312-49 exam study guide

In order to help you more IT-Tests.com the EC-COUNCIL 312-49 exam eliminate tension of the candidates on the Internet. 312-49 study materials including the official EC-COUNCIL 312-49 certification training courses, EC-COUNCIL 312-49 self-paced training guide, 312-49 exam IT-Tests.com and practice, 312-49 online exam 312-49 study guide. 312-49 simulation training package designed by IT-Tests.com can help you effortlessly pass the exam. Do not spend too much time and money, as long as you have IT-Tests.com learning materials you will easily pass the exam.

In the recent few years, EC-COUNCIL 312-49 exam certification have caused great impact to many people. But the key question for the future is that how to pass the EC-COUNCIL 312-49 exam more effectively. The answer of this question is to use IT-Tests.com's EC-COUNCIL 312-49 exam training materials, and with it you can pass your exams. So what are you waiting for? Go to buy IT-Tests.com's EC-COUNCIL 312-49 exam training materials please, and with it you can get more things what you want.

Exam Code: 312-49
Exam Name: EC-COUNCIL (Computer Hacking Forensic Investigator )
Free One year updates to match real exam scenarios, 100% pass and refund Warranty.
Total Q&A: 150 Questions and Answers
Last Update: 2013-10-12

Having a EC-COUNCIL certification 312-49 exam certificate can help people who are looking for a job get better employment opportunities in the IT field and will also pave the way for a successful IT career for them.

IT-Tests.com EC-COUNCIL 312-49 exam study guide can be a lighthouse in your career. Because it contains all 312-49 exam information. Select IT-Tests.com, it can help you to pass the exam. This is absolutely a wise decision. IT-Tests.com is your helper, you can get double the result, only need to pay half the effort.

312-49 (Computer Hacking Forensic Investigator ) Free Demo Download: http://www.it-tests.com/312-49.html

NO.1 The offset in a hexadecimal code is:
A. The last byte after the colon
B. The 0x at the beginning of the code
C. The 0x at the end of the code
D. The first byte after the colon
Answer: B

EC-COUNCIL   312-49   312-49 certification   312-49 exam simulations

NO.2 When an investigator contacts by telephone the domain administrator or controller listed by a
whois lookup to request all e-mails sent and received for a user account be preserved, what
U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?
A. Title 18, Section 1030
B. Title 18, Section 2703(d)
C. Title 18, Section Chapter 90
D. Title 18, Section 2703(f)
Answer: D

EC-COUNCIL   312-49   312-49   312-49 original questions   312-49

NO.3 When examining a file with a Hex Editor, what space does the file header occupy?
A. the last several bytes of the file
B. the first several bytes of the file
C. none, file headers are contained in the FAT
D. one byte at the beginning of the file
Answer: D

EC-COUNCIL braindump   312-49 demo   312-49 certification training

NO.4 What type of attack occurs when an attacker can force a router to stop forwarding packets by
flooding the router with many open connections simultaneously so that all the hosts behind the
router are effectively disabled?
A. digital attack
B. denial of service
C. physical attack
D. ARP redirect
Answer: B

EC-COUNCIL   312-49 questions   312-49 study guide   312-49 exam simulations   312-49 pdf

NO.5 A(n) _____________________ is one that's performed by a computer program rather than the
attacker manually performing the steps in the attack sequence.
A. blackout attack
B. automated attack
C. distributed attack
D. central processing attack
Answer: B

EC-COUNCIL original questions   312-49   312-49   312-49   312-49   312-49

NO.6 A suspect is accused of violating the acceptable use of computing resources, as he has visited
adult websites and downloaded images. The investigator wants to demonstrate that the suspect
did indeed visit these sites. However, the suspect has cleared the search history and emptied the
cookie cache. Moreover, he has removed any images he might have downloaded. What can the
investigator do to prove the violation? Choose the most feasible option.
A. Image the disk and try to recover deleted files
B. Seek the help of co-workers who are eye-witnesses
C. Check the Windows registry for connection data (You may or may not recover)
D. Approach the websites for evidence
Answer: A

EC-COUNCIL exam simulations   312-49 certification   312-49 demo   312-49 answers real questions   312-49 dumps

NO.7 How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?
A. 128
B. 64
C. 32
D. 16
Answer: C

EC-COUNCIL   312-49 answers real questions   312-49   312-49

NO.8 A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is
an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the
attacker by studying the log. Please note that you are required to infer only what is explicit in the
excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting,
basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)
03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111
TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 23678634 2878772
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111
UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84
Len: 64
01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................
00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................
00 00 00 11 00 00 00 00 ........
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773
UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104
Len: 1084
47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8 G..c............
00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20 ...............
3A B1 5E E5 00 00 00 09 6C 6F 63 61 6C 68 6F 73 :.