Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Computer Hacking Forensic Investigator (v9)

Last Update 13 hours ago Total Questions : 589

The Computer Hacking Forensic Investigator (v9) content is now fully updated, with all current exam questions added 13 hours ago. Deciding to include 312-49v9 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our 312-49v9 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these 312-49v9 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any Computer Hacking Forensic Investigator (v9) practice test comfortably within the allotted time.

Question # 151

What is the investigator trying to analyze if the system gives the following image as output?

A.

All the logon sessions

B.

Currently active logon sessions

C.

Inactive logon sessions

D.

Details of users who can logon

Question # 152

Which Linux command when executed displays kernel ring buffers or information about device drivers loaded into the kernel?

A.

pgrep

B.

dmesg

C.

fsck

D.

grep

Question # 153

To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?

A.

if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit

B.

if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 80 or 443) then permit

C.

if (source matches 10.10.10.0 and destination matches 10.20.20.1 and port matches 443) then permit

Question # 154

CAN-SPAM act requires that you:

A.

Don’t use deceptive subject lines

B.

Don’t tell the recipients where you are located

C.

Don’t identify the message as an ad

D.

Don’t use true header information

Question # 155

A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect’s available information but without any success. Which of the following tool can help the investigator to solve this issue?

A.

Cain & Abel

B.

Xplico

C.

Recuva

D.

Colasoft’s Capsa

Question # 156

Which of the following statements is incorrect when preserving digital evidence?

A.

Verify if the monitor is in on, off, or in sleep mode

B.

Turn on the computer and extract Windows event viewer log files

C.

Remove the plug from the power router or modem

D.

Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

Question # 157

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

A.

INFO2

B.

INFO1

C.

LOGINFO1

D.

LOGINFO2

Question # 158

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

A.

Lossful compression

B.

Lossy compression

C.

Lossless compression

D.

Time-loss compression

Question # 159

A section of your forensics lab houses several electrical and electronic equipment. Which type of fire extinguisher you must install in this area to contain any fire incident?

A.

Class B

B.

Class D

C.

Class C

D.

Class A

Question # 160

In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file

var/log/dmesg?

A.

Kernel ring buffer information

B.

All mail server message logs

C.

Global system messages

D.

Debugging log messages

Question # 161

Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

A.

Signature-Based Detection

B.

Integrity-Based Detection

C.

Cross View-Based Detection

D.

Heuristic/Behavior-Based Detection

Question # 162

What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

A.

Restore point interval

B.

Automatically created restore points

C.

System CheckPoints required for restoring

D.

Restore point functions

Question # 163

Select the tool appropriate for finding the dynamically linked lists of an application or malware.

A.

SysAnalyzer

B.

ResourcesExtract

C.

PEiD

D.

Dependency Walker

Question # 164

Which of the following Perl scripts will help an investigator to access the executable image of a process?

A.

Lspd.pl

B.

Lpsi.pl

C.

Lspm.pl

D.

Lspi.pl

Question # 165

Where should the investigator look for the Edge browser’s browsing records, including history, cache, and cookies?

A.

ESE Database

B.

Virtual Memory

C.

Sparse files

D.

Slack Space

Go to page: