EC-COUNCIL 312-49V10 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V10 Online Questions & Answers

• Question 951:

  During a digital forensics investigation, you stumble upon a file which you suspect to be a disguised JPEG file. You don't have any specific software to verify your suspicion, but you can view the binary representation of the file. Which characteristic would definitively indicate that the file is indeed a JPEG?

  A. The binary file ends with the value 0xffd9
  B. The file contains 16-bit integer values in big-endian byte format throughout
  C. The binary file begins with the value 0xffd8 and ends with the value 0xffd9
  D. The file size is one-tenth of the original image data size
  C. The binary file begins with the value 0xffd8 and ends with the value 0xffd9

• Question 952:

  A digital forensics investigator is examining a suspect's hard disk drive. The hard disk is known to have 16,384 cylinders, 16 heads, and 63 sectors per track, with a sector size of 512 bytes. During the investigation, the forensic analyst identifies a particular file that resides in two sectors.

  Considering that each sector contains data plus overhead information such as ID, synchronization fields. ECC, and gaps, what is the maximum potential size of this particular file stored on the disk?

  A. More than 512 bytes but less than 1024 bytes
  B. Equal to or more than 1024 bytes
  C. Equal to 512 bytes
  D. Less than 512 bytes
  A. More than 512 bytes but less than 1024 bytes

• Question 953:

  For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

  A. Bypassing iPhone passcode
  B. Debugging iPhone
  C. Rooting iPhone
  D. Copying contents of iPhone
  A. Bypassing iPhone passcode

• Question 954:

  Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity.

  A. True
  B. False
  A. True

• Question 955:

  After a major data breach in a financial institution, a forensic investigator is brought in to determine the source and the extent of the breach. The investigator needs to ensure compliance with the legal standards in their investigations.

  During the investigation, they stumble upon non-public personal information of consumers stored by the institution and suspect this information was illegally shared with non-affiliated third parties.

  Which law/regulation should be the investigator s primary concern in this scenario?

  A. Health Insurance Portability and Accountability Act of 1996
  B. Federal Information Security Modernization Act of 2014
  C. General Data Protection Regulation
  D. Gramm-Leach-Bliley Act
  D. Gramm-Leach-Bliley Act

• Question 956:

  The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

  A. Locard Exchange Principle
  B. Clark Standard
  C. Kelly Policy
  D. Silver-Platter Doctrine
  D. Silver-Platter Doctrine

• Question 957:

  During an ongoing cybercrime investigation, a non-expert witness, who is an employee of the organization, testifies to observing unusualcomputer activity. Simultaneously, an expert witness introduces a record of the regularly conducted activity of the organization. The record waskept near the incident's time adept as part of the regular activity. It reveals a similar observation as the non-expert witness.

  How would the FederalRules of Evidence classify and treat these testimonies in this scenario?

  A. The lay witness testimony is inadmissible hearsay under Rule 801. but the record is admissible under Rule 803(6)
  B. Both testimonies are admissible; the lay witness testimony is under Rule 701, and the record is under Rule 803(6)
  C. Both testimonies are inadmissible; the lay witness testimony is hearsay under Rule 801, and the record is hearsay under Rule 803(6)
  D. The lay witness testimony is admissible under Rule 701, but the record is inadmissible hearsay under Rule 803(6)
  B. Both testimonies are admissible; the lay witness testimony is under Rule 701, and the record is under Rule 803(6)

• Question 958:

  In which IoT attack does the attacker use multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?

  A. Blueborne attack
  B. Replay attack
  C. Sybil attack
  D. Jamming attack
  C. Sybil attack

• Question 959:

  Email archiving is a systematic approach to save and protect the data contained in emails so that it can tie easily accessed at a later date.

  A. True
  B. False
  A. True

• Question 960:

  Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  A. Use Vmware to be able to capture the data in memory and examine it
  B. Give the Operating System a minimal amount of memory, forcing it to use a swap file
  C. Create a Separate partition of several hundred megabytes and place the swap file there
  D. Use intrusion forensic techniques to study memory resident infections
  A. Use Vmware to be able to capture the data in memory and examine it
  C. Create a Separate partition of several hundred megabytes and place the swap file there