EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 561:

  A digital forensics investigator is analyzing the memory dump from a suspicious computer using the Bulk Extractor tool. He found a domain associated with Gmail (mail.google.com) and an associated Gmail ID. From the json.txt file, he discovered an email composed from the browser with an attachment. He also found an opened email with a different attachment in the memory dump.

  After identifying these items, what should be the investigator's next immediate step?

  A. Forensically examine the storage of the computer
  B. Extract the email.txt file for further analysis
  C. Initiate a Bulk Extractor scan on another memory dump
  D. Consult the url.txt and url_facebook-id.txt files
  B. Extract the email.txt file for further analysis

• Question 562:

  Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

  A. Rule-Based Approach
  B. Automated Field Correlation
  C. Field-Based Approach
  D. Graph-Based Approach
  B. Automated Field Correlation

• Question 563:

  When collecting electronic evidence at the crime scene, the collection should proceed from the most volatile to the least volatile

  A. True
  B. False
  A. True

• Question 564:

  Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

  A. Errors-To header
  B. Content-Transfer-Encoding header
  C. Mime-Version header
  D. Content-Type header
  A. Errors-To header

• Question 565:

  A cybersecurity investigator is analyzing a sophisticated malware program that has infiltrated a corporate network. The malware appears to use multiple propagation methods and exploits several system vulnerabilities. After capturing a sample of the malware, which of the following steps should the investigator prioritize in order to accurately determine its behavior and prevent further damage?

  A. Using a signature-based IDS to detect known malicious payloads
  B. Setting up a controlled malware analysis lab and executing the malware in isolation
  C. Deploying an endpoint detection and response solution to oversee endpoint activities
  D. Implementing network ow analysis to monitor data transmission
  B. Setting up a controlled malware analysis lab and executing the malware in isolation

• Question 566:

  Frank, a Computer Hacking Forensics Investigator (CHFI), is investigating a multi-jurisdictional cybercrime. His team successfully collected digitalevidence and ascertained that the attacker had breached the security of the system from a different country.

  Given the international nature of thecase, which of the following would be the most complex issue he might encounter during his investigation?

  A. The different legal systems and their rules for acquiring, preserving, investigating, and presenting digital evidence
  B. The volatility of the collected digital evidence
  C. The circumstantial nature of digital evidence
  D. The rapid changes in the technology used by the attacker
  A. The different legal systems and their rules for acquiring, preserving, investigating, and presenting digital evidence

• Question 567:

  Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

  A. Bayesian Correlation
  B. Vulnerability-Based Approach
  C. Rule-Based Approach
  D. Route Correlation
  A. Bayesian Correlation

• Question 568:

  Which of the following is considered as the starting point of a database and stores user data and database objects in an MS SQL server?

  A. ibdata1
  B. Application data files (ADF)
  C. Transaction log data files (LDF)
  D. Primary data files (MDF)
  D. Primary data files (MDF)

• Question 569:

  A CHFI has been asked to recover browser history from a seized Microsoft Edge browser on a Windows system. This is important to pinpoint the suspect's online activities. The suspect was known to clear their browser history frequently. Which tool and path would most efficiently recover the required data?

  A. MZCacheView tool; Path: C:\UsersWAppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cache2
  B. MZHistoryView tool; Path: C:\UsersWAppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\places.sqlite
  C. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History
  D. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
  C. Browsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History

• Question 570:

  When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

  A. Hard Drive Failure
  B. Scope Creep
  C. Unauthorized expenses
  D. Overzealous marketing
  B. Scope Creep