EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 721:

  Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?

  A. malfind
  B. pslist
  C. mallist
  D. malscan
  A. malfind

• Question 722:

  An organization just experienced a serious cybersecurity incident involving data theft. The first responder on the scene is anon-forensics staff member. Based on the guidelines provided, which of the following actions should they take as the first response to this incident?

  A. They should isolate the affected systems and document every detail relevant to the incident without tampering with them
  B. They should start retrieving the stolen data from the compromised systems immediately to minimize further damage
  C. They should power down the compromised systems to prevent further attacks
  D. They should launch a preliminary investigation into the breach before the forensics team arrives
  A. They should isolate the affected systems and document every detail relevant to the incident without tampering with them

• Question 723:

  Which of these ISO standards define the file system for optical storage media, such as CD-ROM and DVD-ROM?

  A. ISO 9660
  B. ISO 13346
  C. ISO 9960
  D. ISO 13490
  A. ISO 9660

• Question 724:

  The need for computer forensics is highlighted by an exponential increase in the number of cybercrimes and litigations where large organizations were involved. Computer forensics plays an important role in tracking the cyber criminals. The main role of computer forensics is to:

  A. Maximize the investigative potential by maximizing the costs
  B. Harden organization perimeter security
  C. Document monitoring processes of employees of the organization
  D. Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court
  D. Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court

• Question 725:

  Which of the following is not a part of data acquisition forensics Investigation?

  A. Permit only authorized personnel to access
  B. Protect the evidence from extremes in temperature
  C. Work on the original storage medium not on the duplicated copy
  D. Disable all remote access to the system
  C. Work on the original storage medium not on the duplicated copy

• Question 726:

  Which of the following is a device monitoring tool?

  A. Capsa
  B. Driver Detective
  C. Regshot
  D. RAM Capturer
  A. Capsa

• Question 727:

  While collecting Active Transaction Logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file. Here, assigning NULL values implies?

  A. Start and end points for log sequence numbers are specified
  B. Start and end points for log files are not specified
  C. Start and end points for log files are specified
  D. Start and end points for log sequence numbers are not specified
  D. Start and end points for log sequence numbers are not specified

• Question 728:

  In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

  A. Chosen-message attack
  B. Known-cover attack
  C. Known-message attack
  D. Known-stego attack
  A. Chosen-message attack

• Question 729:

  One way to identify the presence of hidden partitions on a suspect's hard drive is to:

  A. Add up the total size of all known partitions and compare it to the total size of the hard drive
  B. Examine the FAT and identify hidden partitions by noting an H in the partition Type field
  C. Examine the LILO and note an H in the partition Type field
  D. It is not possible to have hidden partitions on a hard drive
  A. Add up the total size of all known partitions and compare it to the total size of the hard drive

• Question 730:

  What document does the screenshot represent?

  

  A. Chain of custody form
  B. Search warrant form
  C. Evidence collection form
  D. Expert witness form
  A. Chain of custody form