QUESTION: 45

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

The system files have been copied by a remote attacker
The system administrator has created an incremental backup
The system has been compromised using a t0rnrootkit
Nothing in particular as these can be operational files

Answer(s): D

From the following spam mail header, identify the host IP that sent this spam?

From jie02@netvigator.com jie02@netvigator.com Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk
(8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)
Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by
viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)
with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >200111270926.fAR9QXwZ018431@viruswall.ie.cuhk.edu.hk
From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0
X-Priority: 3 X-MSMail-
Priority: Normal
Reply-To: "china hotel web"

137.189.96.52
8.12.1.0
203.218.39.20
203.218.39.50

Answer(s): C

Reveal Solution Next Question

QUESTION: 47

If you plan to startup a suspect's computer, you must modify the_________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

deltree command
CMOS
Boot.sys
Scandisk utility

Answer(s): C

Reveal Solution Next Question

QUESTION: 48

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

Answer(s): C

Reveal Solution Next Question

Free 312-49 Exam Braindumps (page: 12)

QUESTION: 45

QUESTION: 46

QUESTION: 47

QUESTION: 48