EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 101:

  Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

  A. ff d8 ff
  B. 25 50 44 46
  C. d0 0f 11 e0
  D. 50 41 03 04
  A. ff d8 ff

• Question 102:

  Data density of a disk drive is calculated by using _________.

  A. Track density, areal density, and bit density.
  B. Track space, bit area, and slack space.
  C. Slack space, bit density, and slack density.
  D. Track density, areal density, and slack density.
  A. Track density, areal density, and bit density.

• Question 103:

  A Computer Hacking Forensic Investigator is acquiring volatile data from a Linux-based suspect machine that they cannot physically access. They need to obtain a dump of the system's RAM remotely. Which of the following sequences of commands and tools should be utilized for a forensically sound extraction?

  A. On the forensic workstation: insmod lime-.ko "path= format=lime"; on the suspect machine: nc : > filename.mem
  B. On the suspect machine: insmod lime-.ko "path=tcp: format=lime": on the forensics workstation: nc : > filename.mem
  C. On the forensic workstation: nc -l > filename.dd; on the suspect machine: dd if=/dev/fmem bs=l024 | nc
  D. On the suspect machine: dd if=/dev/fmem of= bs=lMB; on the forensic workstation: nc -l > filename.dd
  B. On the suspect machine: insmod lime-.ko "path=tcp: format=lime": on the forensics workstation: nc : > filename.mem

• Question 104:

  The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used. Which command displays the network configuration of the NICs on the system?

  A. ipconfig /all
  B. netstat
  C. net session
  D. tasklist
  A. ipconfig /all

• Question 105:

  Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?

  A. OpenGL/ES and SGL
  B. Surface Manager
  C. Media framework
  D. WebKit
  A. OpenGL/ES and SGL

• Question 106:

  In the context of file deletion process, which of the following statement holds true?

  A. When files are deleted, the data is overwritten and the cluster marked as available
  B. The longer a disk is in use, the less likely it is that deleted files will be overwritten
  C. While booting, the machine may create temporary files that can delete evidence
  D. Secure delete programs work by completely overwriting the file in one go
  C. While booting, the machine may create temporary files that can delete evidence

• Question 107:

  During the process of a forensic investigation after a cyber incident, a team of forensic analysts conducts the initial response on-site. Onemember of the team is packaging the collected electronic evidence. What is the most appropriate step the team member should take during thisphase according to the standard forensic investigation process?

  A. The team member should strictly follow exhibit numbering and provide accurate information on the front panel of the evidence bags
  B. The team member should conduct a preliminary analysis of the collected evidence before packaging
  C. The team member should turn off all devices before packaging to prevent any potential damage to the data
  D. The team member should connect the collected electronic devices to a safe computer system to create backup data
  A. The team member should strictly follow exhibit numbering and provide accurate information on the front panel of the evidence bags

• Question 108:

  A Computer Hacking Forensics Investigator (CHFI) has been called in to handle a complex data breach at a large corporation. The investigator plans to follow the rules of thumb for data acquisition during the investigation. Which of the following actions is NOT in line with these best practices?

  A. Producing two copies of the original media before starting the investigation process
  B. Verifying the integrity of the duplicates by comparing them to the original using hash values
  C. Performing the forensic investigation directly on the original evidence
  D. Creating a duplicate bit-stream image of the suspicious drive for analysis
  C. Performing the forensic investigation directly on the original evidence

• Question 109:

  During forensics investigations, investigators tend to collect the system time at first and compare it with UTC. What does the abbreviation UTC stand for?

  A. Coordinated Universal Time
  B. Universal Computer Time
  C. Universal Time for Computers
  D. Correlated Universal Time
  A. Coordinated Universal Time

• Question 110:

  Which of the following setups should a tester choose to analyze malware behavior?

  A. A virtual system with internet connection
  B. A normal system without internet connect
  C. A normal system with internet connection
  D. A virtual system with network simulation for internet connection
  D. A virtual system with network simulation for internet connection