Pass EC-Council 312-49v10 Exam To Become A Computer Hacking Forensic Investigator

test2022-02-21T07:24:17+00:00

Want to pass the 312-49v10 exam and become a Computer Hacking Forensic Investigator? CHFI certification validate the candidate’s skills to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute in the court of law.The best tips to pass EC-Council 312-49v10 exam is to use 312-49v10 exam dumps. Freetestshare 312-49v10 dumps offer 100% real exam questions and answers that you’ll encounter on the real 312-49v10 exam.

Here we’ve prepared some real 312-49v10 exam questions. Have a try!

Page 1 of 16

1. How many possible sequence number combinations are there in TCP/IP protocol?

1 billion

320 billion

4 billion

32 million

2. Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop .

Which of the following email clients can he use to analyze the DBX files?

Microsoft Outlook

Eudora

Mozilla Thunderbird

Microsoft Outlook Express

3. An expert witness is a __________________ who is normally appointed by a party to

assist the formulation and preparation of a party’s claim or defense.

Expert in criminal investigation

Subject matter specialist

Witness present at the crime scene

Expert law graduate appointed by attorney

4. What is the purpose of using Obfuscator in malware?

Execute malicious code in the system

Avoid encryption while passing through a VPN

Avoid detection by security mechanisms

Propagate malware to other connected devices

5. What is a good security method to prevent unauthorized users from "tailgating"?

Man trap

Electronic combination locks

Pick-resistant locks

Electronic key systems

6. When a router receives an update for its routing table, what is the metric value change to that path?

Increased by 2

Decreased by 1

Increased by 1

Decreased by 2

7. Which of the following technique creates a replica of an evidence media?

Data Extraction

Backup

Bit Stream Imaging

Data Deduplication

8. Select the tool appropriate for examining the dynamically linked libraries of an application or malware.

DependencyWalker

SysAnalyzer

PEiD

ResourcesExtract

9. Which of the following is an iOS Jailbreaking tool?

Kingo Android ROOT

Towelroot

One Click Root

Redsn0w

10. You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test."

What is the result of this test?

Your website is vulnerable to CSS

Your website is not vulnerable

Your website is vulnerable to SQL injection

Your website is vulnerable to web bugs

Page 2 of 16

11. Brian needs to acquire data from RAID storage .

Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?

Static Acquisition

Sparse or Logical Acquisition

Bit-stream disk-to-disk Acquisition

Bit-by-bit Acquisition

12. Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless.

Under which US Amendment is Madison lawyer trying to prove the police violated?

The 10th Amendment

The 5th Amendment

The 1st Amendment

The 4th Amendment

13. What feature of Windows is the following command trying to utilize?

White space

AFS

ADS

Slack file

14. If you plan to startup a suspect's computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

deltree command

CMOS

Boot.sys

Scandisk utility

15. What does 254 represent in ICCID 89254021520014515744?

Industry Identifier Prefix

Country Code

Individual Account Identification Number

Issuer Identifier Number

16. An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

logical

anti-magnetic

magnetic

optical

17. Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server .

Why will Jonathan not succeed?

Only an HTTPS session can be hijacked

HTTP protocol does not maintain session

Only FTP traffic can be hijacked

Only DNS traffic can be hijacked

18. NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

FAT does not index files

NTFS is a journaling file system

NTFS has lower cluster size space

FAT is an older and inefficient file system

19. In a FAT32 system, a 123 KB file will use how many sectors?

20. 1.If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

The system files have been copied by a remote attacker

The system administrator has created an incremental backup

The system has been compromised using a t0rnrootkit

Nothing in particular as these can be operational files

Page 3 of 16

21. The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created .

Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?

File Allocation Table (FAT

New Technology File System (NTFS)

Hierarchical File System (HFS)

Global File System (GFS)

22. While collecting Active Transaction Logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file.

Here, assigning NULL values implies?

Start and end points for log sequence numbers are specified

Start and end points for log files are not specified

Start and end points for log files are specified

Start and end points for log sequence numbers are not specified

23. Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive .

Which of the following statements is correct while dealing with local archives?

Server storage archives are the server information and settings stored on a local system, whereas the local archives are the local email client information stored on the mail server

It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers

Local archives should be stored together with the server storage archives in order to be admissible in a court of law

Local archives do not have evidentiary value as the email client may alter the message data

24. Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device.

Where is TAC located in mobile devices?

International Mobile Equipment Identifier (IMEI)

Integrated circuit card identifier (ICCID)

International mobile subscriber identity (IMSI)

Equipment Identity Register (EIR)

25. Madison is on trial for allegedly breaking into her university’s internal network. The police raided her dorm room and seized all of her computer equipment. Madison’s lawyer is trying to convince the judge that the seizure was unfounded and baseless.

Under which US Amendment is Madison’s lawyer trying to prove the police violated?

The 4th Amendment

The 1st Amendment

The 10th Amendment

The 5th Amendment

26. In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

config.db

install.db

sigstore.db

filecache.db

27. What will the following command accomplish in Linux?

fdisk /dev/hda

Partition the hard drive

Format the hard drive

Delete all files under the /dev/hda folder

Fill the disk with zeros

28. Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

Cross Examination

Direct Examination

Indirect Examination

Witness Examination

29. What is the investigator trying to view by issuing the command displayed in the following screenshot?

List of services stopped

List of services closed recently

List of services recently started

List of services installed

30. Which Event Correlation approach assumes and predicts what an attacker can do next after the attack by studying statistics and probability?

Profile/Fingerprint-Based Approach

Bayesian Correlation

Time (Clock Time) or Role-Based Approach

Automated Field Correlation

Page 4 of 16

31. When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.

What is the actual error code that you would see in the log for resource not found?

202

404

505

909

32. Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

Signature-Based Detection

Integrity-Based Detection

Cross View-Based Detection

Heuristic/Behavior-Based Detection

33. Which of the following information is displayed when Netstat is used with -ano switch?

Ethernet statistics

Contents of IP routing table

Details of routing table

Details of TCP and UDP connections

34. A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size .

What type of removable media could the investigator use?

Blu-Ray single-layer

HD-DVD

Blu-Ray dual-layer

DVD-18

35. Why would a company issue a dongle with the software they sell?

To provide source code protection

To provide wireless functionality with the software

To provide copyright protection

To ensure that keyloggers cannot be used

36. Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1 .

What is the file type of the image?

gif

bmp

jpeg

png

37. Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?

OpenGL/ES and SGL

Surface Manager

Media framework

WebKit

38. Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."

Man-in-the-Middle Attack

Sniffer Attack

Buffer Overflow

DDoS

39. Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations.

In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

Hex Editor

Internet Evidence Finder

Process Monitor

Report Viewer

40. After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts respond to your ICMP pings; definitely not the number of hosts you were expecting .

Why did this ping sweep only produce a few responses?

Only IBM AS/400 will reply to this scan

Only Windows systems will reply to this scan

A switched network will not respond to packets sent to the broadcast address

Only Unix and Unix-like systems will reply to this scan

Page 5 of 16

41. Which of the following tools is not a data acquisition hardware tool?

UltraKit

Atola Insight Forensic

F-Response Imager

Triage-Responder

42. In which registry does the system store the Microsoft security IDs?

HKEY_CLASSES_ROOT (HKCR)

HKEY_CURRENT_CONFIG (HKCC)

HKEY_CURRENT_USER (HKCU)

HKEY_LOCAL_MACHINE (HKLM)

43. The given image displays information about date and time of installation of the OS along with service packs, patches, and sub-directories .

What command or tool did the investigator use to view this output?

dir /o:d

dir /o:s

dir /o:e

dir /o:n

44. Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG .

What is Simon trying to accomplish here?

Send DOS commands to crash the DNS servers

Perform DNS poisoning

Perform a zone transfer

Enumerate all the users in the domain

45. Richard is extracting volatile data from a system and uses the command doskey/history .

What is he trying to extract?

Events history

Previously typed commands

History of the browser

Passwords used across the system

46. What is the size value of a nibble?

0.5 kilo byte

0.5 bit

0.5 byte

2 bits

47. Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

wmic service

Reg.exe

fsutil

Devcon

48. Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material .

What type of steganography did these two suspects use?

Text semagram

Visual semagram

Grill cipher

Visual cipher

49. The surface of a hard disk consists of several concentric rings known as tracks; each of these tracks has smaller partitions called disk blocks .

What is the size of each block?

512 bits

512 bytes

256 bits

256 bytes

50. Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security.

Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort .

Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

Border Gateway Protocol

Cisco Discovery Protocol

Broadcast System Protocol

Simple Network Management Protocol

Page 6 of 16

51. What does the Rule 101 of Federal Rules of Evidence states?

Scope of the Rules, where they can be applied

Purpose of the Rules

Limited Admissibility of the Evidence

Rulings on Evidence

52. On Linux/Unix based Web servers, what privilege should the daemon service be run under?

Guest

Root

You cannot determine what privilege runs the daemon service

Something other than root

53. Rusty, a computer forensics apprentice, uses the command nbtstat Cc while analyzing the network information in a suspect system .

What information is he looking for?

Contents of the network routing table

Status of the network carrier

Contents of the NetBIOS name cache

Network connections

54. When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

Passive IDS

Active IDS

Progressive IDS

NIPS

55. For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

Bypassing iPhone passcode

Debugging iPhone

Rooting iPhone

Copying contents of iPhone

56. Who is responsible for the following tasks?

Non-forensics staff

Lawyers

System administrators

Local managers or other non-forensic staff

57. The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks .

Which of the following would that be?

Any data not yet flushed to the system will be lost

All running processes will be lost

The /tmp directory will be flushed

Power interruption will corrupt the pagefile

58. Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer.

Where should Harold navigate on the computer to find the file?

%systemroot%system32LSA

%systemroot%system32driversetc

%systemroot%repair

%systemroot%LSA

59. How many times can data be written to a DVD+R disk?

Twice

Once

Zero

Infinite

60. When you carve an image, recovering the image depends on which of the following skills?

Recognizing the pattern of the header content

Recovering the image from a tape backup

Recognizing the pattern of a corrupt file

Recovering the image from the tape backup

Page 7 of 16

61. Which ISO Standard enables laboratories to demonstrate that they comply with quality assurance and provide valid results?

ISO/IEC 16025

ISO/IEC 18025

ISO/IEC 19025

ISO/IEC 17025

62. Which of the following attack uses HTML tags like <script></script>?

Phishing

XSS attack

SQL injection

Spam

63. The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

Locard Exchange Principle

Clark Standard

Kelly Policy

Silver-Platter Doctrine

64. At what layer of the OSI model do routers function on?

65. Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused.

In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other .

What type of cipher was used by the accused in this case?

Grill cipher

Null cipher

Text semagram

Visual semagram

66. If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?

true

false

67. Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?

Core Services

Media services

Cocoa Touch

Core OS

68. Identify the term that refers to individuals who, by virtue of their knowledge and expertise, express an independent opinion on a matter related to a case based on the information that is provided.

Expert Witness

Evidence Examiner

Forensic Examiner

Defense Witness

69. During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence.

This type of evidence is known as:

Inculpatory evidence

Mandatory evidence

Exculpatory evidence

Terrible evidence

70. When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

The year the evidence was taken

The sequence number for the parts of the same exhibit

The initials of the forensics analyst

The sequential number of the exhibits seized

Page 8 of 16

71. Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated.

When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy?

IT personnel

Employees themselves

Supervisors

Administrative assistant in charge of writing policies

72. After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet .

Why is that?

Stateful firewalls do not work with packet filtering firewalls

NAT does not work with stateful firewalls

IPSEC does not work with packet filtering firewalls

NAT does not work with IPSEC

73. POP3 is an Internet protocol, which is used to retrieve emails from a mail server.

Through which port does an email client connect with a POP3 server?

110

143

993

74. Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. He wants to recover all the data, which includes his personal photos, music, documents, videos, official emails, etc .

Which of the following tools shall resolve Bob's purpose?

Cain & Abel

Recuva

Xplico

Colasoft’s Capsa

75. CAN-SPAM act requires that you:

Don’t use deceptive subject lines

Don’t tell the recipients where you are located

Don’t identify the message as an ad

Don’t use true header information

76. What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?

SD memory

CF memory

MMC memory

SM memory

77. Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process .

Which of the following hex codes should she look for to identify image files?

ff d8 ff

25 50 44 46

d0 0f 11 e0

50 41 03 04

78. Which response organization tracks hoaxes as well as viruses?

NIPC

FEDCIRC

CERT

CIAC

79. What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

digital attack

denial of service

physical attack

ARP redirect

80. What is the first step taken in an investigation for laboratory forensic staff members?

Packaging the electronic evidence

Securing and evaluating the electronic crime scene

Conducting preliminary interviews

Transporting the electronic evidence

Page 9 of 16

81. Which of the following is NOT a part of pre-investigation phase?

Building forensics workstation

Gathering information about the incident

Gathering evidence data

Creating an investigation team

82. The process of restarting a computer that is already turned on through the operating system is called?

Warm boot

Ice boot

Hot Boot

Cold boot

83. Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?

1029 Possession of Access Devices

1030 Fraud and related activity in connection with computers

1343 Fraud by wire, radio or television

1361 Injury to Government Property

1362 Government communication systems

1831 Economic Espionage Act

1832 Trade Secrets Act

84. Consider that you are investigating a machine running an Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:Recycler<USER SID>. You read an entry named "Dd5.exe" .

What does Dd5.exe mean?

D drive. fifth file deleted, a .exe file

D drive, fourth file restored, a .exe file

D drive, fourth file deleted, a .exe file

D drive, sixth file deleted, a .exe file

85. What operating system would respond to the following command?

Windows 95

FreeBSD

Windows XP

Mac OS X

86. Which of the following standard represents a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases?

SWGDE & SWGIT

Daubert

Frye

IOCE

87. E-mail logs contain which of the following information to help you in your investigation? (Choose four.)

user account that was used to send the account

attachments sent with the e-mail message

unique message identifier

contents of the e-mail message

date and time the message was sent

88. Jacky encrypts her documents using a password. It is known that she uses her daughter’s year of birth as part of the password .

Which password cracking technique would be optimal to crack her password?

Rule-based attack

Brute force attack

Syllable attack

Hybrid attack

89. UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?

BIOS-MBR

GUID Partition Table (GPT)

Master Boot Record (MBR)

BIOS Parameter Block

90. Why would you need to find out the gateway of a device when investigating a wireless attack?

The gateway will be the IP of the proxy server used by the attacker to launch the attack

The gateway will be the IP of the attacker computer

The gateway will be the IP used to manage the RADIUS server

The gateway will be the IP used to manage the access point

Page 10 of 16

91. You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case .

How would you permanently erase the data on the hard disk?

Throw the hard disk into the fire

Run the powerful magnets over the hard disk

Format the hard disk multiple times using a low level disk utility

Overwrite the contents of the hard disk with Junk data

92. In which cloud crime do attackers try to compromise the security of the cloud environment in order to steal data or inject a malware?

Cloud as an Object

Cloud as a Tool

Cloud as an Application

Cloud as a Subject

93. Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system.

Where should he look apart from the RAM and virtual memory?

Swap space

Application data

Files and documents

Slack space

94. In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

evidence must be handled in the same way regardless of the type of case

evidence procedures are not important unless you work for a law enforcement agency

evidence in a criminal case must be secured more tightly than in a civil case

evidence in a civil case must be secured more tightly than in a criminal case

95. Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.?

Dictionary attack

Brute force attack

Rule-based attack

Man in the middle attack

96. Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives.

One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

HKEY_LOCAL_MACHINEhardwarewindowsstart

HKEY_LOCAL_USERSSoftwareMicrosoftoldVersionLoad

HKEY_CURRENT_USERMicrosoftDefault

HKEY_LOCAL_MACHINESoftwareMicrosoftCurrentVersionRun

97. Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

Rule-Based Approach

Automated Field Correlation

Field-Based Approach

Graph-Based Approach

98. Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces .

What could have prevented this information from being stolen from the laptops?

EFS Encryption

DFS Encryption

IPS Encryption

SDW Encryption

99. To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https .

Which of the following firewall rules meets this requirement?

if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit

if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 80 or 443) then permit

if (source matches 10.10.10.0 and destination matches 10.20.20.1 and port matches 443) then permit

100. Which of the following commands shows you the username and IP address used to access the system via a remote login session and the type of client from which they are accessing the system?

Net config

Net sessions

Net share

Net stat

Page 11 of 16

101. Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures .

What technique did the accused criminal employ?

Typography

Steganalysis

Picture encoding

Steganography

102. The objective of this act was to protect consumers’ personal financial information held by financial institutions and their service providers.

Gramm-Leach-Bliley Act

Sarbanes-Oxley 2002

California SB 1386

HIPAA

103. You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation.

At what layer of the OSI model are you monitoring while watching traffic to and from the router?

Network

Transport

Data Link

Session

104. Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

Tokenmon

PSLoggedon

TCPView

Process Monitor

105. What value of the "Boot Record Signature" is used to indicate that the boot-loader exists?

AA55

00AA

AA00

A100

106. During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled.

Where could the investigator search to find the message tracking log file on the Exchange server?

C:Program FilesExchsrvrservername.log

D:ExchsrvrMessage Trackingservername.log

C:ExchsrvrMessage Trackingservername.log

C:Program FilesMicrosoft Exchangesrvrservername.log

107. Which of the following is NOT a physical evidence?

Removable media

Cables

Image file on a hard disk

Publications

108. Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table .

Which of the following is true for Data Rows?

Data Rows store the actual data

Data Rows present Page type. Page ID, and so on

Data Rows point to the location of actual data

Data Rows spreads data across multiple databases

109. What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?

Design patent

Trademark

Utility patent

110. How often must a company keep log files for them to be admissible in a court of law?

All log files are admissible in court no matter their frequency

Weekly

Monthly

Continuously

Page 12 of 16

111. In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down .

What will the other routers communicate between themselves?

The change in the routing fabric to bypass the affected router

More RESET packets to the affected router to get it to power back up

RESTART packets to the affected router to get it to power back up

STOP packets to all other routers warning of where the attack originated

112. Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups?

Inode bitmap block

Superblock

Block bitmap block

Data block

113. Which tool does the investigator use to extract artifacts left by Google Drive on the system?

PEBrowse Professional

RegScanner

RAM Capturer

Dependency Walker

114. Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites .

What is she doing?

Click-jacking

Compromising a legitimate site

Spearphishing

Malvertising

115. Annie is searching for certain deleted files on a system running Windows XP OS.

Where will she find the files if they were not completely deleted from the system?

C: $Recycled.Bin

C: $Recycle.Bin

C:RECYCLER

C:$RECYCLER

116. Which network attack is described by the following statement?

“At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries.”

DDoS

Sniffer Attack

Buffer Overflow

Man-in-the-Middle Attack

117. NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR) .

Which of the following is not a part of DDF?

Encrypted FEK

Checksum

EFS Certificate Hash

Container Name

118. How will you categorize a cybercrime that took place within a CSP’s cloud environment?

Cloud as a Subject

Cloud as a Tool

Cloud as an Audit

Cloud as an Object

119. Which of the following file system uses Master File Table (MFT) database to store information about every file and directory on a volume?

FAT File System

ReFS

exFAT

NTFS File System

120. Which of the following statements is incorrect when preserving digital evidence?

Verify if the monitor is in on, off, or in sleep mode

Turn on the computer and extract Windows event viewer log files

Remove the plug from the power router or modem

Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

Page 13 of 16

121. What does the acronym POST mean as it relates to a PC?

Primary Operations Short Test

PowerOn Self Test

Pre Operational Situation Test

Primary Operating System Test

122. Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?

RegistryChangesView

RegDIIView

RegRipper

ProDiscover

123. Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.

Physical block

Operating system block

Hard disk block

Logical block

124. Sectors are pie-shaped regions on a hard disk that store data .

Which of the following parts of a hard disk do not contribute in determining the addresses of data?

Sectors

Interface

Cylinder

Heads

125. The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

http://victim.com/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+C:Winntsystem32LogfilesW3SVC1

[Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test

127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700]"GET /apache_pb.gif HTTP/1.0" 200 2326

127.0.0.1 - - [10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0" 200 2326

126. Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

8-bit

32-bit

16-bit

24-bit

127. What is the CIDR from the following screenshot?

/24

/32

/16

128. Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?

MIME

BINHEX

UT-16

UUCODE

129. Ron, a computer forensics expert, is investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in ON condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner .

Which of the following key combinations can he use to recover the IMEI number?

#*06*#

*#06#

#06#*

*IMEI#

130. Which of the following tool enables a user to reset his/her lost admin password in a Windows system?

Advanced Office Password Recovery

Active@ Password Changer

Smartkey Password Recovery Bundle Standard

Passware Kit Forensic

Page 14 of 16

131. To check for POP3 traffic using Ethereal, what port should an investigator search by?

143

110

125

132. Which tool allows dumping the contents of process memory without stopping the process?

psdump.exe

pmdump.exe

processdump.exe

pdump.exe

133. When cataloging digital evidence, the primary goal is to

Make bit-stream images of all hard drives

Preserve evidence integrity

Not remove the evidence from the scene

Not allow the computer to be turned off

134. Which command line tool is used to determine active network connections?

netsh

nbstat

nslookup

netstat

135. In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

Chosen-message attack

Known-cover attack

Known-message attack

Known-stego attack

136. Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders were able to gain access into the company firewalls by overloading them with IP packets. Cylie then discovers through her investigation that the intruders hacked into the company phone system and used the hard drives on their PBX system to store shared music files .

What would this attack on the company PBX system be called?

Phreaking

Squatting

Crunching

Pretexting

137. What does the part of the log, “% SEC-6-IPACCESSLOGP”, extracted from a Cisco router represent?

The system was not able to process the packet because there was not enough room for all of the desired IP header options

Immediate action required messages

Some packet-matching logs were missed because the access list log messages were rate limited, or no access list log buffers were available

A packet matching the log criteria for the given access list has been detected (TCP or UDP)

138. An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack .

Which type of attack is this?

Cloud as a subject

Cloud as a tool

Cloud as an object

Cloud as a service

139. Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity.

After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

The manufacturer of the system compromised

The logic, formatting and elegance of the code used in the attack

The nature of the attack

The vulnerability exploited in the incident

140. Examination of a computer by a technically unauthorized person will almost always result in:

Rendering any evidence found inadmissible in a court of law

Completely accurate results of the examination

The chain of custody being fully maintained

Rendering any evidence found admissible in a court of law

Page 15 of 16

141. An investigator has acquired packed software and needed to analyze it for the presence of malice .

Which of the following tools can help in finding the packaging software used?

SysAnalyzer

PEiD

Comodo Programs Manager

Dependency Walker

142. Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud .

What is the term used for Jacob testimony in this case?

Justification

Authentication

Reiteration

Certification

143. The offset in a hexadecimal code is:

The last byte after the colon

The 0x at the beginning of the code

The 0x at the end of the code

The first byte after the colon

144. Which command can provide the investigators with details of all the loaded modules on a Linux-based system?

list modules -a

lsmod

plist mod -a

lsof -m

145. You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network .

How would you answer?

Microsoft Methodology

Google Methodology

IBM Methodology

LPT Methodology

146. What must an attorney do first before you are called to testify as an expert?

Qualify you as an expert witness

Read your curriculum vitae to the jury

Engage in damage control

Prove that the tools you used to conduct your examination are perfect

147. You are assisting in the investigation of a possible Web Server Hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a porno graphic web site. The company checked the web server and nothing appears wrong. When you type in the IP address of the web site in your browser everything appears normal .

What is the name of the attack that affects the DNS cache of the name resolution servers, resulting in those servers directing users to the wrong web site?

ARP Poisoning

DNS Poisoning

HTTP redirect attack

IP Spoofing

148. A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.

What can the investigator infer from the screenshot seen below?

A smurf attack has been attempted

A denial of service has been attempted

Network intrusion has occurred

Buffer overflow attempt on the firewall.

149. Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

Point-to-point

End-to-end

Thorough

Complete event analysis

150. Software firewalls work at which layer of the OSI model?

Application

Network

Transport

Data Link

Page 16 of 16

151. The efforts to obtain information before a trail by demanding documents, depositions, questioned and answers written under oath, written requests for admissions of fact and examination of the scene is a description of what legal term?

Detection

Hearsay

Spoliation

Discovery