312-49v10 ECCouncil Computer Hacking Forensic Investigator (CHFI-v10) exact Exam Questions

Computer Hacking Forensic Investigator (CHFI-v10)

Last Update 20 hours ago Total Questions : 704

The Computer Hacking Forensic Investigator (CHFI-v10) content is now fully updated, with all current exam questions added 20 hours ago. Deciding to include 312-49v10 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our 312-49v10 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these 312-49v10 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Computer Hacking Forensic Investigator (CHFI-v10) practice test comfortably within the allotted time.

Question # 31

A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect’s available information but without any success. Which of the following tool can help the investigator to solve this issue?

Cain & Abel

Xplico

Recuva

Colasoft’s Capsa

Question # 32

Lynne receives the following email:

Dear lynne@gmail.com! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24

You have 24 hours to fix this problem or risk to be closed permanently!

To proceed Please Connect > > My Apple ID

Thank You The link to My Apple ID shows http://byggarbetsplatsen.se/backup/signon/

What type of attack is this?

Mail Bombing

Phishing

Email Spamming

Email Spoofing

Question # 33

Buffer overflow vulnerability of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the_________. There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack.

Adjacent memory locations

Adjacent bit blocks

Adjacent buffer locations

Adjacent string locations

Question # 34

In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims. What is the difference between pharming and phishing attacks?

Both pharming and phishing attacks are purely technical and are not considered forms of social engineering

In a pharming attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a phishing attack an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name

In a phishing attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a pharming attack an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name

Both pharming and phishing attacks are identical

Question # 35

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.

Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

All forms should be placed in an approved secure container because they are now primary evidence in the case.

The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container.

The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file.

All forms should be placed in the report file because they are now primary evidence in the case.

Question # 36

Why is it a good idea to perform a penetration test from the inside?

It is never a good idea to perform a penetration test from the inside

Because 70% of attacks are from inside the organization

To attack a network from a hacker ' s perspective

It is easier to hack from the inside

Question # 37

George is a senior security analyst working for a state agency in Florida. His state ' s congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a " time-based induction machine " be used.

What IDS feature must George implement to meet this requirement?

Signature-based anomaly detection

Pattern matching

Real-time anomaly detection

Statistical-based anomaly detection

Question # 38

After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

PRIV.STM

PUB.EDB

PRIV.EDB

PUB.STM

Question # 39

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

/auth

/proc

/var/log/debug

/var/spool/cron/

Question # 40

Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

Same-platform correlation

Network-platform correlation

Cross-platform correlation

Multiple-platform correlation