EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 931:

  What does the Rule 101 of Federal Rules of Evidence states?

  A. Scope of the Rules, where they can be applied
  B. Purpose of the Rules
  C. Limited Admissibility of the Evidence
  D. Rulings on Evidence
  A. Scope of the Rules, where they can be applied

• Question 932:

  An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected instance to perform further analysis and collected other data of evidentiary value. What should be their next step?

  A. They should terminate all instances connected via the same VPC
  B. They should pause the running instance
  C. They should keep the instance running as it stores critical data
  D. They should terminate the instance after taking necessary backup
  D. They should terminate the instance after taking necessary backup

• Question 933:

  When examining the log files from a Windows IIS Web Server, how often is a new log file created?

  A. the same log is used at all times
  B. a new log file is created everyday
  C. a new log file is created each week
  D. a new log is created each time the Web Server is started
  B. a new log file is created everyday

• Question 934:

  Why should you note all cable connections for a computer you want to seize as evidence?

  A. to know what outside connections existed
  B. in case other devices were connected
  C. to know what peripheral devices exist
  D. to know what hardware existed
  A. to know what outside connections existed

• Question 935:

  Which of the following statements does not support the case assessment?

  A. Review the case investigator's request for service
  B. Identify the legal authority for the forensic examination request
  C. Do not document the chain of custody
  D. Discuss whether other forensic processes need to be performed on the evidence
  C. Do not document the chain of custody

• Question 936:

  What must an attorney do first before you are called to testify as an expert?

  A. Qualify you as an expert witness
  B. Read your curriculum vitae to the jury
  C. Engage in damage control
  D. Prove that the tools you used to conduct your examination are perfect
  A. Qualify you as an expert witness

• Question 937:

  Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute in determining the addresses of data?

  A. Sectors
  B. Interface
  C. Cylinder
  D. Heads
  B. Interface

• Question 938:

  Where is the startup configuration located on a router?

  A. Static RAM
  B. BootROM
  C. NVRAM
  D. Dynamic RAM
  C. NVRAM

• Question 939:

  What type of analysis helps to identify the time and sequence of events in an investigation?

  A. Time-based
  B. Functional
  C. Relational
  D. Temporal
  D. Temporal

• Question 940:

  Which file is a sequence of bytes organized into blocks understandable by the system's linker?

  A. executable file
  B. source file
  C. Object file
  D. None of these
  C. Object file