EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 161:

  During a forensic investigation of a system suspected to be involved in cybercrime, the investigator observes discrepancies between the $STANDARD_INFORMATION and $FILE_NAME creation dates for some files. As part of the investigation process, the investigator also noted that a utility called BCWipe was found installed on the system.

  What would be the investigator's most plausible conclusion based on these observations?

  A. The system user used BCWipe to delete specific files securely
  B. The system was compromised with malware that altered the metadata
  C. The files were encrypted using the BCWipe utility
  D. The timestamps for some files have been manipulated, possibly as an anti-forensic measure
  D. The timestamps for some files have been manipulated, possibly as an anti-forensic measure

• Question 162:

  An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:

  A. Type Allocation Code (TAC)
  B. Integrated Circuit Code (ICC)
  C. Manufacturer Identification Code (MIC)
  D. Device Origin Code (DOC)
  A. Type Allocation Code (TAC)

• Question 163:

  Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

  A. Cross Examination
  B. Direct Examination
  C. Indirect Examination
  D. Witness Examination
  A. Cross Examination

• Question 164:

  Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

  A. Search for disk errors within an image file
  B. Backup a disk to an image file
  C. Copy a partition to an image file
  D. Restore a disk from an image file
  D. Restore a disk from an image file

• Question 165:

  During a forensic investigation, an attorney requested a forensic investigator to check if Dropbox was installed on the suspect's hard drive. The investigator finds traces of Dropbox artifacts in C:\Users\Admin\AppData\Roaming\, C:\Program Files (x86) and C:\Program Files directories.

  If the hypothesis is that the operating system installed is Windows 10, and Dropbox installation is confirmed by its artifacts in the mentioned directories, which assertion is the investigator most likely to make?

  A. The Dropbox was installed on the suspect's machine using the open-source version of the installation package
  B. The Dropbox application was most likely installed on the system running Windows 10
  C. The Dropbox artifacts were manually moved to the mentioned directories on the suspect's hard drive
  D. The Dropbox installation occurred using Windows 10's built-in installation manager
  B. The Dropbox application was most likely installed on the system running Windows 10

• Question 166:

  Web browsers can store relevant information from user activities. Forensic investigators may retrieve files, lists, access history, cookies, among other digital footprints. Which tool can contribute to this task?

  A. MZCacheView
  B. Google Chrome Recovery Utility
  C. Task Manager
  D. Most Recently Used (MRU) list
  A. MZCacheView

• Question 167:

  An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?

  A. Cloud as a subject
  B. Cloud as a tool
  C. Cloud as an object
  D. Cloud as a service
  A. Cloud as a subject

• Question 168:

  What is static executable file analysis?

  A. It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances
  B. It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances
  C. It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment
  D. It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment
  A. It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances

• Question 169:

  Which table is used to convert huge word lists (i .e. dictionary files and brute-force lists) into password hashes?

  A. Rainbow tables
  B. Hash tables
  C. Master file tables
  D. Database tables
  A. Rainbow tables

• Question 170:

  Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?

  A. Isolating the host device
  B. Installing malware analysis tools
  C. Using network simulation tools
  D. Enabling shared folders
  D. Enabling shared folders