Verified 312-49v11 dumps Q&As - Pass Guarantee Exam Dumps Test Engine [2025]
312-49v11 dumps and 1006 unique questions
NEW QUESTION # 66
Gary, a computer technician, is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation does this case require?
- A. Both Criminal and Administrative Investigation
- B. Criminal Investigation
- C. Administrative Investigation
- D. Civil Investigation
Answer: B
NEW QUESTION # 67
A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?
- A. HD-DVD
- B. DVD-18
- C. Blu-Ray single-layer
- D. Blu-Ray dual-layer
Answer: D
NEW QUESTION # 68
The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used.
Which command displays the network configuration of the NICs on the system?
- A. net session
- B. tasklist
- C. ipconfig /all
- D. netstat
Answer: C
NEW QUESTION # 69
A cybersecurity forensics investigator is tasked with acquiring data from a suspect's drive for a civil litigation case. The suspect drive is 1TB, and due to time constraints, the investigator decides to prioritize and acquire only data of evidentiary value. The original drive cannot be retained. In this context, which of the following steps should the investigator prioritize?
- A. Opt for disk-to-image copying for the large suspect drive
- B. Utilize DriveSpace or DoubleSpace to reduce the data size
- C. Execute logical acquisition considering the one-time opportunity to capture data
- D. Use a reliable data acquisition tool to make a copy of the original drive
Answer: D
NEW QUESTION # 70
Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization's DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry keys will Smith check to find the above information?
- A. TypedURLs key
- B. UserAssist Key
- C. RunMRU key
- D. MountedDevices key
Answer: C
NEW QUESTION # 71
An investigator is conducting a forensic analysis on a Windows machine suspected of accessing the Dark Web. The investigator has found Tor browser artifacts, but the Tor browser has been uninstalled. Which of the following steps should the investigator take next to obtain more information on the user's activities?
- A. Look for the 'State' file in the \Tor Browser\Browser\TorBrowser\Data\Tor\ directory
- B. Check the prefetch files using a tool such as WinPrefetchView
- C. Examine the registry key: HKEY_USERS\\SOFTWARE\Mozilla\Firefox\Launcher for path information
- D. Use the netstat -ano command to check the active network connections
Answer: B
NEW QUESTION # 72
Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?
- A. Intruding into a DMZ is not illegal
- B. Entrapment
- C. Intruding into ahoneypot is not illegal
- D. Enticement
Answer: B
NEW QUESTION # 73
Which rule requires an original recording to be provided to prove the content of a recording?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION # 74
WPA2 provides enterprise and Wi-Fi users with stronger data protection and network access control which of the following encryption algorithm is used DVWPA2?
- A. AES-TKIP
- B. RC4-CCMP
- C. AES-CCMP
- D. RC4-TKIP
Answer: C
NEW QUESTION # 75
Which of the following files contains the traces of the applications installed, run, or uninstalled from a system?
- A. Shortcut Files
- B. Image Files
- C. Virtual Files
- D. Prefetch Files
Answer: A
NEW QUESTION # 76
In forensics.______are used lo view stored or deleted data from both files and disk sectors.
- A. Hex editors
- B. SI EM tools
- C. Host interfaces
- D. Hash algorithms
Answer: A
NEW QUESTION # 77
A Computer Hacking Forensic Investigator (CHFI) is trying to identify a hidden data leak happening through seemingly benign PDF documents sent from a corporate network. While examining a suspicious PDF, he discovers a series of unexpected objects in the file's body. Given the following hex signatures of various file formats: JPEG (0xffd8), BMP (0x424d), GIF (0x474946), and PNG (0x89504e), which of the following actions should he take next?
- A. Examine the cross-reference table (xref table) for any unusual links to objects
- B. Search for the existence of the hex signature 0x89504e in the PDF's body as a PNC could be embedded
- C. Check for the existence of the hex signature 0xffd8 in the PDF's body as a JPEG could be hidden
- D. Verify if the PDF document ends with the %EOF value
Answer: C
NEW QUESTION # 78
Which network attack is described by the following statement?
"At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."
- A. Buffer Overflow
- B. DDoS
- C. Man-in-the-Middle Attack
- D. Sniffer Attack
Answer: B
NEW QUESTION # 79
The process of restarting a computer that is already turned on through the operating system is called?
- A. Cold boot
- B. Ice boot
- C. Hot Boot
- D. Warm boot
Answer: D
NEW QUESTION # 80
In the context of cybercrime investigations, when the crime perpetrator uses an anonymity tool like Tor Browser to perform illicit activities, the investigator encounters a significant challenge.
Considering the scenario, which of the following would best describe the difficulty faced by the investigator?
- A. The investigator is limited by the jurisdiction in which they can carry out their investigation
- B. The investigator cannot legally access the data without proper authorization and warrants
- C. The investigator struggles with the speed of accessing and interpreting data
- D. The investigator cannot reliably trace the source of the criminal activity
Answer: D
NEW QUESTION # 81
First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for collecting, preserving, and packaging electronic evidence?
- A. System administrators
- B. Lawyers
- C. Local managers or other non-forensic staff
- D. Forensic laboratory staff
Answer: D
NEW QUESTION # 82
As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing . What document describes the specifics of the testing, the associated violations, and essentially protects both the organization's interest and your liabilities as a tester?
- A. Project Scope
- B. Non-Disclosure Agreement
- C. Rules of Engagement
- D. Service Level Agreement
Answer: C
NEW QUESTION # 83
What does Locard's Exchange Principle state?
- A. Forensic investigators face many challenges during forensics investigation of a digital crime, such as extracting, preserving, and analyzing the digital evidence
- B. Any information of probative value that is either stored or transmitted in a digital form
- C. Digital evidence must have some characteristics to be disclosed in the court of law
- D. Anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave
Answer: D
NEW QUESTION # 84
Why would you need to find out the gateway of a device when investigating a wireless attack?
- A. The gateway will be the IP used to manage the RADIUS server
- B. The gateway will be the IP used to manage the access point
- C. The gateway will be the IP of the proxy server used by the attacker to launch the attack
- D. The gateway will be the IP of the attacker computer
Answer: B
NEW QUESTION # 85
You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network. How would you answer?
- A. LPT Methodology
- B. IBM Methodology
- C. Microsoft Methodology
- D. Google Methodology
Answer: A
NEW QUESTION # 86
Amber, a black hat hacker, has embedded malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?
- A. Malvertising
- B. Click-jacking
- C. Compromising a legitimate site
- D. Spearphishing
Answer: A
NEW QUESTION # 87
You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network.
Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing?
- A. Transmorphic
- B. Polymorphic
- C. Metamorphic
- D. Oligomorhic
Answer: C
NEW QUESTION # 88
......
312-49v11 Dumps for Pass Guaranteed - Pass 312-49v11 Exam: https://examcollection.realvce.com/312-49v11-original-questions.html