EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 1011:

  File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file

  A. First 10 bytes
  B. First 20 bytes
  C. First 30 bytes
  D. First 40 bytes
  B. First 20 bytes

• Question 1012:

  A forensic investigator is a person who handles the complete Investigation process, that is, the preservation, identification, extraction, and documentation of the evidence. The investigator has many roles and responsibilities relating to the cybercrime analysis. The role of the forensic investigator is to:

  A. Take permission from all employees of the organization for investigation
  B. Harden organization network security
  C. Create an image backup of the original evidence without tampering with potential evidence
  D. Keep the evidence a highly confidential and hide the evidence from law enforcement agencies
  C. Create an image backup of the original evidence without tampering with potential evidence

• Question 1013:

  Which of the following hives in Windows registry contain configuration information related to the application type that is used to open various files on the system?

  A. HKEY_CURRENT_CONFIG
  B. HKEY_CLASSES_ROOT
  C. HKEY_CURRENT_USER
  D. HKEY_LOCAL MACHINE
  B. HKEY_CLASSES_ROOT

• Question 1014:

  P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails.

  A. Port 109
  B. Port 110
  C. Port 115
  D. Port 123
  B. Port 110

• Question 1015:

  BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16. 7 million colors). Each bitmap file contains header, the RGBQUAD array, information header, and image data.

  Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

  A. Header
  B. The RGBQUAD array
  C. Information header
  D. Image data
  B. The RGBQUAD array

• Question 1016:

  John, a Forensic Lab Director, is planning to strengthen the security measures of his lab to maintain the trustworthiness and integrity of their investigations. He also wants to ensure that the forensics team members are assigned specific roles to streamline the investigation process.

  Given the following list of security measures and team roles, which combination should he NOT consider?

  A. Establishing a fire safety protocol with trained personnel and assigning the role of Photographer to record the crime scene
  B. Installation of a TEMPEST system to shield workstations from electromagnetic signals and appointment of an Incident Responder to secure the crime scene and collect evidence
  C. Instituting a physical lab surveillance system with guards around the premises and designating a single individual to fulfill the roles of Incident Analyzer, Evidence Documenter, and Evidence Manager
  D. Providing an electronic sign-in log for visitors and assigning the role of Evidence Examiner to sort and prioritize the collected evidence based on usefulness and relevance
  C. Instituting a physical lab surveillance system with guards around the premises and designating a single individual to fulfill the roles of Incident Analyzer, Evidence Documenter, and Evidence Manager

• Question 1017:

  In an investigation into a cyber-attack incident, you are a Computer Hacking Forensics Investigator tasked with gathering digital evidence. The targeted system has been turned off unexpectedly, and you know the system was running a crucial process during the attack.

  Which types of evidence might be lost due to the system being switched off?

  A. Neither volatile data, such as command history and process-to-port mapping, nor non-volatile data, like event logs and hidden files
  B. Volatile data such as command history and process-to-port mapping, but not non-volatile data like event logs and hidden files
  C. Both volatile data, such as command history and process-to-port mapping, and non-volatile data, like event logs and hidden files
  D. Non-volatile data such as event logs and hidden files, but not volatile data like command history and process-to-port mapping
  B. Volatile data such as command history and process-to-port mapping, but not non-volatile data like event logs and hidden files

• Question 1018:

  Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage.

  Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?

  A. Swap les
  B. Security logs
  C. Files in Recycle Bin
  D. Prefetch les
  D. Prefetch les

• Question 1019:

  In the event of a fileless malware attack, a Computer Hacking Forensics Investigator (CHFI) notes that the fileless malware has managed to persist even after the system reboots. What built-in Windows tool/utility might the attacker most likely have leveraged for this persistent behavior?

  A. Windows Operation system components
  B. Windows Task Scheduler
  C. Windows AutoStart registry keys
  D. Windows Process Explorer
  C. Windows AutoStart registry keys

• Question 1020:

  Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?

  A. HIPAA
  B. GLBA
  C. SOX
  D. FISMA
  C. SOX