Download Latest 412-79 Questions

EC-Council Certified Security Analyst (ECSA) Questions and Answers

Question 29

You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

Options:

the attorney-work-product rule

Good manners

Trade secrets

ISO 17799

Question 30

An Expert witness give an opinion if:

Options:

The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

To define the issues of the case for determination by the finder of fact

To stimulate discussion between the consulting expert and the expert witness

To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

Question 31

When investigating a Windows System, it is important to view the contents of the page or swap file because:

Options:

Windows stores all of the systems configuration information in this file

This is file that windows use to communicate directly with Registry

A Large volume of data can exist within the swap file of which the computer user has no knowledge

This is the file that windows use to store the history of the last 100 commands that were run from the command line

Question 32

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

Options:

Sector

Metadata

MFT

Slack Space

Labour Day Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

EC-Council Certified Security Analyst (ECSA) Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer: