ExamGecko
Login
Home / ECCouncil / 312-49v10 / List of questions
Ask Question

ECCouncil 312-49v10 Practice Test - Questions Answers, Page 9

List of questions

Question 81

Report Export Collapse

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Network Forensics
Network Forensics
Data Recovery
Data Recovery
Disaster Recovery
Disaster Recovery
Computer Forensics
Computer Forensics
Suggested answer: D
asked 18/09/2024
Pang Guo Ming
35 questions

Question 82

Report Export Collapse

When you carve an image, recovering the image depends on which of the following skills?

Recognizing the pattern of the header content
Recognizing the pattern of the header content
Recovering the image from a tape backup
Recovering the image from a tape backup
Recognizing the pattern of a corrupt file
Recognizing the pattern of a corrupt file
Recovering the image from the tape backup
Recovering the image from the tape backup
Suggested answer: A
asked 18/09/2024
Junaid Sahebzada
39 questions

Question 83

Report Export Collapse

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

A Capital X
A Capital X
A Blank Space
A Blank Space
The Underscore Symbol
The Underscore Symbol
The lowercase Greek Letter Sigma (s)
The lowercase Greek Letter Sigma (s)
Suggested answer: D
asked 18/09/2024
Robert L Swafford
43 questions

Question 84

Report Export Collapse

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

Keep the information of file for later review
Keep the information of file for later review
Destroy the evidence
Destroy the evidence
Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
Present the evidence to the defense attorney
Present the evidence to the defense attorney
Suggested answer: C
asked 18/09/2024
Tiffany Peterson
44 questions

Question 85

Report Export Collapse

In Microsoft file structures, sectors are grouped together to form:

Clusters
Clusters
Drives
Drives
Bitstreams
Bitstreams
Partitions
Partitions
Suggested answer: A
asked 18/09/2024
Haider Nassiry
48 questions

Question 86

Report Export Collapse

What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?

A compressed file
A compressed file
A Data stream file
A Data stream file
An encrypted file
An encrypted file
A reserved file
A reserved file
Suggested answer: B
asked 18/09/2024
Robert Rek
49 questions

Question 87

Report Export Collapse

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
The EFS Revoked Key Agent can be used on the Computer to recover the information
The EFS Revoked Key Agent can be used on the Computer to recover the information
When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.
When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.
Suggested answer: B
asked 18/09/2024
Aamer Shahzad
34 questions

Question 88

Report Export Collapse

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

Recycle Bin
Recycle Bin
MSDOS.sys
MSDOS.sys
BIOS
BIOS
Case files
Case files
Suggested answer: A
asked 18/09/2024
Khalfan KAABI
42 questions

Question 89

Report Export Collapse

You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you can use to obtain the password?

Limited force and library attack
Limited force and library attack
Brute Force and dictionary Attack
Brute Force and dictionary Attack
Maximum force and thesaurus Attack
Maximum force and thesaurus Attack
Minimum force and appendix Attack
Minimum force and appendix Attack
Suggested answer: B
asked 18/09/2024
Ali Alaqoul
45 questions

Question 90

Report Export Collapse

When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.

What is the actual error code that you would see in the log for resource not found?

202
202
404
404
505
505
909
909
Suggested answer: B
asked 18/09/2024
Epitacio Neto
35 questions
Total 704 questions
Go to page: of 71
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?
Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads It to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Information that will allow to produce simple network signatures. What type of malware analysis was performed here?
This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?
An Investigator Is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on Interface outside What does %ASA-1-106021 denote?
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?