Computer Hacking Forensic Investigator (312-49) Free Practice Test

Question 1

How often must a company keep log files for them to be admissible in a court of law?

A. Monthly

B. All log files are admissible in court no matter their frequency

C. Weekly

D. Continuously

Correct Answer: D

Question 2

When should an MD5 hash check be performed when processing evidence?

A. Before the evidence examination has been completed

B. On an hourly basis during the evidence examination

C. Before and after evidence examination

D. After the evidence examination has been completed

Correct Answer: C

Question 3

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

A. All forms should be placed in the report file because they are now primary evidence in the case

B. The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file

C. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container

D. All forms should be placed in an approved secure container because they are now primary evidence in the case

Correct Answer: C

Question 4

You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company? IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?

A. Data Link

B. Session

C. Network

D. Transport

Correct Answer: C

Question 5

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

A. Copy files from the master disk to the slave disk on the secondary IDE controller

B. Fill the disk with zeros

C. Low-level format

D. Fill the disk with 4096 zeros

Correct Answer: B

Question 6

Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

A. Point-to-point

B. Complete event analysis

C. Thorough

D. End-to-end

Correct Answer: D

Question 7

What binary coding is used most often for e-mail purposes?

A. IMAP

B. MIME

C. SMTP

D. Uuencode

Correct Answer: B

Question 8

What type of attack sends SYN requests to a target system with spoofed IP addresses?

A. SYN flood

B. Cross site scripting

C. Land

D. Ping of death

Correct Answer: A

Question 9

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

A. Make a bit-stream disk-to-image file

B. Make a bit-stream disk-to-disk file

C. Create a sparse data copy of a folder or file

D. Create a compressed copy of the file with DoubleSpace

Correct Answer: C

Question 10

In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

A. Network Administrator

B. Director of Administration

C. Security Administrator

D. Director of Information Technology

Correct Answer: A

Welcome to TestSimulate

EC-COUNCIL Computer Hacking Forensic Investigator (312-49) Free Practice Test