Question 1

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

Accepted Answer

A)  The year the evidence was taken 
B)  The sequence number for the parts of the same exhibit 
C)  The initials of the forensics analyst 
D)  The sequential number of the exhibits seized 
A)  The year the evidence was taken 
B)  The sequence number for the parts of the same exhibit 
C)  The initials of the forensics analyst 
D)  The sequential number of the exhibits seized

Question 2

When selecting a security solution with reoccurring maintenance costs after the first year (choose the BEST answer):

Accepted Answer

A)  The CISO should cut other essential programs to ensure the new solution's continued use 
B)  Communicate future operating costs to the CIO/CFO and seek commitment from them to ensure the new solution's continued use 
C)  Defer selection until the market improves and cash flow is positive 
D)  Implement the solution and ask for the increased operating cost budget when it is time 
A)  The CISO should cut other essential programs to ensure the new solution's continued use 
B)  Communicate future operating costs to the CIO/CFO and seek commitment from them to ensure the new solution's continued use 
C)  Defer selection until the market improves and cash flow is positive 
D)  Implement the solution and ask for the increased operating cost budget when it is time

Question 3

This occurs when the quantity or quality of project deliverables is expanded from the original project plan.

Accepted Answer

A)  Scope creep 
B)  Deadline extension 
C)  Scope modification 
D)  Deliverable expansion 
A)  Scope creep 
B)  Deadline extension 
C)  Scope modification 
D)  Deliverable expansion

Question 4

Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?

Accepted Answer

A)  Spycrack 
B)  Spynet 
C)  Netspionage 
D)  Hackspionage 
A)  Spycrack 
B)  Spynet 
C)  Netspionage 
D)  Hackspionage

Question 5

The following is a log file screenshot from a default installation of IIS 6.0.   What time standard is used by IIS as seen in the screenshot?

Accepted Answer

A)  UTC 
B)  GMT 
C)  TAI 
D)  UT 
A)  UTC 
B)  GMT 
C)  TAI 
D)  UT

Question 6

When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

Accepted Answer

A)  One 
B)  Two 
C)  Three 
D)  Four 
A)  One 
B)  Two 
C)  Three 
D)  Four

Question 7

What is the first step taken in an investigation for laboratory forensic staff members?

Accepted Answer

A)  Packaging the electronic evidence 
B)  Securing and evaluating the electronic crime scene 
C)  Conducting preliminary interviews 
D)  Transporting the electronic evidence 
A)  Packaging the electronic evidence 
B)  Securing and evaluating the electronic crime scene 
C)  Conducting preliminary interviews 
D)  Transporting the electronic evidence

Question 8

What is the CIDR from the following screenshot?

Accepted Answer

A)  /24A./24A./24 
B)  /32 B./32 B./32 
C)  /16 C./16 C./16 
D)  /8D./8D./8 
A)  /24A./24A./24 
B)  /32 B./32 B./32 
C)  /16 C./16 C./16 
D)  /8D./8D./8

Question 9

Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security. The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of. What step could you take to help secure SNMP on your network?

Accepted Answer

A)  Block all internal MAC address from using SNMP 
B)  Block access to UDP port 171 
C)  Block access to TCP port 171 
D)  Change the default community string names 
A)  Block all internal MAC address from using SNMP 
B)  Block access to UDP port 171 
C)  Block access to TCP port 171 
D)  Change the default community string names

Question 10

A stakeholder is a person or group:

Accepted Answer

A)  Vested in the success and/or failure of a project or initiative regardless of budget implications. 
B)  Vested in the success and/or failure of a project or initiative and is tied to the project budget. 
C)  That has budget authority. 
D)  That will ultimately use the system. 
A)  Vested in the success and/or failure of a project or initiative regardless of budget implications. 
B)  Vested in the success and/or failure of a project or initiative and is tied to the project budget. 
C)  That has budget authority. 
D)  That will ultimately use the system.

Question 11

Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders were able to gain access into the company firewalls by overloading them with IP packets. Cylie then discovers through her investigation that the intruders hacked into the company phone system and used the hard drives on their PBX system to store shared music files. What would this attack on the company PBX system be called?

Accepted Answer

A)  Phreaking 
B)  Squatting 
C)  Crunching 
D)  Pretexting 
A)  Phreaking 
B)  Squatting 
C)  Crunching 
D)  Pretexting

Question 12

What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

Accepted Answer

A)  SD memory 
B)  CF memory 
C)  MMC memory 
D)  SM memory 
A)  SD memory 
B)  CF memory 
C)  MMC memory 
D)  SM memory

Question 13

To get an Information Security project back on schedule, which of the following will provide the MOST help?

Accepted Answer

A)  Upper management support 
B)  More frequent project milestone meetings 
C)  Stakeholder support 
D)  Extend work hours 
A)  Upper management support 
B)  More frequent project milestone meetings 
C)  Stakeholder support 
D)  Extend work hours

Question 14

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

Accepted Answer

A)  Blackberry Message Center 
B)  Microsoft Exchange 
C)  Blackberry WAP gateway 
D)  Blackberry WEP gateway 
A)  Blackberry Message Center 
B)  Microsoft Exchange 
C)  Blackberry WAP gateway 
D)  Blackberry WEP gateway

Question 15

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Accepted Answer

A)  C:\Program Files\Exchsrvr\servername.log 
B)  D:\Exchsrvr\Message Tracking\servername.log 
C)  C:\Exchsrvr\Message Tracking\servername.log 
D)  C:\Program Files\Microsoft Exchange\srvr\servername.log 
A)  C:\Program Files\Exchsrvr\servername.log 
B)  D:\Exchsrvr\Message Tracking\servername.log 
C)  C:\Exchsrvr\Message Tracking\servername.log 
D)  C:\Program Files\Microsoft Exchange\srvr\servername.log

Question 16

Paraben Lockdown device uses which operating system to write hard drive data?

Accepted Answer

A)  Mac OS 
B)  Red Hat 
C)  Unix 
D)  Windows 
A)  Mac OS 
B)  Red Hat 
C)  Unix 
D)  Windows

Question 17

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

Accepted Answer

A)  All virtual memory will be deleted 
B)  The wrong partition may be set to active 
C)  This action can corrupt the disk 
D)  The computer will be set in a constant reboot state 
A)  All virtual memory will be deleted 
B)  The wrong partition may be set to active 
C)  This action can corrupt the disk 
D)  The computer will be set in a constant reboot state

Question 18

What method of copying should always be performed first before carrying out an investigation?

Accepted Answer

A)  Parity-bit copy 
B)  Bit-stream copy 
C)  MS-DOS disc copy 
D)  System level copy 
A)  Parity-bit copy 
B)  Bit-stream copy 
C)  MS-DOS disc copy 
D)  System level copy

Question 19

When gathering security requirements for an automated business process improvement program, which of the following is MOST important?

Accepted Answer

A)  Type of data contained in the process/system 
B)  Type of connection/protocol used to transfer the data 
C)  Type of encryption required for the data once it is at rest 
D)  Type of computer the data is processed on 
A)  Type of data contained in the process/system 
B)  Type of connection/protocol used to transfer the data 
C)  Type of encryption required for the data once it is at rest 
D)  Type of computer the data is processed on

Question 20

Which of the following represents the BEST method of ensuring security program alignment to business needs?

Accepted Answer

A)  Create a comprehensive security awareness program and provide success metrics to business units 
B)  Create security consortiums, such as strategic security planning groups, that include business unit participation 
C)  Ensure security implementations include business unit testing and functional validation prior to production rollout 
D)  Ensure the organization has strong executive-level security representation through clear sponsorship or the creation of a CISO role 
A)  Create a comprehensive security awareness program and provide success metrics to business units 
B)  Create security consortiums, such as strategic security planning groups, that include business unit participation 
C)  Ensure security implementations include business unit testing and functional validation prior to production rollout 
D)  Ensure the organization has strong executive-level security representation through clear sponsorship or the creation of a CISO role

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

When selecting a security solution with reoccurring maintenance costs after the first year (choose the BEST answer):

This occurs when the quantity or quality of project deliverables is expanded from the original project plan.

Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?

The following is a log file screenshot from a default installation of IIS 6.0. What time standard is used by IIS as seen in the screenshot?

When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

What is the first step taken in an investigation for laboratory forensic staff members?

What is the CIDR from the following screenshot?

A stakeholder is a person or group:

What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

To get an Information Security project back on schedule, which of the following will provide the MOST help?

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Paraben Lockdown device uses which operating system to write hard drive data?

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

What method of copying should always be performed first before carrying out an investigation?

When gathering security requirements for an automated business process improvement program, which of the following is MOST important?

Which of the following represents the BEST method of ensuring security program alignment to business needs?

EC-Council Certified Incident Handler

Certified Network Defender

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters

Exam 3: EC-Council Information Security Manager (E|ISM)

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

When selecting a security solution with reoccurring maintenance costs after the first year (choose the BEST answer):

This occurs when the quantity or quality of project deliverables is expanded from the original project plan.

Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?

The following is a log file screenshot from a default installation of IIS 6.0. What time standard is used by IIS as seen in the screenshot?

When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

What is the first step taken in an investigation for laboratory forensic staff members?

What is the CIDR from the following screenshot?

A stakeholder is a person or group:

What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

To get an Information Security project back on schedule, which of the following will provide the MOST help?

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Paraben Lockdown device uses which operating system to write hard drive data?

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

What method of copying should always be performed first before carrying out an investigation?

When gathering security requirements for an automated business process improvement program, which of the following is MOST important?

Which of the following represents the BEST method of ensuring security program alignment to business needs?

EC-Council Certified Incident Handler

Certified Network Defender

EC-Council Certified CISO

ECCouncil Computer Hacking Forensic Investigator

EC-Council Certified Security Analyst

Filters