EC-COUNCIL 312-49V9 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-49V9 Online Questions & Answers

• Question 161:

  Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

  A. Sector
  B. Metadata
  C. MFT
  D. Slack Space
  D. Slack Space

• Question 162:

  Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

  A. Text semagram
  B. Visual semagram
  C. Grill cipher
  D. Visual cipher
  B. Visual semagram

• Question 163:

  Why should you note all cable connections for a computer you want to seize as evidence?

  A. to know what outside connections existed
  B. in case other devices were connected
  C. to know what peripheral devices exist
  D. to know what hardware existed
  A. to know what outside connections existed

• Question 164:

  Which of the following is not an example of a cyber-crime?

  A. Fraud achieved by the manipulation of the computer records
  B. Firing an employee for misconduct
  C. Deliberate circumvention of the computer security systems
  D. Intellectual property theft, including software piracy
  B. Firing an employee for misconduct

• Question 165:

  What method of copying should always be performed first before carrying out an investigation?

  A. Parity-bit copy
  B. Bit-stream copy
  C. MS-DOS disc copy
  D. System level copy
  B. Bit-stream copy

• Question 166:

  Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for. Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report?

  A. TIFF-8
  B. DOC
  C. WPD
  D. PDF
  D. PDF

• Question 167:

  What file structure database would you expect to find on floppy disks?

  A. NTFS
  B. FAT32
  C. FAT16
  D. FAT12
  D. FAT12

• Question 168:

  What must be obtained before an investigation is carried out at a location?

  A. Search warrant
  B. Subpoena
  C. Habeas corpus
  D. Modus operandi
  A. Search warrant

• Question 169:

  As a CHFI professional, which of the following is the most important to your professional reputation?

  A. Your Certifications
  B. The correct, successful management of each and every case
  C. The free that you charge
  D. The friendship of local law enforcement officers
  B. The correct, successful management of each and every case

• Question 170:

  Determine the message length from following hex viewer record:

  

  A. 6E2F
  B. 13
  C. 27
  D. 810D
  D. 810D