Pass the ECCouncil ECSA EC0-479 Questions and answers with CertsForce

Viewing page 1 out of 7 pages
Viewing questions 1-10 out of questions
Questions # 1:

From the following spam mail header, identify the host IP that sent this spam? From jie02@netvigator.com jie02@netvigator.com Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT) Message-Id: >200111270926.fAR9QXwZ018431@viruswall.ie.cuhk.edu.hk

From: “china hotel web”

To: “Shlam”

Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail- Priority: Normal Reply-

To: “china hotel web”

Options:

A.

137.189.96.52


B.

8.12.1.0


C.

203.218.39.20


D.

203.218.39.50


Expert Solution
Questions # 2:

What does the superblock in Linux define?

Options:

A.

filesynames


B.

diskgeometr


C.

location of the firstinode


D.

available space


Expert Solution
Questions # 3:

Which response organization tracks hoaxes as well as viruses?

Options:

A.

NIPC


B.

FEDCIRC


C.

CERT


D.

CIAC


Expert Solution
Questions # 4:

Microsoft Outlook maintains email messages in a proprietary format in what type of file?

Options:

A.

.email


B.

.mail


C.

.pst


D.

.doc


Expert Solution
Questions # 5:

Which of the following is NOT a graphics file?

Options:

A.

Picture1.tga


B.

Picture2.bmp


C.

Picture3.nfo


D.

Picture4.psd


Expert Solution
Questions # 6:

As a CHFI professional, which of the following is the most important to your professional reputation?

Options:

A.

Your Certifications


B.

The correct, successful management of each and every case


C.

The free that you charge


D.

The friendship of local law enforcement officers


Expert Solution
Questions # 7:

Which of the following should a computer forensics lab used for investigations have?

Options:

A.

isolation


B.

restricted access


C.

open access


D.

an entry log


Expert Solution
Questions # 8:

In a FAT32 system, a 123 KB file will use how many sectors?

Options:

A.

34


B.

246


C.

11


D.

56


Expert Solution
Questions # 9:

In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

Options:

A.

The ISP can investigate anyone using their service and can provide you with assistance


B.

The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant


C.

The ISP can‟t conduct any type of investigations on anyone and therefore can‟t assist you


D.

ISP‟s never maintain log files so they would be of no use to your investigation


Expert Solution
Questions # 10:

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

Options:

A.

The system files have been copied by a remote attacker


B.

The system administrator has created an incremental backup


C.

The system has been compromised using a t0rnrootkit


D.

Nothing in particular as these can be operational files


Expert Solution
Viewing page 1 out of 7 pages
Viewing questions 1-10 out of questions