EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 51:

  In which registry does the system store the Microsoft security IDs?

  A. HKEY_CLASSES_ROOT (HKCR)
  B. HKEY_CURRENT_CONFIG (HKCC)
  C. HKEY_CURRENT_USER (HKCU)
  D. HKEY_LOCAL_MACHINE (HKLM)
  D. HKEY_LOCAL_MACHINE (HKLM)

• Question 52:

  Microsoft Outlook maintains email messages in a proprietary format in what type of file?

  A. .email
  B. .mail
  C. .pst
  D. .doc
  C. .pst

• Question 53:

  Raw data acquisition format creates _________ of a data set or suspect drive.

  A. Segmented image files
  B. Simple sequential flat files
  C. Compressed image files
  D. Segmented files
  B. Simple sequential flat files

• Question 54:

  The following is a log file screenshot from a default installation of IIS 6. 0.

  

  What time standard is used by IIS as seen in the screenshot?

  A. UTC
  B. GMT
  C. TAI
  D. UT
  A. UTC

• Question 55:

  Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices.

  How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

  A. Two
  B. One
  C. Three
  D. Four
  A. Two

• Question 56:

  Self-Monitoring, Analysis, and Reporting Technology (SMART) is built into the hard drives to monitor and report system activity. Which of the following is included in the report generated by SMART?

  A. Power Off time
  B. Logs of high temperatures the drive has reached
  C. All the states (running and discontinued) associated with the OS
  D. List of running processes
  B. Logs of high temperatures the drive has reached

• Question 57:

  According to US federal rules, to present a testimony in a court of law, an expert witness needs to furnish certain information to prove his eligibility. Jason, a qualified computer forensic expert who has started practicing two years back, was denied an expert testimony in a computer crime case by the US Court of Appeals for the Fourth Circuit in Richmond, Virginia.

  Considering the US federal rules, what could be the most appropriate reason for the court to reject Jason's eligibility as an expert witness?

  A. Jason was unable to furnish documents showing four years of previous experience in the field
  B. Being a computer forensic expert, Jason is not eligible to present testimony in a computer crime case
  C. Jason was unable to furnish documents to prove that he is a computer forensic expert
  D. Jason was not aware of legal issues involved with computer crimes
  A. Jason was unable to furnish documents showing four years of previous experience in the field

• Question 58:

  Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?

  A. Swap space
  B. Application data
  C. Files and documents
  D. Slack space
  A. Swap space

• Question 59:

  In the following email header, where did the email first originate from?

  

  A. Somedomain.com
  B. Smtp1.somedomain.com
  C. Simon1.state.ok.gov.us
  D. David1.state.ok.gov.us
  C. Simon1.state.ok.gov.us

• Question 60:

  A security breach has occurred at a multinational company. The forensic investigator was asked to identify whether a specific application, say "SecureBox", was installed on a Windows 10 system under suspicion. Which approach should the investigator follow to validate this?

  A. Making observations, hypothesizing about the incident, and then checking for SecureBox artifacts in specific operating system directories
  B. Choosing commercial tools for investigation because they have a market value and provide a diverse and in-depth investigation
  C. Experimenting and testing various plans in an environment similar to the suspect machine
  D. Formulating an opinion based on the review of several artifacts and determining exactly when SecureBox was installed
  A. Making observations, hypothesizing about the incident, and then checking for SecureBox artifacts in specific operating system directories