EC0-479 Practice Exam Questions with Answers EC-Council Certified Security Analyst (ECSA) Certification

Which of the following filesystem is used by Mac OS X?

Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

In a FAT32 system, a 123 KB file will use how many sectors?

What binary coding is used most often for e-mail purposes?

Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation?

On Linux/Unix based Web servers, what privilege should the daemon service be run under?

John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

An "idle" system is also referred to as what?

Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?

Jason is the security administrator of ACMA metal Corporation. One day he notices the company?s Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately. Which organization coordinates computer crimes investigations throughout the United States?

How many sectors will a 125 KB file use in a FAT32 file system?

Sectors in hard disks typically contain how many bytes?

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

Windows identifies which application to open a file with by examining which of the following?

When you carve an image, recovering the image depends on which of the following skills?

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloadeD. What can the investigator do to prove the violation? Choose the most feasible option.

When examining a file with a Hex Editor, what space does the file header occupy?

A (n) ____________ is one that?s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

E-mail logs contain which of the following information to help you in your investigation? (Select up to 4)

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekenD. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

The MD5 program is used to:

When investigating a potential e-mail crime, what is your first step in the investigation?

The newer Macintosh Operating System is based on:

When monitoring for both intrusion and security events between multiple computers, it is essential that the computers? clocks are synchronize D. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

Lance wants to place a honeypot on his network. Which of the following would be your recommendations?

The offset in a hexadecimal code is:

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

Paul's company is in the process of undergoing a complete security audit including logical and physical security testing. After all logical tests were performed; it is now time for the physical round to begin. None of the employees are made aware of this round of testing. The security-auditing firm sends in a technician dressed as an electrician. He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas. After entering the main office, he is able to get into the server room telling the IT manager that there is a problem with the outlets in that room. What type of attack has the technician performed?

What will the following command produce on a website login page?

SELECT email, passwd, login_id, full_name

FROM members

WHERE email = 'someone@somehwere.com'; DROP TABLE members; --'

When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

What is the target host IP in the following command?

Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers. Bill protects the PDF documents with a password and sends them to their intended recipients. Why PDF passwords do not offer maximum protection?

On Linux/Unix based Web servers, what privilege should the daemon service be run under?

Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?

You are running through a series of tests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened?

To preserve digital evidence, an investigator should ____________________

You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

What information do you need to recover when searching a victims computer for a crime committed with specific e-mail message?

What should you do when approached by a reporter about a case that you are working on or have worked on?

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

A law enforcement officer may only search for and seize criminal evidence with _____________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searcheD.

The use of warning banners helps a company avoid litigation by overcoming an employees assumed

____________ When connecting to the company?s intranet, network or Virtual Private Network(VPN) and will allow the company?s investigators to monitor, search and retrieve information stored within the network.

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well- tested hardware write-blocking device to:

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

An Expert witness give an opinion if:

When investigating a Windows System, it is important to view the contents of the page or swap file because:

One way to identify the presence of hidden partitions on a suspect?s hard drive is to:

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complain with Police?

What are the security risks of running a "repair" installation for Windows XP?

Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test. The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis?

Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to google.com and types in the following search.

link:www.ghttech.net

What will this search produce?

What is a good security method to prevent unauthorized users from "tailgating"?

You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company clients. You have rummaged through their trash and found very little information. You do not want to set off any alarms on their network, so you plan on performing passive footprinting against their Web servers. What tool should you use?

To test your website for vulnerabilities, you type in a quotation mark (? for the username field. After you click Ok, you receive the following error message window:

What can you infer from this error window?

Exhibit:

You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities:

<script>alert("This is a test.")</script>

When you type this and click on search, you receive a pop-up window that says:

"This is a test."

What is the result of this test?