Spring Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
ECCouncil
ECSA
EC0-479
EC-Council Certified Security Analyst (ECSA) Questions and Answers

Pass the ECCouncil ECSA EC0-479 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam EC0-479 Premium Access

View all detail and faqs for the EC0-479 exam

Go to Exam

824 Students Passed

86% Average Score

95% Same Questions

Viewing page 6 out of 7 pages

Viewing questions 51-60 out of questions

Questions # 51:

Corporate investigations are typically easier than public investigations because:

Options:

the users have standard corporate equipment and software

the investigator does not have to get a warrant

the investigator has to get a warrant

the users can load whatever they want on their machines

Answer

Questions # 52:

What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

Options:

forensic duplication of hard drive

analysis of volatile data

comparison of MD5 checksums

review of SIDs in the Registry

Answer

Questions # 53:

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

Options:

on the individual computer‟s ARP cache

in the Web Server log files

in the DHCP Server log files

there is no way to determine the specific IP address

Answer

Questions # 54:

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics laB. How many law-enforcement computer investigators should you request to staff the lab?

Options:

Answer

Questions # 55:

When cataloging digital evidence, the primary goal is to:

Options:

Make bit-stream images of all hard drives

Preserve evidence integrity

Not remove the evidence from the scene

Not allow the computer to be turned off

Answer

Questions # 56:

Why should you note all cable connections for a computer you want to seize as evidence?

Options:

to know what outside connections existed

in case other devices were connected

to know what peripheral devices exist

to know what hardware existed

Answer

Questions # 57:

The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

Options:

Locard Exchange Principle

Clark Standard

Kelly Policy

Silver-Platter Doctrine

Answer

Questions # 58:

What information do you need to recover when searching a victims computer for a crime committed with specific e-mail message?

Options:

Internet service provider information

E-mail header

Username and password

Firewall log

Answer

Questions # 59:

This organization maintains a database of hash signatures for known software:

Options:

International Standards Organization

Institute of Electrical and Electronics Engineers

National Software Reference Library

American National standards Institute

Answer

Questions # 60:

You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have founD. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subjects computer. You inform the officer that you will not be able to comply with that request because doing so would: