EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 311:

  Which of the following file formats allows the user to compress the acquired data as well as keep it randomly accessible?

  A. Proprietary Format
  B. Generic Forensic Zip (gfzip)
  C. Advanced Forensic Framework 4
  D. Advanced Forensics Format (AFF)
  B. Generic Forensic Zip (gfzip)

• Question 312:

  Log management includes all the processes and techniques used to collect, aggregate, and analyze computer-generated log messages. It consists of the hardware, software, network and media used to generate, transmit, store, analyze, and dispose of log data.

  A. True
  B. False
  A. True

• Question 313:

  An executive has leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?

  A. Postmortem Analysis
  B. Real-Time Analysis
  C. Packet Analysis
  D. Malware Analysis
  A. Postmortem Analysis

• Question 314:

  If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  A. The system files have been copied by a remote attacker
  B. The system administrator has created an incremental backup
  C. The system has been compromised using a t0rn rootkit
  D. Nothing in particular as these can be operational files
  C. The system has been compromised using a t0rn rootkit

• Question 315:

  As a CHFI professional, which of the following is the most important to your professional reputation?

  A. Your Certifications
  B. The correct, successful management of each and every case
  C. The free that you charge
  D. The friendship of local law enforcement officers
  B. The correct, successful management of each and every case

• Question 316:

  A Computer Hacking Forensics Investigator (CHFI) has been asked to retrieve specific email files from a large RAID server after a data breach. Additionally, fragments of unallocated (deleted) data are also required. However, there is a severe constraint on time and resources.

  Considering these requirements, which type of data acquisition should the investigator primarily focus on?

  A. Logical acquisition
  B. Bit-stream disk-to-disk
  C. Sparse acquisition
  D. Bit-stream disk-to-image-file
  C. Sparse acquisition

• Question 317:

  You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printed out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

  A. Routing Table
  B. Firewall log
  C. Configuration files
  D. Email Header
  D. Email Header

• Question 318:

  Which of the following statements is true with respect to SSDs (solid-state drives)?

  A. Like HDDs, SSDs also have moving parts
  B. SSDs contain tracks, clusters, and sectors to store data
  C. Faster data access, lower power usage, and higher reliability are some of the major advantages of SSDs over HDDs
  D. SSDs cannot store non-volatile data
  C. Faster data access, lower power usage, and higher reliability are some of the major advantages of SSDs over HDDs

• Question 319:

  What is the primary function of the tool CHKDSK in Windows that authenticates the file system reliability of a volume?

  A. Repairs logical file system errors
  B. Check the disk for hardware errors
  C. Check the disk for connectivity errors
  D. Check the disk for Slack Space
  A. Repairs logical file system errors

• Question 320:

  What are the security risks of running a "repair" installation for Windows XP?

  A. Pressing Shift+F1 gives the user administrative rights
  B. Pressing Ctrl+F10 gives the user administrative rights
  C. There are no security risks when running the "repair" installation for Windows XP
  D. Pressing Shift+F10 gives the user administrative rights
  D. Pressing Shift+F10 gives the user administrative rights