Free EC-COUNCIL EC0-349 Exam Dumps Questions & Answers

You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printed out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

• A.  Routing Table
• B.  Configuration files
• C.  Email Header
• D.  Firewall log

Physical security recommendations: There should be only one entrance to a forensics lab

• A.  True
• B.  False

Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

• A.  Use intrusion forensic techniques to study memory resident infections
• B.  Use Vmware to be able to capture the data in memory and examine it
• C.  Give the Operating System a minimal amount of memory, forcing it to use a swap file
• D.  Create a Separate partition of several hundred megabytes and place the swap file there

Which of the following would you consider an aspect of organizational security, especially focusing on IT security?

• A.  Biometric information security
• B.  Security from frauds
• C.  Information copyright security
• D.  Application security

You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour.
Why were these passwords cracked so Quickly?

• A.  Passwords of 14 characters or less are broken up into two 7-character hashes
• B.  The passwords that were cracked are local accounts on the Domain Controller
• C.  Networks using Active Directory never use SAM databases so the SAM database pulled was empty
• D.  A password Group Policy change takes at least 3 weeks to completely replicate throughout a network