Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Computer Hacking Forensic Investigator (CHFI-v10)

Last Update 20 hours ago Total Questions : 704

The Computer Hacking Forensic Investigator (CHFI-v10) content is now fully updated, with all current exam questions added 20 hours ago. Deciding to include 312-49v10 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our 312-49v10 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these 312-49v10 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Computer Hacking Forensic Investigator (CHFI-v10) practice test comfortably within the allotted time.

Question # 136

If a suspect computer is located in an area that may have toxic chemicals, you must:

A.

coordinate with the HAZMAT team

B.

determine a way to obtain the suspect computer

C.

assume the suspect machine is contaminated

D.

do not enter alone

Question # 137

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?

A.

Any data not yet flushed to the system will be lost

B.

All running processes will be lost

C.

The /tmp directory will be flushed

D.

Power interruption will corrupt the pagefile

Question # 138

When examining a file with a Hex Editor, what space does the file header occupy?

A.

the last several bytes of the file

B.

the first several bytes of the file

C.

none, file headers are contained in the FAT

D.

one byte at the beginning of the file

Question # 139

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

A.

Speculation or opinion as to the cause of the incident

B.

Purpose of the report

C.

Author of the report

D.

Incident summary

Question # 140

Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?

A.

ParentIDPrefix

B.

LastWrite

C.

UserAssist key

D.

MRUListEx key

Question # 141

Which Federal Rule of Evidence speaks about the Hearsay exception where the availability of the declarant Is immaterial and certain characteristics of the declarant such as present sense Impression, excited utterance, and recorded recollection are also observed while giving their testimony?

A.

Rule 801

B.

Rule 802

C.

Rule 804

D.

Rule 803

Question # 142

A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evldence1.doc. sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin. what will happen to the data?

A.

The data will remain in its original clusters until it is overwritten

B.

The data will be moved to new clusters in unallocated space

C.

The data will become corrupted, making it unrecoverable

D.

The data will be overwritten with zeroes

Question # 143

Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee In order to hide their nefarious actions. What tool should Mark use to restore the data?

A.

EFSDump

B.

Diskmon D

C.

iskvlew

D.

R-Studio

Question # 144

You are an information security analyst at a large pharmaceutical company. While performing a routine review of audit logs, you have noticed a significant amount of egress traffic to various IP addresses on destination port 22 during off-peak hours. You researched some of the IP addresses and found that many of them are in Eastern Europe. What is the most likely cause of this traffic?

A.

Malicious software on internal system is downloading research data from partner 5FTP servers in Eastern Europe

B.

Internal systems are downloading automatic Windows updates

C.

Data is being exfiltrated by an advanced persistent threat (APT)

D.

The organization ' s primary internal DNS server has been compromised and is performing DNS zone transfers to malicious external entities

Question # 145

Ronald, a forensic investigator, has been hired by a financial services organization to Investigate an attack on their MySQL database server, which Is hosted on a Windows machine named WIN-DTRAI83202X. Ronald wants to retrieve information on the changes that have been made to the database. Which of the following files should Ronald examine for this task?

A.

relay-log.info

B.

WIN-DTRAl83202Xrelay-bin.index

C.

WIN-DTRAI83202Xslow.log

D.

WIN-DTRAI83202X-bin.nnnnnn

Question # 146

SO/IEC 17025 is an accreditation for which of the following:

A.

CHFI issuing agency

B.

Encryption

C.

Forensics lab licensing

D.

Chain of custody

Question # 147

Which of the following is a database in which information about every file and directory on an NT File System (NTFS) volume is stored?

A.

Volume Boot Record

B.

Master Boot Record

C.

GUID Partition Table

D.

Master File Table

Question # 148

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

A.

Fraggle

B.

Smurf scan

C.

SYN flood

D.

Teardrop

Question # 149

Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. he wants to recover all those data, which includes his personal photos, music, documents, videos, official email, etc. Which of the following tools shall resolve Bob’s purpose?

A.

Colasoft’s Capsa

B.

Recuva

C.

Cain & Abel

D.

Xplico

Question # 150

Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?

A.

C: $Recycled.Bin

B.

C: \$Recycle.Bin

C.

C:\RECYCLER

D.

C:\$RECYCLER

Go to page: