Which of the following tool enables a user to reset his/her lost admin password in a Windows system?

Advanced Office Password Recovery

Smartkey Password Recovery Bundle Standard

In Steganalysis, which of the following describes a Known-stego attack?

Original and stego-object are available and the steganography algorithm is known

The hidden message and the corresponding stego-image are known

During the communication process, active attackers can change cover

Original and stego-object are available and the steganography algorithm is known

Only the steganography medium is available for analysis

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense.

Expert in criminal investigation

Witness present at the crime scene

Expert law graduate appointed by attorney

Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

Record the system state by taking photographs of physical system and the display

Perform data acquisition without disturbing the state of the systems

Open the systems, remove the hard disk and secure it

Switch off the systems and carry them to the laboratory

Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?

Passwords used across the system

When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

Undo the last action performed on the system

Use a recovery tool to undelete the file

Download the file from Microsoft website

What is the primary function of the tool CHKDSK in Windows that authenticates the file system reliability of a volume?

Repairs logical file system errors

Check the disk for hardware errors

Check the disk for connectivity errors

What does 254 represent in ICCID 89254021520014515744?

Individual Account Identification Number

A master boot record (MBR) is the first sector ("sector zero") of a data storage device. What is the size of MBR?

Depends on the capacity of the storage device

NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space.This is because:

NTFS has lower cluster size space

NTFS is a journaling file system

NTFS has lower cluster size space

FAT is an older and inefficient file system

Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card. What can Jason do in this scenario to reset the PIN and access SIM data?

He should contact the network operator for Personal Unlock Number (PUK)

He should contact the network operator for a Temporary Unlock Code (TUK)

Use system and hardware tools to gain access

He can attempt PIN guesses after 24 hours

He should contact the network operator for Personal Unlock Number (PUK)

Which of the following is NOT a part of pre-investigation phase?

Gathering information about the incident

ECCouncil 312-49v10 Practice Test 10 - Free Online Exam Prep & Questions

Which among the following files provides email header information in the Microsoft Exchange server?

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 312-49v10 Practice Test 10

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests