DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

ECCouncil 312-49 Exam Sample Questions | SPOTO

SPOTO's latest exam dumps on the homepage, with a 100% pass rate! SPOTO delivers authentic Cisco CCNA, CCNP study materials, CCIE Lab solutions, PMP, CISA, CISM, AWS, and Palo Alto exam dumps. Our comprehensive study materials are meticulously aligned with the latest exam objectives. With a proven track record, we have enabled thousands of candidates worldwide to pass their IT certifications on their first attempt. Over the past 20+ years, SPOTO has successfully placed numerous IT professionals in Fortune 500 companies.
Take other online exams
Question #1
Which is a standard procedure to perform during all computer forensics investigations?
A. With the hard drive in the suspect PC, check the date and time in the system CMOSWith the hard drive in the suspect PC, check the date and time in the system? CMOS
B. With the hard drive in the suspect PC, check the date and time in the File Allocation Table
C. With the hard drive removed from the suspect PC, check the date and time in the system RAMWith the hard drive removed from the suspect PC, check the date and time in the system? RAM
D. With the hard drive removed from the suspect PC, check the date and time in the system CMOSWith the hard drive removed from the suspect PC, check the date and time in the system? CMOS
View answer
Correct Answer: D
Question #2
What is the smallest allocation unit of a hard disk?
A. Cluster
B. Spinning tracks
C. Disk platters
D. Slack space
View answer
Correct Answer: A
Question #3
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:
A. C:\windows\system32\config\SAM
B. C:\windows\system32\con\SAM
C. C:\windows\system32\Boot\SAM
D. C:\windows\system32\drivers\SAM
View answer
Correct Answer: A
Question #4
Item 2If you come across a sheepdip machine at your client site, what would you infer?
A. A sheepdip coordinates several honeypots
B. A sheepdip computer is another name for a honeypot
C. A sheepdip computer is used only for virus-checking
D. A sheepdip computer defers a denial of service attack
View answer
Correct Answer: C
Question #5
SIM is a removable component that contains essential information about the subscriber. It has both volatile and non-volatile memory. The file system of a SIM resides in _____________ memory.
A. Volatile
B. Non-volatile
View answer
Correct Answer: B
Question #6
Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.
A. True
B. False
View answer
Correct Answer: A
Question #7
Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software?
A. Operating System (OS) logs
B. Application logs
C. Security software logs
D. Audit logs
View answer
Correct Answer: C
Question #8
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.
A. The attacker has conducted a network sweep on port 111
B. The attacker has scanned and exploited the system using Buffer Overflow
C. The attacker has used a Trojan on port 32773
D. The attacker has installed a backdoor
View answer
Correct Answer: A
Question #9
Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?
A. It is difficult to deal with the webmail as there is no offline archive in most cases
B. Local archives do not have evidentiary value as the email client may alter the message data
C. Local archives should be stored together with the server storage archives in order to be admissible in a court of law
D. Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server
View answer
Correct Answer: A
Question #10
Damaged portions of a disk on which no read/Write operation can be performed is known as ______________.
A. Lost sector
B. Bad sector
C. Empty sector
D. Unused sector
View answer
Correct Answer: B
Question #11
The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?
A. INFO2 file
B. INFO1 file
C. LOGINFO2 file
D. LOGINFO1 file
View answer
Correct Answer: A
Question #12
Sectors in hard disks typically contain how many bytes?
A. 1024
B. 512
C. 256
D. 2048
View answer
Correct Answer: B
Question #13
Why would a company issue a dongle with the software they sell?
A. To provide source code protection
B. To provide copyright protection
C. To ensure that keyloggers cannot be used
D. To provide wireless functionality with the software
View answer
Correct Answer: B
Question #14
What advantage does the tool Evidor have over the built-in Windows search?
A. It can find bad sectors on the hard drive
B. It can search slack space
C. It can find files hidden within ADS
D. It can find deleted files even after they have been physically removed
View answer
Correct Answer: B
Question #15
It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?
A. quite a few
B. only one
C. by law, three
D. at least two
View answer
Correct Answer: B
Question #16
Email archiving is a systematic approach to save and protect the data contained in emails so that it can tie easily accessed at a later date.
A. True
B. False
View answer
Correct Answer: A
Question #17
What is the First Step required in preparing a computer for forensics investigation?
A. Do not turn the computer off or on, run any programs, or attempt to access data on a computer
B. Secure any relevant media
C. Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue
D. Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination
View answer
Correct Answer: A
Question #18
You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?
A. Web bug
B. CGI code
C. Trojan
D. Blind bug
View answer
Correct Answer: A
Question #19
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?
A. Errors-To header
B. Content-Transfer-Encoding header
C. Mime-Version header
D. Content-Type header
View answer
Correct Answer: A
Question #20
Which of the following commands shows you the NetBIOS name table each?
A. Option A
B. Option B
C. Option C
D. Option D
View answer
Correct Answer: A

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.