Eccouncil 312-49v8 Exam Dumps

Computer Hacking Forensic Investigator (v9)

Eccouncil 312-49v8 Sample Questions

Question # 1

When collecting evidence from the RAM, where do you look for data?

A. Swap file  
B. SAM file  
C. Data file  

Answer: A

Show Answer

Question # 2

During first responder procedure you should follow all laws while collecting the evidence, and contact a computer forensic examiner as soon as possible 

A. True  
B. False  

Answer: A

Show Answer

Question # 3

What is the first step that needs to be carried out to crack the password? 

A. A word list is created using a dictionary generator program or dictionaries
B. The list of dictionary words is hashed or encrypted
C. The hashed wordlist is compared against the target hashed password, generally one word at a time 

Answer: A

Show Answer

Question # 4

How do you define forensic computing?

A. It is the science of capturing, processing, and investigating data security incidents and making it acceptable to a court of law. 
B. It is a methodology of guidelines that deals with the process of cyber investigation 
C. It Is a preliminary and mandatory course necessary to pursue and understand fundamental principles of ethical hacking 

Answer: A

Show Answer

Question # 5

Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity.

A. True  
B. False  

Answer: A

Show Answer

Question # 6

The IIS log file format is a fixed (cannot be customized) ASCII text-based format. The IIS format includes basic items, such as client IP address, user name, date and time, service and instance, server name and IP address, request type, target of operation, etc. Identify the service status code from the following IIS log. 192.168.100.150, -, 03/6/11, 8:45:30, W3SVC2, SERVER, 172.15.10.30, 4210, 125, 3524, 100, 0, GET, /dollerlogo.gif, 

A. W3SVC2  
B. 4210  
C. 3524  
D. 100  

Answer: D

Show Answer

Question # 7

Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media 

A. True  
B. False  

Answer: A

Show Answer

Question # 8

Data compression involves encoding the data to take up less storage space and less bandwidth for transmission. It helps in saving cost and high data manipulation in many business applications. Which data compression technique maintains data integrity? 

A. Lossless compression  
B. Lossy compression  
C. Speech encoding compression  

Answer: A

Show Answer

Question # 9

At the time of evidence transfer, both sender and receiver need to give the information about date and time of transfer in the chain of custody record.

A. True  
B. False  

Answer: A

Show Answer

Question # 10

When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code 

A. First 12  
B. First 16  

Answer: B

Show Answer

Question # 11

Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader?

A. Open code steganography  
B. Visual semagrams steganography  

Answer: A

Show Answer

Question # 12

Physical security recommendations: There should be only one entrance to a forensics lab 

A. True  
B. False  

Answer: A

Show Answer

Question # 13

Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file. Which of the following hash algorithms produces a message digest that is 128 bits long? 

A. CRC-32  
B. MD5  

Answer: B

Show Answer

Question # 14

All the Information about the user activity on the network, like details about login and logoff attempts, is collected in the security log of the computer. When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table. In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer?

A. 528  
B. 529  

Answer: A

Show Answer

Question # 15

Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time. Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network?

A. Same-platform correlation  
B. Cross-platform correlation  

Answer: B

Show Answer

Question # 16

Syslog is a client/server protocol standard for forwarding log messages across an IP network. Syslog uses ___________to transfer log messages in a clear text format. 

A. TCP  
B. FTP  

Answer: A

Show Answer

Question # 17

The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

A. INFO2 file  
B. INFO1 file  

Answer: A

Show Answer

Question # 18

When a system is compromised, attackers often try to disable auditing, in Windows 7; modifications to the audit policy are recorded as entries of Event ID____________. 

A. 4902  
B. 3902  

Answer: A

Show Answer

Question # 19

Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software? 

A. Operating System (OS) logs  
B. Application logs
C. Security software logs  

Answer: C

Show Answer

Question # 20

In which step of the computer forensics investigation methodology would you run MD5 checksum on the evidence?  

A. Obtain search warrant  
B. Evaluate and secure the scene  
C. Collect the evidence  
D. Acquire the data  

Answer: D

Show Answer

Question # 21

Which one of the following is not a consideration in a forensic readiness planning checklist? 

A. Define the business states that need digital evidence  
B. Identify the potential evidence available  
C. Decide the procedure for securely collecting the evidence that meets the requirement fn 

Answer: D

Show Answer

Question # 22

When a file or folder is deleted, the complete path, including the original file name, is stored in a special hidden file called "INF02" in the Recycled folder. If the INF02 file is deleted, it is re-created when you___________. 

A. Restart Windows  
B. Kill the running processes in Windows task manager  
C. Run the antivirus tool on the system  

Answer: A

Show Answer

Question # 23

Depending upon the Jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?  

A. 18 USC 7029  
B. 18 USC 7030  
C. 18 USC 7361  

Answer: B

Show Answer

Question # 24

Tracks numbering on a hard disk begins at 0 from the outer edge and moves towards the center, typically reaching a value of ___________. 

A. 1023  
B. 1020  

Answer: A

Show Answer

Question # 25

TCP/IP (Transmission Control Protocol/Internet Protocol) is a communication protocol used to connect different hosts in the Internet. It contains four layers, namely the network interface layer. Internet layer, transport layer, and application layer. Which of the following protocols works under the transport layer of TCP/IP?

A. UDP  
B. HTTP  

Answer: A

Show Answer

Question # 26

Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where, “X” represents the _________

A. Drive name  
B. Sequential number  
C. Original file name's extension  

Answer: A

Show Answer

Question # 27

Netstat is a tool for collecting Information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

A. netstat ?ano  
B. netstat ?b  

Answer: A

Show Answer

Question # 28

P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails.

A. Port 109  
B. Port 110  
C. Port 115  

Answer: B

Show Answer

Question # 29

Which of the following statements is not a part of securing and evaluating electronic crime scene checklist?

A. Locate and help the victim  
B. Transmit additional flash messages to other responding units  
C. Request additional help at the scene if needed  
D. Blog about the incident on the internet  

Answer: D

Show Answer

Question # 30

How do you define Technical Steganography?

A. Steganography that uses physical or chemical means to hide the existence of a message 
B. Steganography that utilizes written natural language to hide the message in the carrier in some non-obvious ways 

Answer: A

Show Answer

Question # 31

Raw data acquisition format creates ____________of a data set or suspect drive

A. Simple sequential flat files  
B. Segmented files  

Answer: A

Show Answer

Question # 32

In what circumstances would you conduct searches without a warrant?

A. When destruction of evidence is imminent, a warrantless seizure of that evidence is justified if there is probable cause to believe that the item seized constitutes evidence of criminal activity 
B. Agents may search a place or object without a warrant if he suspect the crime was committed 

Answer: A

Show Answer

Question # 33

What is the "Best Evidence Rule"?

A. It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy
B. It contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, and command history

Answer: A

Show Answer

Question # 34

Attacker uses vulnerabilities in the authentication or session management functions such as exposed accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges. Which of the following  vulnerability/exploitation is referred above?

A. Session ID in URLs  
B. Timeout Exploitation  

Answer: B

Show Answer

Question # 35

Computer security logs contain information about the events occurring within an organization's systems and networks. Application and Web server log files are useful in detecting web attacks. The source, nature, and time of the attack can be determined by _________of the compromised system.

A. Analyzing log files 
B. Analyzing SAM file 

Answer: A

Show Answer

Question # 36

Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is: 

Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is: 
B. HKEY_LOCAL_MACHlNE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \NetworkList

Answer: A

Show Answer

Question # 37

The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin. What is the size limit for Recycle Bin in Vista and later versions of the Windows? 

A. No size limit  
B. Maximum of 3.99 GB  

Answer: A

Show Answer

Question # 38

Log management includes all the processes and techniques used to collect, aggregate, and analyze computer-generated log messages. It consists of the hardware, software, network and media used to generate, transmit, store, analyze, and dispose of log data. 

A. True  
B. False  

Answer: A

Show Answer

Question # 39

Injection flaws are web application vulnerabilities that allow untrusted data to be Interpreted and executed as part of a command or query. Attackers exploit injection flaws by constructing malicious commands or queries that result in data loss or corruption, lack of accountability, or denial of access. Which of the following injection flaws involves the injection of malicious code through a web application? 

A. SQL Injection  
B. Password brute force  
C. Nmap Scanning  

Answer: A

Show Answer

Question # 40

What is the goal of forensic science?

A. To determine the evidential value of the crime scene and related evidence  
B. Mitigate the effects of the information security breach  
C. Save the good will of the investigating organization  

Answer: A

Show Answer

Question # 41

Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox, or overwhelm the server where the email address is hosted, to cause a denial-of-service attack?

A. Email spamming  
B. Mail bombing  

Answer: B

Show Answer