Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Computer Hacking Forensic Investigator

Last Update 1 day ago Total Questions : 531

The Computer Hacking Forensic Investigator content is now fully updated, with all current exam questions added 1 day ago. Deciding to include 312-49 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our 312-49 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these 312-49 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Computer Hacking Forensic Investigator practice test comfortably within the allotted time.

Question # 46

When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?

A.

File Size

B.

File origin and modification

C.

Time and date of deletion

D.

File Name

Question # 47

Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.

The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?

A.

A Honeypot that traps hackers

B.

A system Using Trojaned commands

C.

An environment set up after the user logs in

D.

An environment set up before a user logs in

Question # 48

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party’s claim or defense.

A.

Expert in criminal investigation

B.

Subject matter specialist

C.

Witness present at the crime scene

D.

Expert law graduate appointed by attorney

Question # 49

A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect’s available information but without any success. Which of the following tool can help the investigator to solve this issue?

A.

Cain & Abel

B.

Xplico

C.

Recuva

D.

Colasoft’s Capsa

Question # 50

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

A.

The system files have been copied by a remote attacker

B.

The system administrator has created an incremental backup

C.

The system has been compromised using a t0rnrootkit

D.

Nothing in particular as these can be operational files

Question # 51

What are the security risks of running a " repair " installation for Windows XP?

A.

Pressing Shift+F10gives the user administrative rights

B.

Pressing Shift+F1gives the user administrative rights

C.

Pressing Ctrl+F10 gives the user administrative rights

D.

There are no security risks when running the " repair " installation for Windows XP

Question # 52

Raw data acquisition format creates _________ of a data set or suspect drive.

A.

Segmented image files

B.

Simple sequential flat files

C.

Compressed image files

D.

Segmented files

Question # 53

Which of the following tool creates a bit-by-bit image of an evidence media?

A.

Recuva

B.

FileMerlin

C.

AccessData FTK Imager

D.

Xplico

Question # 54

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

A.

PEBrowse Professional

B.

RegScanner

C.

RAM Capturer

D.

Dependency Walker

Question # 55

Analyze the hex representation of mysql-bin.000013 file in the screenshot below. Which of the following will be an inference from this analysis?

A.

A user with username bad_guy has logged into the WordPress web application

B.

A WordPress user has been created with the username anonymous_hacker

C.

An attacker with name anonymous_hacker has replaced a user bad_guy in the WordPress database

D.

A WordPress user has been created with the username bad_guy

Question # 56

Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?

A.

Directory Table

B.

Rainbow Table

C.

Master file Table (MFT)

D.

Partition Table

Question # 57

What type of equipment would a forensics investigator store in a StrongHold bag?

A.

PDAPDA?

B.

Backup tapes

C.

Hard drives

D.

Wireless cards

Question # 58

The offset in a hexadecimal code is:

A.

The last byte after the colon

B.

The 0x at the beginning of the code

C.

The 0x at the end of the code

D.

The first byte after the colon

Question # 59

Which of the following is a list of recently used programs or opened files?

A.

Most Recently Used (MRU)

B.

Recently Used Programs (RUP)

C.

Master File Table (MFT)

D.

GUID Partition Table (GPT)

Question # 60

You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:

http://172.168.4.131/level/99/exec/show/config

After typing in this URL, you are presented with the entire configuration file for that router. What have you discovered?

A.

HTTP Configuration Arbitrary Administrative Access Vulnerability

B.

HTML Configuration Arbitrary Administrative Access Vulnerability

C.

Cisco IOS Arbitrary Administrative Access Online Vulnerability

D.

URL Obfuscation Arbitrary Administrative Access Vulnerability

Go to page: