Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Home
ECCouncil
CHFIv9
312-49v9
Computer Hacking Forensic Investigator (v9) Questions and Answers

Pass the ECCouncil CHFIv9 312-49v9 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 312-49v9 Premium Access

View all detail and faqs for the 312-49v9 exam

Go to Exam

519 Students Passed

96% Average Score

92% Same Questions

Viewing page 1 out of 12 pages

Viewing questions 1-15 out of questions

Questions # 1:

Select the data that a virtual memory would store in a Windows-based system.

Options:

Information or metadata of the files

Documents and other files

Application data

Running processes

Answer

Questions # 2:

Identify the term that refers to individuals who, by virtue of their knowledge and expertise, express an independent opinion on a matter related to a case based on the information that is provided.

Options:

Expert Witness

Evidence Examiner

Forensic Examiner

Defense Witness

Answer

Questions # 3:

Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

Options:

Signature-Based Detection

Integrity-Based Detection

Cross View-Based Detection

Heuristic/Behavior-Based Detection

Answer

Questions # 4:

POP3 is an Internet protocol, which is used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?

Options:

110

143

993

Answer

Questions # 5:

What does Locard's Exchange Principle state?

Options:

Any information of probative value that is either stored or transmitted in a digital form

Digital evidence must have some characteristics to be disclosed in the court of law

Anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave

Forensic investigators face many challenges during forensics investigation of a digital crime, such as extracting, preserving, and analyzing the digital evidence

Answer

Questions # 6:

Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.

Options:

Statement of personal or family history

Prior statement by witness

Statement against interest

Statement under belief of impending death

Answer

Questions # 7:

Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

Options:

DevScan

Devcon

fsutil

Reg.exe

Answer

Questions # 8:

Raw data acquisition format creates _________ of a data set or suspect drive.

Options:

Segmented image files

Simple sequential flat files

Compressed image files

Segmented files

Answer

Questions # 9:

During an investigation of an XSS attack, the investigator comes across the term “[a-zA-Z0-9\%]+” in analyzed evidence details. What is the expression used for?

Options:

Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation

Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent

Checks for opening angle bracket, its hex or double-encoded hex equivalent

Checks for closing angle bracket, hex or double-encoded hex equivalent

Answer

Questions # 10:

Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

Options:

Tokenmon

PSLoggedon

TCPView

Process Monitor

Answer

Questions # 11:

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

Options:

/auth

/proc

/var/log/debug

/var/spool/cron/

Answer

Questions # 12:

Buffer overflow vulnerabilities, of web applications, occurs when the application fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the _________. There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack.

Options:

Adjacent buffer locations

Adjacent string locations

Adjacent bit blocks

Adjacent memory locations

Answer

Questions # 13:

What is the location of a Protective MBR in a GPT disk layout?

Options:

Logical Block Address (LBA) 2

Logical Block Address (LBA) 0

Logical Block Address (LBA) 1

Logical Block Address (LBA) 3

Answer

Questions # 14:

What is cold boot (hard boot)?

Options:

It is the process of restarting a computer that is already in sleep mode

It is the process of shutting down a computer from a powered-on or on state

It is the process of restarting a computer that is already turned on through the operating system

It is the process of starting a computer from a powered-down or off state

Answer

Questions # 15:

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?