ExamGecko
Login
Home / ECCouncil / 312-49v10 / List of questions
Ask Question

ECCouncil 312-49v10 Practice Test - Questions Answers, Page 12

Add to Whishlist

List of questions

Question 111

Report Export Collapse

What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?

mcopy
mcopy
image
image
MD5
MD5
dd
dd
Suggested answer: D
asked 18/09/2024
Bassem Louati
38 questions

Question 112

Report Export Collapse

To preserve digital evidence, an investigator should ____________________.

Make two copies of each evidence item using a single imaging tool
Make two copies of each evidence item using a single imaging tool
Make a single copy of each evidence item using an approved imaging tool
Make a single copy of each evidence item using an approved imaging tool
Make two copies of each evidence item using different imaging tools
Make two copies of each evidence item using different imaging tools
Only store the original evidence item
Only store the original evidence item
Suggested answer: C
asked 18/09/2024
Christian Galea
47 questions

Question 113

Report Export Collapse

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

The manufacturer of the system compromised
The manufacturer of the system compromised
The logic, formatting and elegance of the code used in the attack
The logic, formatting and elegance of the code used in the attack
The nature of the attack
The nature of the attack
The vulnerability exploited in the incident
The vulnerability exploited in the incident
Suggested answer: B
asked 18/09/2024
Thomas Lichtenberger
39 questions

Question 114

Report Export Collapse

Printing under a Windows Computer normally requires which one of the following files types to be created?

EME
EME
MEM
MEM
EMF
EMF
CME
CME
Suggested answer: C
asked 18/09/2024
Dimitri Alvarez Ruiz
51 questions

Question 115

Report Export Collapse

An Expert witness give an opinion if:

The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
To define the issues of the case for determination by the finder of fact
To define the issues of the case for determination by the finder of fact
To stimulate discussion between the consulting expert and the expert witness
To stimulate discussion between the consulting expert and the expert witness
To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
Suggested answer: A
asked 18/09/2024
krishamrock krishqmrock
46 questions

Question 116

Report Export Collapse

When using Windows acquisitions tools to acquire digital evidence, it is important to use a welltested hardware write-blocking device to:

Automate Collection from image files
Automate Collection from image files
Avoiding copying data from the boot partition
Avoiding copying data from the boot partition
Acquire data from host-protected area on a disk
Acquire data from host-protected area on a disk
Prevent Contamination to the evidence drive
Prevent Contamination to the evidence drive
Suggested answer: D
asked 18/09/2024
Welton Harris
55 questions

Question 117

Report Export Collapse

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

Globally unique ID
Globally unique ID
Microsoft Virtual Machine Identifier
Microsoft Virtual Machine Identifier
Personal Application Protocol
Personal Application Protocol
Individual ASCII string
Individual ASCII string
Suggested answer: A
asked 18/09/2024
annalise ramdin
43 questions

Question 118

Report Export Collapse

You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?

Throw the hard disk into the fire
Throw the hard disk into the fire
Run the powerful magnets over the hard disk
Run the powerful magnets over the hard disk
Format the hard disk multiple times using a low level disk utility
Format the hard disk multiple times using a low level disk utility
Overwrite the contents of the hard disk with Junk data
Overwrite the contents of the hard disk with Junk data
Suggested answer: A
asked 18/09/2024
David Gallegos
45 questions

Question 119

Report Export Collapse

You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

The X509 Address
The X509 Address
The SMTP reply Address
The SMTP reply Address
The E-mail Header
The E-mail Header
The Host Domain Name
The Host Domain Name
Suggested answer: C
asked 18/09/2024
Angelica Caldeo
45 questions

Question 120

Report Export Collapse

You are working as a Computer forensics investigator for a corporation on a computer abuse case.

You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:

Violate your contract
Violate your contract
Cause network congestion
Cause network congestion
Make you an agent of law enforcement
Make you an agent of law enforcement
Write information to the subject's hard drive
Write information to the subject's hard drive
Suggested answer: C
asked 18/09/2024
Felix Maroto Roman
54 questions
Total 704 questions
Go to page: of 71
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?
Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?
This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?
An Investigator Is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on Interface outside What does %ASA-1-106021 denote?
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?