Examination of a computer by a technically unauthorized person will almost always result in:

Rendering any evidence found inadmissible in a court of law

Completely accurate results of the examination

The chain of custody being fully maintained

Rendering any evidence found admissible in a court of law

Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?

Installing malware analysis tools

During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?

Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent

Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation

Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent

Checks for opening angle bracket, its hex or double-encoded hex equivalent

Checks for closing angle bracket, hex or double-encoded hex equivalent

Which among the following search warrants allows the first responder to search and seize the victim's computer components such as hardware, software, storage devices, and documentation?

Electronic Storage Device Search Warrant

Citizen Informant Search Warrant

Electronic Storage Device Search Warrant

Service Provider Search Warrant

Which of the following setups should a tester choose to analyze malware behavior?

A virtual system with network simulation for internet connection

A virtual system with internet connection

A normal system without internet connect

A normal system with internet connection

A virtual system with network simulation for internet connection

What is the purpose of using Obfuscator in malware?

Avoid detection by security mechanisms

Execute malicious code in the system

Avoid encryption while passing through a VPN

Avoid detection by security mechanisms

Propagate malware to other connected devices

In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?

The images will always be identical because data is mirrored for redundancy

An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E" represent?

Network credentials of the database

During the trial, an investigator observes that one of the principal witnesses is severely ill and cannot be present for the hearing. He decides to record the evidence and present it to the court. Under which rule should he present such evidence?

Rule 1003: Admissibility of Duplicates

What is cold boot (hard boot)?

It is the process of starting a computer from a powered-down or off state

It is the process of restarting a computer that is already in sleep mode

It is the process of shutting down a computer from a powered-on or on state

It is the process of restarting a computer that is already turned on through the operating system

It is the process of starting a computer from a powered-down or off state

What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

System CheckPoints required for restoring

Automatically created restore points

System CheckPoints required for restoring

Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers

Server storage archives are the server information and settings stored on a local system, whereas the local archives are the local email client information stored on the mail server

It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers

Local archives should be stored together with the server storage archives in order to be admissible in a court of law

Local archives do not have evidentiary value as the email client may alter the message data

ECCouncil 312-49v10 Practice Test 13 - Free Online Exam Prep & Questions

While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

Become a Premium Member for full access

Unlock Premium Member

ECCouncil 312-49v10 Practice Test 13

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests