ExamGecko
Login
Home / ECCouncil / 312-49v10 / List of questions
Ask Question

ECCouncil 312-49v10 Practice Test - Questions Answers, Page 11

List of questions

Question 101

Report Export Collapse

One way to identify the presence of hidden partitions on a suspect's hard drive is to:

Add up the total size of all known partitions and compare it to the total size of the hard drive
Add up the total size of all known partitions and compare it to the total size of the hard drive
Examine the FAT and identify hidden partitions by noting an H in the partition Type field
Examine the FAT and identify hidden partitions by noting an H in the partition Type field
Examine the LILO and note an H in the partition Type field
Examine the LILO and note an H in the partition Type field
It is not possible to have hidden partitions on a hard drive
It is not possible to have hidden partitions on a hard drive
Suggested answer: A
asked 18/09/2024
Tim Roe
37 questions

Question 102

Report Export Collapse

What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?

Internet service provider information
Internet service provider information
E-mail header
E-mail header
Username and password
Username and password
Firewall log
Firewall log
Suggested answer: B
asked 18/09/2024
Miroslav Vukic
40 questions

Question 103

Report Export Collapse

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
A simple DOS copy will not include deleted files, file slack and other information
A simple DOS copy will not include deleted files, file slack and other information
There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
Suggested answer: C
asked 18/09/2024
Paul Shortt
44 questions

Question 104

Report Export Collapse

You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

the attorney-work-product rule
the attorney-work-product rule
Good manners
Good manners
Trade secrets
Trade secrets
ISO 17799
ISO 17799
Suggested answer: A
asked 18/09/2024
andrea rosi
49 questions

Question 105

Report Export Collapse

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

the File Allocation Table
the File Allocation Table
the file header
the file header
the file footer
the file footer
the sector map
the sector map
Suggested answer: B
asked 18/09/2024
Salvatore Andrisani
47 questions

Question 106

Report Export Collapse

This organization maintains a database of hash signatures for known software.

International Standards Organization
International Standards Organization
Institute of Electrical and Electronics Engineers
Institute of Electrical and Electronics Engineers
National Software Reference Library
National Software Reference Library
American National standards Institute
American National standards Institute
Suggested answer: C
asked 18/09/2024
Instel SL
35 questions

Question 107

Report Export Collapse

The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

Locard Exchange Principle
Locard Exchange Principle
Clark Standard
Clark Standard
Kelly Policy
Kelly Policy
Silver-Platter Doctrine
Silver-Platter Doctrine
Suggested answer: D
asked 18/09/2024
Shaun Kilmartin
31 questions

Question 108

Report Export Collapse

You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned
Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned
Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment
Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment
Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy
Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy
Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies
Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies
Suggested answer: C
asked 18/09/2024
Gerrit Struik
58 questions

Question 109

Report Export Collapse

During the course of a corporate investigation, you find that an Employee is committing a crime.

Can the Employer file a criminal complaint with Police?

Yes, and all evidence can be turned over to the police
Yes, and all evidence can be turned over to the police
Yes, but only if you turn the evidence over to a federal law enforcement agency
Yes, but only if you turn the evidence over to a federal law enforcement agency
No, because the investigation was conducted without following standard police procedures
No, because the investigation was conducted without following standard police procedures
No, because the investigation was conducted without warrant
No, because the investigation was conducted without warrant
Suggested answer: A
asked 18/09/2024
Alejandro Meza
40 questions

Question 110

Report Export Collapse

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

Network Forensics
Network Forensics
Computer Forensics
Computer Forensics
Incident Response
Incident Response
Event Reaction
Event Reaction
Suggested answer: B
asked 18/09/2024
Marian Mateev
42 questions
Total 704 questions
Go to page: of 71
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?
Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?
This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?
An Investigator Is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on Interface outside What does %ASA-1-106021 denote?
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?