EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 641:

  Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

  A. Tokenmon
  B. PSLoggedon
  C. TCPView
  D. Process Monitor
  B. PSLoggedon

• Question 642:

  A forensic investigator has collected a compromised Amazon Echo Dot and a smartphone from a crime scene. The Alexa app on the smartphoneis synced with the Echo Dot. To begin investigating these devices, the investigator needs to obtain certain artifacts.

  In this scenario, which of the following sequence of steps should the investigator follow to acquire the necessary artifacts for a client-based analysis?

  A. Retrieve database files using the adb pull command -> Generate an image of the firmware -> Parse database files -> Conduct data analysis
  B. Parse database files -> Retrieve database files using the adb pull command -> Generate an image of the firmware -> Conduct data analysis
  C. Generate an image of the firmware -> Retrieve database files using the adb pull command -> Parse database files -> Conduct data analysis
  D. Retrieve database files using the adb pull command -> Parse database files -> Generate an image of the firmware -> Conduct data analysis
  A. Retrieve database files using the adb pull command -> Generate an image of the firmware -> Parse database files -> Conduct data analysis

• Question 643:

  In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file var/log/dmesg?

  A. Kernel ring buffer information
  B. All mail server message logs
  C. Global system messages
  D. Debugging log messages
  A. Kernel ring buffer information

• Question 644:

  You have been given the task to investigate web attacks on a Windows-based server.

  Which of the following commands will you use to look at which sessions the machine has opened with other systems?

  A. Net sessions
  B. Net use
  C. Net config
  D. Net share
  B. Net use

• Question 645:

  Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.

  A. Statement of personal or family history
  B. Prior statement by witness
  C. Statement against interest
  D. Statement under belief of impending death
  D. Statement under belief of impending death

• Question 646:

  What is the investigator trying to view by issuing the command displayed in the following screenshot?

  

  A. List of services stopped
  B. List of services closed recently
  C. List of services recently started
  D. List of services installed
  D. List of services installed

• Question 647:

  While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

  A. Windows 10
  B. Windows 8
  C. Windows 7
  D. Windows 8.1
  C. Windows 7

• Question 648:

  A security analyst identifies an influx of network traffic from an IoT HVAC system in a multinational corporation. The corporation is concerned about a possible HVAC attack. What should the security analyst prioritize to mitigate this potential threat?

  A. Investigate a possible BlueBorne attack on the IoT devices
  B. Inspect the IoT HVAC system for backdoor access
  C. Validate the IoT HVAC system for a potential DDoS attack
  D. Check for signs of a Rolling Code attack on the IoT HVAC system
  B. Inspect the IoT HVAC system for backdoor access

• Question 649:

  A Computer Hacking Forensic Investigator (CHFI) arrives at the crime scene in an incident involving cybercrime. While performing the initial search of the scene, the investigator spots a GPS device, a keyboard, and a telephone line connected to a caller ID box.

  Considering the steps involved in searching for evidence, which of the following actions should the investigator perform first?

  A. Secure the keyboard to protect any potential fingerprints
  B. Initiate the search and seizure evidence log to document details of the identified devices
  C. Record observations about the current situation at the scene
  D. Survey the GPS device to explore potential sources of digital information
  A. Secure the keyboard to protect any potential fingerprints

• Question 650:

  Which one of the following is not a first response procedure?

  A. Preserve volatile data
  B. Fill forms
  C. Crack passwords
  D. Take photos
  C. Crack passwords