312-49v11 Free Certification Exam Material from Exam4Tests with 1006 Questions
Use Real 312-49v11 - 100% Cover Real Exam Questions
NEW QUESTION # 300
An investigator Is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:
- A. Static analysis
- B. Threat analysis
- C. Threat hunting
- D. Dynamic analysis
Answer: B
NEW QUESTION # 301
In an investigation into a cyber-attack incident, you are a Computer Hacking Forensics Investigator tasked with gathering digital evidence. The targeted system has been turned off unexpectedly, and you know the system was running a crucial process during the attack. Which types of evidence might be lost due to the system being switched off?
- A. Volatile data such as command history and process-to-port mapping, but not non-volatile data like event logs and hidden files
- B. Non-volatile data such as event logs and hidden files, but not volatile data like command history and process-to-port mapping
- C. Both volatile data, such as command history and process-to-port mapping, and non-volatile data, like event logs and hidden files
- D. Neither volatile data, such as command history and process-to-port mapping, nor non-volatile data, like event logs and hidden files
Answer: A
NEW QUESTION # 302
In a cyber-forensic investigation, a CHFI expert found a Linux system unexpectedly booting into a different OS kernel. The system was configured with the Grand Unified Bootloader (GRUB). The expert suspects that an attacker may have tampered with the bootloader stage of the Linux boot process. Which one of the following is NOT a step performed during the bootloader stage in a normal Linux boot process?
- A. Detecting the device that contains the file system and loading the necessary modules
- B. Loading the kernel into memory
- C. Loading the Linux kernel and optional initial RAM disk
- D. Execution of the Linuxrc program to generate the real file system for the kernel
Answer: D
NEW QUESTION # 303
The investigator wants to examine changes made to the system's registry by the suspect program. Which of the following tool can help the investigator?
- A. RAM Capturer
- B. TRIPWIRE
- C. What's Running
- D. Regshot
Answer: D
NEW QUESTION # 304
System software password cracking is defined as cracking the operating system and all other utilities that enable a computer to function
- A. False
- B. True
Answer: B
NEW QUESTION # 305
Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?
- A. Verbal Formal Report
- B. Verbal Informal Report
- C. Written Informal Report
- D. Written Formal Report
Answer: A
NEW QUESTION # 306
Which among the following laws emphasizes the need for each Federal agency to develop, document, and implement an organization-wide program to provide information security for the information systems that support its operations and assets?
- A. HIPAA
- B. SOX
- C. GLBA
- D. FISMA
Answer: D
NEW QUESTION # 307
Which of the following statements is true with respect to SSDs (solid-state drives)?
- A. SSDs contain tracks, clusters, and sectors to store data
- B. Like HDDs. SSDs also have moving parts
- C. Faster data access, lower power usage, and higher reliability are some of the m<ijor advantages of SSDs over HDDs
- D. SSDs cannot store non-volatile data
Answer: C
NEW QUESTION # 308
George was recently fired from his job as an IT analyst at Pitts and Company in Dallas Texas.
His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company's network by cracking some of the service accounts he knows about.
Which password cracking technique should George use in this situation?
- A. Brute force attack
- B. Syllable attack
- C. Rule-based attack
- D. Dictionary attack
Answer: C
NEW QUESTION # 309
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software ?
- A. Association of Computer Forensics Software Manufactures (ACFSM)
- B. National Institute of Standards and Technology (NIST)
- C. Society for Valid Forensics Tools and Testing (SVFTT)
- D. Computer Forensics Tools and Validation Committee (CFTVC)
Answer: B
NEW QUESTION # 310
Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.
Which organization coordinates computer crimes investigations throughout the United States?
- A. CERT Coordination Center
- B. Internet Fraud Complaint Center
- C. National Infrastructure Protection Center
- D. Local or national office of the U.S. Secret Service
Answer: C
NEW QUESTION # 311
Which of the following methods of mobile device data acquisition captures all the data present on the device, as well as all deleted data and access to unallocated space?
- A. Physical acquisition
- B. Logical acquisition
- C. Manual acquisition
- D. Direct acquisition
Answer: A
NEW QUESTION # 312
Sally accessed the computer system that holds trade secrets of the company where she Is employed. She knows she accessed It without authorization and all access (authorized and unauthorized) to this computer Is monitored. To cover her tracks. Sally deleted the log entries on this computer. What among the following best describes her action?
- A. Password sniffing
- B. Anti-forensics
- C. Brute-force attack
- D. Network intrusion
Answer: B
NEW QUESTION # 313
An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?
- A. Security event was monitored but not stopped
- B. An email marked as potential spam
- C. Connection rejected
- D. Malicious URL detected
Answer: B
NEW QUESTION # 314
Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use?
- A. Spycrack
- B. Netspionage
- C. Hackspionage
- D. Spynet
Answer: B
NEW QUESTION # 315
A computer forensics investigator is handling a case where the suspect destroyed a potential piece of digital evidence. The investigator has obtained a duplicate copy of the destroyed evidence and believes it's crucial to the case. What is the correct procedure under the Federal Rules of Evidence to ensure this duplicate copy can be submitted in court?
- A. The investigator must take the suspect to court to prove the authenticity of the duplicate evidence
- B. The investigator must prove that the suspect intentionally tampered with the destroyed evidence
- C. A third party must testify and confirm that the submitted duplicate is a copy of the original evidence
- D. The investigator must recreate the original piece of evidence from the duplicate copy
Answer: C
NEW QUESTION # 316
"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?
- A. Principle 1
- B. Principle 3
- C. Principle 2
- D. Principle 4
Answer: C
NEW QUESTION # 317
Which of the following statements is TRUE about SQL Server error logs?
- A. Trace files record, user-defined events, and specific system events
- B. Error logs contain IP address of SQL Server client connections
- C. SQL Server error logs record all the events occurred on the SQL Server and its databases
- D. Forensic investigator uses SQL Server Profiler to view error log files
Answer: D
NEW QUESTION # 318
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employees computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?
- A. The EFS Revoked Key Agent can be used on the computer to recover the information
- B. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information
- C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information
- D. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
Answer: C
NEW QUESTION # 319
What do you call the process in which an attacker uses magnetic field over the digital media device to delete any previously stored data?
- A. Disk magnetization
- B. Disk cleaning
- C. Disk degaussing
- D. Disk deletion
Answer: C
NEW QUESTION # 320
A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evldence1.doc. sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin. What will happen to the data?
- A. The data will be moved to new clusters in unallocated space
- B. The data will remain in its original clusters until it is overwritten
- C. The data will be overwritten with zeroes
- D. The data will become corrupted, making it unrecoverable
Answer: B
NEW QUESTION # 321
When a router receives an update for its routing table, what is the metric value change to that path?
- A. Decreased by 2
- B. Increased by 2
- C. Increased by 1
- D. Decreased by 1
Answer: C
NEW QUESTION # 322
Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?
- A. Phishing
- B. Email spamming
- C. Email spoofing
- D. Mail bombing
Answer: D
NEW QUESTION # 323
You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?
- A. locate:"logon page"
- B. outlook:"search"
- C. allinurl:"exchange/logon.asp"
- D. intitle:"exchange server"
Answer: C
NEW QUESTION # 324
Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?
- A. UUCODE
- B. MIME
- C. BINHEX
- D. UT-16
Answer: B
NEW QUESTION # 325
......
Dumps Brief Outline Of The 312-49v11 Exam: https://www.exam4tests.com/312-49v11-valid-braindumps.html
312-49v11 Training & Certification Get Latest Certified Ethical Hacker: https://drive.google.com/open?id=1hOTZsXhPmAWudSluG0XDp4Kbev4WMnBQ