312-49v10 by EC-COUNCIL Valid Free Exam Practice Test

Question 1

In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?

A. RAID 0 B. RAID 1 C. The images will always be identical because data is mirrored for redundancy D. It will always be different

Correct Answer: D

Question 2

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

A. The lowercase Greek Letter Sigma (s) B. The Underscore Symbol C. A Capital X D. A Blank Space

Correct Answer: A

Question 3

What TCP/UDP port does the toolkit program netstat use?

A. Port 7 B. Port 15 C. Port 23 D. Port 69

Correct Answer: B

Question 4

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

A. Dependency Walker B. RegScanner C. PEBrowse Professional D. RAM Capturer

Correct Answer: D

Question 5

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

A. Incident Response B. Network Forensics C. Event Reaction D. Computer Forensics

Correct Answer: D

Question 6

At what layer does a cross site scripting attack occur on?

A. Presentation B. Session C. Data Link D. Application

Correct Answer: D

Question 7

Which of the following commands shows you all of the network services running on Windows-based servers?

A. Net config B. Netstart C. Net Session D. Net use

Correct Answer: B

Question 8

Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses' testimony during federal legal proceedings?

A. IOCE B. SWGDE & SWGIT C. Frye D. Daubert

Correct Answer: D

Question 9

To preserve digital evidence, an investigator should ____________________.

A. Make two copies of each evidence item using a single imaging tool B. Make two copies of each evidence item using different imaging tools C. Make a single copy of each evidence item using an approved imaging tool D. Only store the original evidence item

Correct Answer: B

Question 10

What is the location of the binary files required for the functioning of the OS in a Linux system?

A. /root B. /sbin C. /bin D. /run

Correct Answer: C

Question 11

According to RFC 3227, which of the following is considered as the most volatile item on a typical system?

A. Archival media B. Temporary system files C. Registers and cache D. Kernel statistics and memory

Correct Answer: C

EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v10) - 312-49v10 Exam Practice Test