Winter Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: bigdisc65

EC0-479 Exam Dumps - ECCouncil ECSA Questions and Answers

Question # 14

Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?

Options:

A.

18 U.S.C. 1029 Possession of Access Devices

B.

18 U.S.C. 1030 Fraud and related activity in connection with computers

C.

18 U.S.C. 1343 Fraud by wire, radio or television

D.

18 U.S.C. 1361 Injury to Government Property

E.

18 U.S.C. 1362 Government communication systems

F.

18 U.S.C. 1832 Trade Secrets Act

Buy Now
Question # 15

When obtaining a warrant it is important to:

Options:

A.

particularlydescribe the place to be searched and particularly describe the items to be seized

B.

generallydescribe the place to be searched and particularly describe the items to be seized

C.

generallydescribe the place to be searched and generally describe the items to be seized

D.

particularlydescribe the place to be searched and generally describe the items to be seized

Buy Now
Question # 16

The efforts to obtain information before a trail by demanding documents, depositions, questioned and answers written under oath, written requests for admissions of fact and examination of the scene is a description of what legal term?

Options:

A.

Detection

B.

Hearsay

C.

Spoliation

D.

Discovery

Buy Now
Question # 17

What is the advantage in encrypting the communication between the agent and the monitor in an Intrusion Detection System?

Options:

A.

Encryption of agent communications will conceal the presence of the agents

B.

Alerts are sent to the monitor when a potential intrusion is detected

C.

An intruder could intercept and delete data or alerts and the intrusion can go undetected

D.

The monitor will know if counterfeit messages are being generated because they will not be encrypted

Buy Now
Question # 18

During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as:

Options:

A.

Inculpatory evidence

B.

mandatory evidence

C.

exculpatory evidence

D.

Terrible evidence

Buy Now
Question # 19

What does mactime, an essential part of the coroner‟s toolkit do?

Options:

A.

It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

B.

It can recover deleted file space and search it for datA. However, it does not allow the investigator t preview them

C.

The tools scans for i-node information, which is used by other tools in the tool kit

D.

It is tool specific to the MAC OS and forms a core component of the toolkit

Buy Now
Question # 20

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

Options:

A.

A disk imaging tool would check for CRC32s for internal self checking and validation and have MD5 checksum

B.

Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file

C.

A simple DOS copy will not include deleted files, file slack and other information

D.

There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

Buy Now
Question # 21

John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

Options:

A.

The SID of Hillary's network account

B.

The network shares that Hillary has permissions

C.

The SAM file from Hillary's computer

D.

Hillary's network username and password hash

Buy Now
Question # 22

To preserve digital evidence, an investigator should ____________________

Options:

A.

Make tow copies of each evidence item using a single imaging tool

B.

Make a single copy of each evidence item using an approved imaging tool

C.

Make two copies of each evidence item using different imaging tools

D.

Only store the original evidence item

Buy Now
Question # 23

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

Options:

A.

one who has NTFS 4 or 5 partitions

B.

one who uses dynamic swap file capability

C.

one who uses hard disk writes on IRQ 13 and 21

D.

one who has lots of allocation units per block or cluster

Buy Now
Exam Code: EC0-479
Exam Name: EC-Council Certified Security Analyst (ECSA)
Last Update: Feb 25, 2025
Questions: 232
EC0-479 pdf

EC0-479 PDF

$29.75  $84.99
EC0-479 Engine

EC0-479 Testing Engine

$33.25  $94.99
EC0-479 PDF + Engine

EC0-479 PDF + Testing Engine

$47.25  $134.99