412-79 Exam Dumps - EC-Council Certified Security Analyst (ECSA)

Go to page:

Question # 9

George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity.

George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

src port 22 and dst port 22

src port 23 and dst port 23

net port 22

udp port 22 and host 172.16.28.1/24

Full Access

Question # 10

E-mail logs contain which of the following information to help you in your investigation? (Select up to 4)

user account that was used to send the account

attachments sent with the e-mail message

unique message identifier

contents of the e-mail message

date and time the message was sent

Full Access

Question # 11

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

by law, three

quite a few

only one

at least two

Full Access

Question # 12

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

A Capital X

A Blank Space

The Underscore Symbol

The lowercase Greek Letter Sigma (s)

Full Access

Question # 13

What does mactime, an essential part of the coronerâ€Ÿs toolkit do?

It traverses the file system and produces a listing of all files based on the modification, access and change timestamps

It can recover deleted file space and search it for datA. However, it does not allow the investigator t preview them

The tools scans for i-node information, which is used by other tools in the tool kit

It is tool specific to the MAC OS and forms a core component of the toolkit

Full Access

Question # 14

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

Network Forensics

Computer Forensics

Incident Response

Event Reaction

Full Access

Question # 15

An Expert witness give an opinion if:

The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors

To define the issues of the case for determination by the finder of fact

To stimulate discussion between the consulting expert and the expert witness

To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case

Full Access