Free 312-49V10 Exam Dumps Preview

As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company.

What information will you be able to gather?

A forensics investigator is studying the Event ID logs on a domain controller for a corporation, following a suspected security breach. He notices that a domain user account was created, then modified, and then added to a group in a very short span of time. The investigator realizes that he must cross-verify the audit policies on the local system to understand if any changes were made to it.

Assuming that the investigator has the correct audit policy settings, which of the following Event IDs should he focus on?

Which of the following tool creates a bit-by-bit image of an evidence media?

An investigator is checking a Cisco firewall log that reads as follows:

Aug 21 2019 09:16:44: %ASA-1 -106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on interface outside

What does %ASA-1-106021 denote?

The ARP table of a router comes in handy for Investigating network attacks, as the table contains IP addresses associated with the respective MAC addresses.

The ARP table can be accessed using the __________command in Windows 7.

Which of the following malware analysis involves executing the malware code to know how the code interacts with the host system and its impact on the system?

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ______

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

A rogue/unauthorized access point is one that Is not authorized for operation by a particular firm or network

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

What is the name of the standard Linux command that can be used to create bit-stream images?

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks.

Which of the following would that be?

LBA (Logical Block Address) addresses data by allotting a ___________to each sector of the hard disk.

Operating System logs are most beneficial for Identifying or Investigating suspicious activities involving a particular host.

Which of the following Operating System logs contains information about operational actions performed by OS components?

How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file.

Which of the following hash algorithms produces a message digest that is 128 bits long?

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything.

What is the reason for this?

You should make at least how many bit-stream copies of a suspect drive?

In an investigation of cybercrime involving advanced persistent threats (APTs), the forensic team faces

challenges in managing and interpreting the digital evidence due to the global origin of the crime and the diverse nature of the digital devices involved. The investigator has to select the most effective method to overcome these challenges.

What should be the preferred approach?

Choose the layer in iOS architecture that provides frameworks for iOS app development?

Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected instance to perform further analysis and collected other data of evidentiary value.

What should be their next step?

Which set of anti-forensic tools/techniques allows a program to compress and/or encrypt an executable file to hide attack tools from being detected by reverse-engineering or scanning?

A large corporation hired an independent marketing firm to manage its email advertising campaign.
Subsequently, it was found that the firm wassending commercial emails without including necessary information about how to stop receiving emails in the future. In addition, they failed tohonor the opt-out requests of the recipients within 10 business days.

Under the CAN-SPAM Act, which of the following is true?

What command-line tool enables forensic investigator to establish communication between an Android device and a forensic workstation in order to perform data acquisition from the device?

Which of the following technique creates a replica of an evidence media?

You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7.

Which of the following is a root folder of the registry editor?

Steven has been given the task of designing a computer forensics lab for the company he works for. He has found documentation on all aspects of how to design a lab except the number of exits needed.

How many exits should Steven include in his design for the computer forensics lab?

Which tool allows dumping the contents of process memory without stopping the process?

An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level.

How long will the team have to respond to the incident?

During an investigation, Noel found a SIM card from the suspect's mobile. The ICCID on the card is
8944245252001451548.

What does the first four digits (89 and 44) in the ICCID represent?

Click on the Exhibit button.

To test your website for vulnerabilities, you type a quotation mark (') in the username field. After you click OK, you receive the following error message window:

What can you infer from this error window?

Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\<USER SID>\ while analyzing a hard disk image for the deleted data.

What inferences can he make from the file name?

When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.

What is the actual error code that you would see in the log for resource not found?

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive.

Which of the following formats correctly specifies these sectors?

An Expert witness gives an opinion if:

Which of the following information is displayed when Netstat is used with -ano switch?

What must an attorney do first before you are called to testify as an expert?

To enhance the security and effectiveness of a computer forensic laboratory, the management is considering implementing a series of changes based on best practices. Which measure would NOT be effective or appropriate according to the given information?

To enhance the security and effectiveness of a computer forensic laboratory, the management is considering implementing a series of changes based on best practices.

Which measure would NOT be effective or appropriate according to the given information?

Robert needs to copy an OS disk snapshot of a compromised VM to a storage account in different region for further investigation.

Which of the following should he use in this scenario?

Log management includes all the processes and techniques used to collect, aggregate, and analyze

computer-generated log messages. It consists of the hardware, software, network and media used to generate, transmit, store, analyze, and dispose of log data.

In a scenario where a potential security incident has occurred on a cloud-based service, and an investigator is brought in to examine the system, what type of data acquisition would likely be beneficial in this situation? Also, explain the volatile data type that might be most interesting to the investigator.

An investigator is tasked with analyzing metadata from a suspected MAC system in a case of data theft.
They have decided to parse the Spotlight database file, store.db.

Which of the following tools and steps would be most effective for obtaining recently accessed file details from this MacOS system?

For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

Before you are called to testify as an expert, what must an attorney do first?

In a high-profile digital forensics investigation, a Computer Hacking Forensic Investigator (CHFI) has successfully secured digital evidence from the crime scene. The investigator must now preserve this evidence for further analysis.

Which of the following actions should the investigator prioritize to ensure evidence integrity?

Which of the following is NOT an anti-forensics technique?

Adam is thinking of establishing a hospital in the US and approaches John, a software developer to build a site and host it for him on one of the servers, which would be used to store patient health records. He has learned from his legal advisors that he needs to have the server's log data reviewed and managed according to certain standards and regulations.

Which of the following regulations are the legal advisors referring to?

Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?

Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table.

Which of the following is true for Data Rows?

Your organization is implementing a new database system and has chosen MySQL due to its pluggable storage engine capability and ability to handle parallel write operations securely.

You are responsible for selecting the best-suited storage engine for your company's needs, which predominantly involves transactional processing, crash recovery, and high data consistency requirements.

What would be the most appropriatechoice?

Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1.

What is the file type of the image?

What is the primary function of the tool CHKDSK in Windows that authenticates the file system reliability of a volume?

James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network.

What type of DoS attack is James testing against his network?

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices.

How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

In Steganalysis, which of the following describes a Known-stego attack?

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

When reviewing web logs, you see an entry for resource not found in the HTTP status code field.

What is the actual error code that you would see in the log for resource not found?

Which cloud model allows an investigator to acquire the instance of a virtual machine and initiate the forensics examination process?

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

How many sectors will a 125 KB file use in a FAT32 file system?

Investigator Janet comes across a suspicious Windows registry key during a computer hacking forensic investigation. She believes modifying this key is associated with the recent cyberattack on the company's servers. In order to confirm this, Janet needs to reference a timestamp embedded inside the registry key.

What is the correct name of this timestamp?

Frank, a cloud administrator in his company, needs to take backup of the OS disks of two Azure VMs that store business-critical data.

Which type of Azure blob storage can he use for this purpose?

The process of restarting a computer that is already turned on through the operating system is called?

What encryption technology is used on Blackberry devices Password Keeper?

Consider the scenario where a large multinational corporation suspects an internal security breach, with significant data possibly compromised.The corporate forensic team initiates the process of conducting a comprehensive forensic investigation following the search and seizureprotocols. During this process, they want to ensure they capture all the required information and minimize disruption to the company's ongoingbusiness operations.

Which among the following activities should NOT be a part of their plan for this search and seizure operation?

A mobile operating system is the operating system that operates a mobile device like a mobile phone, smartphone, PDA, etc. It determines the functions and features available on mobile devices such as
keyboards, applications, email, text messaging, etc.

Which of the following mobile operating systems is free and open source?

What will the following URL produce in an unpatched IIS Web Server?

http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\

During a forensic investigation, an attorney requested a forensic investigator to check if Dropbox was installed on the suspect's hard drive. The investigator finds traces of Dropbox artifacts in C:\Users\Admin
\AppData\Roaming\, C:\Program Files (x86) and C:\Program Files directories.

If the hypothesis is that the operating system installed is Windows 10, and Dropbox installation is confirmed by its artifacts in the mentioned directories, which assertion is the investigator most likely to make?

What does the 63.78.199.4(161) denotes in a Cisco router log?

Mar 14 22:57:53.425 EST: %SEC-6-IPACCESSLOGP: list internet-inbound denied udp 66.56.16.77(1029)
-> 63.78.199.4(161), 1 packet

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the

NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer.

Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

Which of the following Registry components include offsets to other cells as well as the LastWrite time for the key?

As a Computer Hacking Forensics Investigator, you have been tasked with examining a suspicious.E01 disk image file using The Sleuth Kit (TSK).
You need to display the metadata structure of an inode but also want to show the addresses of its disk units.

Which TSK command would best serve this purpose?

This organization maintains a database of hash signatures for known software

An "idle" system is also referred to as what?

Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused.

In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other.

What type of cipher was used by the accused in this case?

An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database.

What does the "WIN-CQQMK62867E" represent?

Damaged portions of a disk on which no read/Write operation can be performed is known as
______________.

What is the first step that needs to be carried out to crack the password?

Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?

dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

What can the investigator infer from the screenshot seen below?

Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages.

What networking protocol language should she learn that routers utilize?

Following an advanced persistent threat attack, a CHFI investigator is called in to acquire data from the compromised system. Given the wide range of potential data sources, the investigator needs to prioritize the order of data collection based on volatility.

Which of the following would be the correct order to collect data in this scenario?

A Computer Hacking Forensics Investigator (CHFI) is working on a case involving an encrypted file from a user profile that was deleted. The investigator knows that the file was encrypted using the Encrypted File System (EFS) on a Windows operating system. The system is still bootable, but the original user profile is gone, and the system administrator has reset the account password.

What would be the most suitable tool to recover this EFS-encrypted file?

Which of the following should a computer forensics lab used for investigations have?

The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data.

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________

Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.

On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin.

What is the size limit for Recycle Bin in Vista and later versions of the Windows?

A large multinational corporation suspects an internal breach of its data center and hires a forensic investigator. The investigator is required toconduct a search on the emails of an employee who is a US citizen, believed to be communicating classified information with a foreign entity.

The forensic investigator, while respecting international laws and US privacy laws, should:

How often must a company keep log files for them to be admissible in a court of law?

What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?

Which of the following statements is incorrect when preserving digital evidence?

The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used.

Which command displays the network configuration of the NICs on the system?

Depending upon the jurisdictional areas, different laws apply to different incidents.

Which of the following law is related to fraud and related activity in connection with computers?

Which of the following Steganography techniques allows you to encode information that ensures creation of cover for secret communication?

What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?