Free 312-49V9 Exam Braindumps (page: 66)

Page 66 of 122

To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software ?

  1. Computer Forensics Tools and Validation Committee (CFTVC)
  2. Association of Computer Forensics Software Manufactures (ACFSM)
  3. National Institute of Standards and Technology (NIST)
  4. Society for Valid Forensics Tools and Testing (SVFTT)

Answer(s): C



You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

  1. The attorney-work-product rule
  2. Good manners
  3. Trade secrets
  4. ISO 17799

Answer(s): A



John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

  1. The SID of Hillary network account
  2. The SAM file from Hillary computer
  3. The network shares that Hillary has permissions
  4. Hillary network username and password hash

Answer(s): D

Explanation:

Note: From the question, we would have to assume that John is not the Administrator, since he needs to run L0phtcrack in sniffing mode. But what if the company is using switches instead of Hubs? John would either try to degarde the switch or perform a man in the middle attack.



Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.


He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

  1. Those connections are established
  2. Those connections are in listening mode
  3. Those connections are in closed/waiting mode
  4. Those connections are in timed out/waiting mode

Answer(s): B



Page 66 of 122



Post your Comments and Discuss EC-Council 312-49V9 exam with other Community members:

Olu commented on October 16, 2023
Question 235: 22,164 x 80 x 63 x 512 = 57.19 GB
UNITED STATES
upvote