EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 791:

  An organization has suffered a significant data breach and called in a Computer Hacking Forensics Investigator (CHFI) to gather evidence. The investigator has decided to use the dead acquisition technique to gather nonvolatile data from the compromised system.

  Which of the following would NOT typically be acquired during this type of forensic data acquisition process?

  A. Web browser cache
  B. Unallocated drive space
  C. Active network connections
  D. Boot sectors
  C. Active network connections

• Question 792:

  A computer forensics investigator is handling a case where the suspect destroyed a potential piece of digital evidence. The investigator has obtained a duplicate copy of the destroyed evidence and believes it's crucial to the case. What is the correct procedure under the Federal Rules of Evidence to ensure this duplicate copy can be submitted in court?

  A. The investigator must prove that the suspect intentionally tampered with the destroyed evidence
  B. The investigator must take the suspect to court to prove the authenticity of the duplicate evidence
  C. A third party must testify and confirm that the submitted duplicate is a copy of the original evidence
  D. The investigator must recreate the original piece of evidence from the duplicate copy
  C. A third party must testify and confirm that the submitted duplicate is a copy of the original evidence

• Question 793:

  On Linux/Unix based Web servers, what privilege should the daemon service be run under?

  A. Something other than root
  B. Root
  C. Guest
  D. You cannot determine what privilege runs the daemon service
  A. Something other than root

• Question 794:

  An expert witness is a witness, who by virtue of education, profession, or experience, is believed to have special knowledge of his/her subject beyond that of the average person, sufficient that others legally depend upon his/her opinion.

  A. True
  B. False
  A. True

• Question 795:

  In a FAT32 system, a 123 KB file will use how many sectors?

  A. 34
  B. 25
  C. 11
  D. 56
  E. 246
  E. 246

• Question 796:

  What will the following command accomplish?

  A. Test the ability of a router to handle under-sized packets
  B. Test ability of a router to handle over-sized packets
  C. Test the ability of a WLAN to handle fragmented packets
  D. Test the ability of a router to handle fragmented packets
  B. Test ability of a router to handle over-sized packets

• Question 797:

  You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a "simple backup copy" of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a "simple backup copy" will not provide deleted files or recover file fragments.

  What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

  A. Bit-stream copy
  B. Robust copy
  C. Full backup copy
  D. Incremental backup copy
  A. Bit-stream copy

• Question 798:

  What must be obtained before an investigation is carried out at a location?

  A. Search warrant
  B. Subpoena
  C. Habeas corpus
  D. Modus operandi
  A. Search warrant

• Question 799:

  You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

  A. The tool hasn't been tested by the International Standards Organization (ISO)
  B. Only the local law enforcement should use the tool
  C. The total has not been reviewed and accepted by your peers
  D. You are not certified for using the tool
  C. The total has not been reviewed and accepted by your peers

• Question 800:

  How many possible sequence number combinations are there in TCP/IP protocol?

  A. 320 billion
  B. 1 billion
  C. 4 billion
  D. 32 million
  C. 4 billion