PDF 312-49v9 Study Guide

ECCouncil Computer Hacking Forensic Investigator (V9) Questions and Answers

Question 61

Printing under a Windows Computer normally requires which one of the following files types to be created?

Options:

EME

MEM

EMF

CME

Question 62

What is kept in the following directory? HKLM\SECURITY\Policy\Secrets

Options:

Cached password hashes for the past 20 users

Service account passwords in plain text

IAS account names and passwords

Local store PKI Kerberos certificates

Question 63

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm’s employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

Options:

Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned

Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment

Inform the owner that conducting an investigation without a policy is a violation of the employee’s expectation of privacy

Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies

Question 64

What does mactime, an essential part of the coroner's toolkit do?

Options:

It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them

The tools scans for i-node information, which is used by other tools in the tool kit

It is too specific to the MAC OS and forms a core component of the toolkit

Labour Day Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

ECCouncil Computer Hacking Forensic Investigator (V9) Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer: