Exam 3: EC-Council Information Security Manager (E|ISM)

What must be obtained before an investigation is carried out at a location?

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive? 22,164 cylinders/disk 80 heads/cylinder 63 sectors/track

The organization does not have the time to remediate the vulnerability; however it is critical to release the application.  Which of the following needs to be further evaluated to help mitigate the risks?

Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?

Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

An application vulnerability assessment has identified a security flaw in an application.  This is a flaw that was previously identified and remediated on a prior release of the application.  Which of the following is MOST likely the reason for this recurring issue?

How many bits is Source Port Number in TCP Header packet?

Which program is the bootloader when Windows XP starts up?

If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?

Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):

Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?

Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for. Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report?

What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don't know what to do. What is the BEST approach to handle this situation?

How many possible sequence number combinations are there in TCP/IP protocol?

In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?

Which of the following information may be found in table top exercises for incident response?

What technique is used by JPEGs for compression?

Which of the following represents the best method of ensuring business unit alignment with security program requirements?