Get 312-49v9 Braindumps & 312-49v9 Real Exam Questions
EC-COUNCIL 312-49v9 Actual Questions and Braindumps
EC-COUNCIL 312-49v9 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
NEW QUESTION 246
You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?
- A. 0:1709-1858
- B. 1:1709, 150
- C. 0:1000, 150
- D. 0:1709, 150
Answer: D
Explanation:
DriveSpy can except two different formats:
Drive #:Start Sector, # Sectors
Drive#:Start Sector-Absolute End Sector.
Drive # is zero based
Both Answer B and D would appear correct, and both formats are valid.
NEW QUESTION 247
An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?
- A. Cloud as an object
- B. Cloud as a subject
- C. Cloud as a service
- D. Cloud as a tool
Answer: B
NEW QUESTION 248
One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?
- A. The File Allocation Table
- B. The sector map
- C. The file footer
- D. The file header
Answer: D
NEW QUESTION 249
What document does the screenshot represent?
- A. Chain of custody form
- B. Evidence collection form
- C. Expert witness form
- D. Search warrant form
Answer: A
NEW QUESTION 250
According to US federal rules, to present a testimony in a court of law, an expert witness needs to furnish certain information to prove his eligibility. Jason, a qualified computer forensic expert who has started practicing two years back, was denied an expert testimony in a computer crime case by the US Court of Appeals for the Fourth Circuit in Richmond,
Virginia. Considering the US federal rules, what could be the most appropriate reason for the court to reject Jason's eligibility as an expert witness?
- A. Being a computer forensic expert, Jason is not eligible to present testimony in a computer crime case
- B. Jason was unable to furnish documents showing four years of previous experience in the field
- C. Jason was unable to furnish documents to prove that he is a computer forensic expert
- D. Jason was not aware of legal issues involved with computer crimes
Answer: B
NEW QUESTION 251
Where are files temporarily written in Unix when printing?
- A. /var/spool
- B. /spool
- C. /var/print
- D. /usr/spool
Answer: A
NEW QUESTION 252
Which of the following is the certifying body of forensics labs that investigate criminal cases by analyzing evidence?
- A. The American Forensics Laboratory for Computer Forensics (AFLCF)
- B. The American Forensics Laboratory Society (AFLS)
- C. International Society of Forensics Laboratory (ISFL)
- D. The American Society of Crime Laboratory Directors (ASCLD)
Answer: D
NEW QUESTION 253
Chong-lee a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his claim?
- A. Identifying file obfuscation
- B. File fingerprinting
- C. Dynamic analysis
- D. Static analysis
Answer: C
NEW QUESTION 254
A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process.
What kind of picture is this file. What kind of picture is this file?
- A. Metafile image
- B. Raster image
- C. Vector image
- D. Catalog image
Answer: C
NEW QUESTION 255
How many possible sequence number combinations are there in TCP/IP protocol?
- A. 1 billion
- B. 32 million
- C. 4 billion
- D. 320 billion
Answer: C
NEW QUESTION 256
Madison is on trial for allegedly breaking into her university's internal network. The police raided her dorm room and seized all of her computer equipment. Madison's lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison's lawyer trying to prove the police violated?
- A. The 5th Amendment
- B. The 4th Amendment
- C. The 10th Amendment
- D. The 1st Amendment
Answer: B
NEW QUESTION 257
During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-
9\%]+" in analyzed evidence details. What is the expression used for?
- A. Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
- B. Checks for closing angle bracket, hex or double-encoded hex equivalent
- C. Checks for opening angle bracket, its hex or double-encoded hex equivalent
- D. Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation
Answer: A
NEW QUESTION 258
Which file is a sequence of bytes organized into blocks understandable by the system's linker?
- A. Object file
- B. None of these
- C. executable file
- D. source file
Answer: A
NEW QUESTION 259
What document does the screenshot represent?
- A. Chain of custody form
- B. Evidence collection form
- C. Expert witness form
- D. Search warrant form
Answer: B
NEW QUESTION 260
Which of the following registry hive gives the configuration information about which application was used to open various files on the system?
- A. HKEY_LOCAL_MACHINE
- B. HKEY_USERS
- C. HKEY_CURRENT_CONFIG
- D. HKEY_CLASSES_ROOT
Answer: D
NEW QUESTION 261
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
- A. Keep the device powered on
- B. Turn off the device immediately
- C. Remove the battery immediately
- D. Remove any memory cards immediately
Answer: A
NEW QUESTION 262
Where does Encase search to recover NTFS files and folders?
- A. MFT
- B. Slack space
- C. MBR
- D. HAL
Answer: A
NEW QUESTION 263
......
312-49v9 Dumps To Pass EC-COUNCIL Exam in 24 Hours - ExamsLabs: https://realexamcollection.examslabs.com/EC-COUNCIL/CHFIv9/best-312-49v9-exam-dumps.html