Free 312-49v10 Braindumps Download Updated on Apr 25, 2023 with 705 Questions
EC-COUNCIL 312-49v10 Exam Practice Test Questions
EC-COUNCIL 312-49v10 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION 135
Maria has executed a suspicious executable file In a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for In this scenario?
- A. Event ID 7040
- B. Event ID 4624
- C. Event ID 4657
- D. Event ID 4688
Answer: C
NEW QUESTION 136
Which among the following files provides email header information in the Microsoft Exchange server?
- A. PRIV.STM
- B. gwcheck.db
- C. PRIV.EDB
- D. PUB.EDB
Answer: C
NEW QUESTION 137
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
- A. The computer will be set in a constant reboot state
- B. The wrong partition may be set to active
- C. All virtual memory will be deleted
- D. This action can corrupt the disk
Answer: D
NEW QUESTION 138
Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?
- A. Ethereal
- B. Coreography
- C. Helix
- D. Datagrab
Answer: C
NEW QUESTION 139
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?
- A. International Mobile Equipment Identifier (IMEI)
- B. Equipment Identity Register (EIR)
- C. Integrated circuit card identifier (ICCID)
- D. International mobile subscriber identity (IMSI)
Answer: A
NEW QUESTION 140
Which of the following tool enables data acquisition and duplication?
- A. Colasoft's Capsa
- B. Wireshark
- C. DriveSpy
- D. Xplico
Answer: C
NEW QUESTION 141
As a CHFI professional, which of the following is the most important to your professional reputation?
- A. The correct, successful management of each and every case
- B. The free that you charge
- C. Your Certifications
- D. The friendship of local law enforcement officers
Answer: A
NEW QUESTION 142
What must an attorney do first before you are called to testify as an expert?
- A. Prove that the tools you used to conduct your examination are perfect
- B. Engage in damage control
- C. Qualify you as an expert witness
- D. Read your curriculum vitae to the jury
Answer: C
NEW QUESTION 143
Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password?
- A. Syllable attack
- B. Brute force attack
- C. Hybrid attack
- D. Rule-based attack
Answer: D
NEW QUESTION 144
Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison lawyer trying to prove the police violated?
- A. The 1st Amendment
- B. The 5th Amendment
- C. The 10th Amendment
- D. The 4th Amendment
Answer: D
NEW QUESTION 145
You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years.
You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?
- A. CGI code
- B. Web bug
- C. Trojan.downloader
- D. Blind bug
Answer: B
NEW QUESTION 146
Which of the following is NOT a graphics file?
- A. Picture2.bmp
- B. Picture1.tga
- C. Picture3.nfo
- D. Picture4.psd
Answer: C
NEW QUESTION 147
Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?
- A. Cachelnf
- B. Coreography
- C. FATKit
- D. Belkasoft Live RAM Capturer
Answer: D
NEW QUESTION 148
Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?
- A. Bit-by-bit Acquisition
- B. Sparse or Logical Acquisition
- C. Bit-stream disk-to-disk Acquisition
- D. Static Acquisition
Answer: B
NEW QUESTION 149
Which of the following application password cracking tool can discover all password-protected items on a computer and decrypts them?
- A. Passware Kit Forensic
- B. Windows Password Recovery Bootdisk
- C. TestDisk for Windows
- D. R-Studio
Answer: A
NEW QUESTION 150
Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. He wants to recover all the data, which includes his personal photos, music, documents, videos, official emails, etc. Which of the following tools shall resolve Bob's purpose?
- A. Recuva
- B. Colasoft's Capsa
- C. Cain & Abel
- D. Xplico
Answer: A
NEW QUESTION 151
What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?
- A. System Baselining
- B. Start-up Programs Monitoring
- C. Windows Services Monitoring
- D. Host integrity Monitoring
Answer: D
NEW QUESTION 152
You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a "simple backup copy" of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a "simple backup copy" will not provide deleted files or recover file fragments.
What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?
- A. Full backup Copy
- B. Bit-stream Copy
- C. Robust Copy
- D. Incremental Backup Copy
Answer: B
NEW QUESTION 153
......
Updated Verified 312-49v10 dumps Q&As - Pass Guarantee or Full Refund: https://www.passleadervce.com/CHFI-v10/reliable-312-49v10-exam-learning-guide.html
Updated Certification Exam 312-49v10 Dumps - Practice Test Questions: https://drive.google.com/open?id=14zzSoJymJtXlo52HiqzYCDdaaD6rM_QC