on a suspect's hard drive is to:
- A. Examine the LILO and note an H in the partition Type field
- B. Examine the FAT and identify hidden partitions by noting an H in the partition Type field
- C. It is not possible to have hidden partitions on a hard drive
- D. Add up the total size of all known partitions and compare it to the total size of the hard drive
Answer: D
NEW QUESTION 27
Why is it a good idea to perform a penetration test from the inside?
- A. To attack a network from a hacker's perspective
- B. Because 70% of attacks are from inside the organization
- C. It is never a good idea to perform a penetration test from the inside
- D. It is easier to hack from the inside
Answer: B
NEW QUESTION 28
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?
- A. The data is still present until the original location of the file is used
- B. The data is moved to the Restore directory and is kept there indefinitely
- C. The data will reside in the L2 cache on a Windows computer until it is manually deleted
- D. It is not possible to recover data that has been emptied from the Recycle Bin
Answer: A
NEW QUESTION 29
......
Get Latest 312-49 Dumps Exam Questions in here: https://www.passcollection.com/312-49_real-exams.html
