Latest [Nov 17, 2023] EC-COUNCIL 312-49v10 Exam Practice Test To Gain Brilliante Result
Take a Leap Forward in Your Career by Earning EC-COUNCIL 312-49v10
The CHFI-v10 exam is recognized globally and is an ideal certification for professionals who are involved in the investigation of cybercrime. It is a rigorous exam that requires candidates to demonstrate their understanding of various topics related to digital forensics. Computer Hacking Forensic Investigator (CHFI-v10) certification is highly respected in the industry and is a valuable asset for professionals who are looking to advance their career in the field of cybersecurity.
NEW QUESTION # 331
Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?
- A. Criminal Investigation
- B. Civil Investigation
- C. Administrative Investigation
- D. Both Civil and Criminal Investigations
Answer: C
NEW QUESTION # 332
William is examining a log entry that reads 192.168.0.1 - - [18/Jan/2020:12:42:29 +0000) "GET / HTTP/1.1" 200 1861. Which of the following logs does the log entry belong to?
- A. The common log format of Apache access log
- B. Apache error log
- C. The combined log format of Apache access log
- D. IIS log
Answer: C
NEW QUESTION # 333
On NTFS file system, which of the following tools can a forensic Investigator use In order to identify timestomping of evidence files?
- A. analyzeMFT
- B. Timestomp
- C. Exiv2
- D. wbStego
Answer: B
NEW QUESTION # 334
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where "x" represents the ___________________.
- A. Drive name
- B. Sequential number
- C. Original file name's extension
- D. Original file name
Answer: A
NEW QUESTION # 335
Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?
- A. Enticement
- B. Intruding into a honeypot is not illegal
- C. Intruding into a DMZ is not illegal
- D. Entrapment
Answer: D
NEW QUESTION # 336
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.
(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)
03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111
TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 23678634 2878772
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111
UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84
Len: 64
01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................
00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................
00 00 00 11 00 00 00 00 ........
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773
UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104
Len: 1084
47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8
- A. The attacker has scanned and exploited the system using Buffer Overflow
- B. The attacker has conducted a network sweep on port 111
- C. The attacker has installed a backdoor
- D. The attacker has used a Trojan on port 32773
Answer: B
NEW QUESTION # 337
"To ensure that the digital evidence is collected, preserved, examined, or transferred In a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effective quality system" Is a principle established by:
- A. SWGDE
- B. NCIS
- C. NIST
- D. EC-Council
Answer: A
NEW QUESTION # 338
James, a forensics specialist, was tasked with investigating a Windows XP machine that was used for malicious online activities. During the Investigation, he recovered certain deleted files from Recycle Bin to Identify attack clues.
Identify the location of Recycle Bin in Windows XP system.
- A. Iocal/sha re/Trash
- B. Drive:\RECYCLER\
- C. Drive:\$Recycle.Bin\
- D. DriveARECYCLED
Answer: C
NEW QUESTION # 339
What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?
- A. System CheckPoints required for restoring
- B. Restore point functions
- C. Automatically created restore points
- D. Restore point interval
Answer: A
NEW QUESTION # 340
What must an attorney do first before you are called to testify as an expert?
- A. Engage in damage control
- B. Qualify you as an expert witness
- C. Prove that the tools you used to conduct your examination are perfect
- D. Read your curriculum vitae to the jury
Answer: B
NEW QUESTION # 341
Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image?
- A. gif
- B. bmp
- C. jpeg
- D. png
Answer: C
NEW QUESTION # 342
Robert, a cloud architect, received a huge bill from the cloud service provider, which usually doesn't happen. After analyzing the bill, he found that the cloud resource consumption was very high. He then examined the cloud server and discovered that a malicious code was running on the server, which was generating huge but harmless traffic from the server. This means that the server has been compromised by an attacker with the sole intention to hurt the cloud customer financially. Which attack is described in the above scenario?
- A. EDoS Attack (Economic Denial of Service)
- B. XSS Attack
- C. Man-in-the-cloud Attack
- D. DDoS Attack (Distributed Denial of Service)
Answer: D
NEW QUESTION # 343
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?
- A. Three
- B. Four
- C. Two
- D. One
Answer: C
NEW QUESTION # 344
Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?
- A. Static
- B. Dynamic
- C. Hybrid
- D. Volatile
Answer: C
NEW QUESTION # 345
In the following email header, where did the email first originate from?
- A. Smtp1.somedomain.com
- B. Somedomain.com
- C. David1.state.ok.gov.us
- D. Simon1.state.ok.gov.us
Answer: D
NEW QUESTION # 346
Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?
- A. Coreography
- B. Ethereal
- C. Helix
- D. Datagrab
Answer: C
NEW QUESTION # 347
Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee In order to hide their nefarious actions. What tool should Mark use to restore the data?
- A. R-Studio
- B. EFSDump
- C. Diskmon D
- D. iskvlew
Answer: A
NEW QUESTION # 348
......
Authentic Best resources for 312-49v10 Online Practice Exam: https://actualtests.realvalidexam.com/312-49v10-real-exam-dumps.html
