Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Home
ECCouncil
ECSA
EC0-479
EC-Council Certified Security Analyst (ECSA) Questions and Answers

Pass the ECCouncil ECSA EC0-479 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam EC0-479 Premium Access

View all detail and faqs for the EC0-479 exam

Go to Exam

501 Students Passed

86% Average Score

97% Same Questions

Viewing page 1 out of 7 pages

Viewing questions 1-10 out of questions

Questions # 1:

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

Options:

logical

anti-magnetic

magnetic

optical

Answer

Questions # 2:

You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protecteD. What are two common methods used by password cracking software that you can use to obtain the password?

Options:

Limited force and library attack

Brute Force and dictionary Attack

Maximum force and thesaurus Attack

Minimum force and appendix Attack

Answer

Questions # 3:

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

Options:

create a compressed copy of the file with DoubleSpace

create a sparse data copy of a folder or file

make a bit-stream disk-to-image file

make a bit-stream disk-to-disk file

Answer

Questions # 4:

When investigating a potential e-mail crime, what is your first step in the investigation?

Options:

Trace the IP address to its origin

Write a report

Determine whether a crime was actually committed

Recover the evidence

Answer

Questions # 5:

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

Options:

100

Answer

Questions # 6:

A (n) ____________ is one that‟s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

Options:

blackout attack

automated attack

distributed attack

central processing attack

Answer

Questions # 7:

Before you are called to testify as an expert, what must an attorney do first?

Options:

engage in damage control

prove that the tools you used to conduct your examination are perfect

read your curriculum vitae to the jury

qualify you as an expert witness

Answer

Questions # 8:

What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?

Options:

A compressed file

A Data stream file

An encrypted file

A reserved file

Answer

Questions # 9:

Which is a standard procedure to perform during all computer forensics investigations?

Options:

with the hard drive removed from the suspect PC, check the date and time in the system‟s CMOS

with the hard drive in the suspect PC, check the date and time in the File Allocation Table

with the hard drive removed from the suspect PC, check the date an d time in the system‟s RAM

with the hard drive in the suspect PC, check the date and time in the system‟s CMOS

Answer

Questions # 10:

The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. (Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 From the options given below choose the one which best interprets the following entry: Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53