PracticeMaterial 312-49v10 Exam Questions | Real 312-49v10 Practice Dumps
Verified 312-49v10 Exam Dumps Q&As - Provide 312-49v10 with Correct Answers
NEW QUESTION # 285
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.
He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?
- A. Those connections are in closed/waiting mode
- B. Those connections are in listening mode
- C. Those connections are established
- D. Those connections are in timed out/waiting mode
Answer: B
NEW QUESTION # 286
Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID "WIN-ABCDE12345F." Which of the following log file will help Shane in tracking all the client connections and activities performed on the database server?
- A. WIN-ABCDE12345F.log
- B. WIN-ABCDE12345F.err
- C. WIN-ABCDE12345F-bin.n
- D. WIN-ABCDE12345F.pid
Answer: A
NEW QUESTION # 287
"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?
- A. Principle 4
- B. Principle 1
- C. Principle 2
- D. Principle 3
Answer: C
NEW QUESTION # 288
Simona has written a regular expression for the detection of web application-specific attack attempt that reads as /((\%3C)|<K(\%2F)|V)*[a-zO-9\%I*((\%3E)|>)/lx. Which of the following does the part (|\%3E)|>) look for?
- A. Closing angle bracket or its hex equivalent
- B. Forward slash for a closing tag or its hex equivalent
- C. Opening angle bracket or its hex equivalent
- D. Alphanumeric string or its hex equivalent
Answer: B
NEW QUESTION # 289
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
- A. Use intrusion forensic techniques to study memory resident infections
- B. Create a Separate partition of several hundred megabytes and place the swap file there
- C. Use VMware to be able to capture the data in memory and examine it
- D. Give the Operating System a minimal amount of memory, forcing it to use a swap file
Answer: B
NEW QUESTION # 290
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?
- A. Perform data acquisition without disturbing the state of the systems
- B. Switch off the systems and carry them to the laboratory
- C. Record the system state by taking photographs of physical system and the display
- D. Open the systems, remove the hard disk and secure it
Answer: C
NEW QUESTION # 291
You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy?
- A. Packet filtering firewall
- B. Circuit-level proxy firewall
- C. Stateful firewall
- D. Application-level proxy firewall
Answer: C
NEW QUESTION # 292
When investigating a potential e-mail crime, what is your first step in the investigation?
- A. Trace the IP address to its origin
- B. Determine whether a crime was actually committed
- C. Write a report
- D. Recover the evidence
Answer: A
NEW QUESTION # 293
Fill In the missing Master Boot Record component.
1. Master boot code
2. Partition table
3._______________
- A. Boot loader
- B. Volume boot record
- C. Signature word
- D. Disk signature
Answer: A
NEW QUESTION # 294
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.
- A. The Underscore Symbol
- B. A Blank Space
- C. A Capital X
- D. The lowercase Greek Letter Sigma (s)
Answer: D
NEW QUESTION # 295
Which of the following malware targets Android mobile devices and installs a backdoor that remotely installs applications from an attacker-controlled server?
- A. Unflod
- B. xHelper
- C. Felix
- D. XcodeGhost
Answer: B
NEW QUESTION # 296
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
- A. Every byte of the file(s) is given an MD5 hash to match against a master file
- B. Every byte of the file(s) is encrypted using three different methods
- C. Every byte of the file(s) is copied to three different hard drives
- D. Every byte of the file(s) is verified using 32-bit CRC
Answer: D
NEW QUESTION # 297
Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups?
- A. Superblock
- B. Inode bitmap block
- C. Data block
- D. Block bitmap block
Answer: A
NEW QUESTION # 298
When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?
- A. Microsoft Exchange server
- B. RIM Messaging center
- C. Blackberry desktop redirector
- D. Blackberry Enterprise server
Answer: A
NEW QUESTION # 299
Which of the following Registry components include offsets to other cells as well as the LastWrite time for the key?
- A. Value cell
- B. Key cell
- C. Value list cell
- D. Security descriptor cell
Answer: B
NEW QUESTION # 300
When obtaining a warrant, it is important to:
- A. particularlydescribe the place to be searched and particularly describe the items to be seized
- B. particularlydescribe the place to be searched and generally describe the items to be seized
- C. generallydescribe the place to be searched and particularly describe the items to be seized
- D. generallydescribe the place to be searched and generally describe the items to be seized
Answer: A
NEW QUESTION # 301
Buffer overflow vulnerability of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the_________. There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack.
- A. Adjacent memory locations
- B. Adjacent string locations
- C. Adjacent bit blocks
- D. Adjacent buffer locations
Answer: A
NEW QUESTION # 302
Sally accessed the computer system that holds trade secrets of the company where she Is employed. She knows she accessed It without authorization and all access (authorized and unauthorized) to this computer Is monitored.To cover her tracks. Sally deleted the log entries on this computer. What among the following best describes her action?
- A. Anti-forensics
- B. Network intrusion
- C. Brute-force attack
- D. Password sniffing
Answer: A
NEW QUESTION # 303
Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?
dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync
- A. Copy files from the master disk to the slave disk on the secondary IDE controller
- B. Fill the disk with 4096 zeros
- C. Low-level format
- D. Fill the disk with zeros
Answer: D
NEW QUESTION # 304
......
Get Top-Rated EC-COUNCIL 312-49v10 Exam Dumps Now: https://www.practicematerial.com/312-49v10-exam-materials.html
Pass Your 312-49v10 Dumps Free Latest EC-COUNCIL Practice Tests: https://drive.google.com/open?id=1nYUTdtiuEqoQ9Ah1Vi2bG-UAYlg7dblN
