EC-COUNCIL 312-49 考試概覽:

認證廠商:	EC-Council
考試名稱:	電腦駭客鑑識調查師 (CHFI)
考試代碼:	312-49
及格分數:	60%–85% (依試卷版本而定)
考試費用:	650 美元 (官方建議參考價)
證照有效期限:	3 年 (需完成重新認證)
考試時間:	240 分鐘
相關認證:	EC-Council 認證事件處理師 (ECIH) EC-Council 認證鑑識分析師
支援語言:	English
考試形式:	單選題, 複選題
實際考試題數:	150
範例考題:	EC-COUNCIL 312-49 範例考題
考試方式:	可透過 EC-Council 考試平台或授權考試中心應考（提供線上監考或現場應考模式）。
必備條件:	無強制先修條件；若未參加官方培訓，建議具備 2 年以上資訊安全或數位鑑識領域工作經驗。
官方大綱網址:	https://www.eccouncil.org/train-certify/computer-hacking-forensic-investigator-chfi/

EC-COUNCIL 312-49 考試大綱：

主題	簡介
主題 1	Email and Social Media Forensics: Examines email protocols, header analysis, social media data investigation, artifacts from messaging platforms, and legal aspects of digital correspondence.
主題 2	Windows Forensics: This domain includes collecting and analyzing volatile and non-volatile data, registry analysis, event logs, user artifacts (LNK, jump lists), memory forensics, and Windows application artifacts.
主題 3	IoT Forensics: Studies forensic investigation of Internet of Things devices, embedded systems, networked sensors, smart home devices, and artifacts from IoT ecosystems.
主題 4	Computer Forensics in Today : Covers fundamentals of digital forensics, importance of forensics in incident response, cybercrimes & investigations, forensic readiness, roles of forensic investigators, and standards & best practices.
主題 5	Defeating Anti-Forensics Techniques: Covers anti-forensic methods such as data hiding, steganography, file wiping, encryption, metadata tampering, trail obfuscation, and countermeasures.
主題 6	Malware Forensics: Covers static & dynamic malware analysis, behavior and network behavior analysis, ransomware, code analysis, and linking malware to forensic evidence.
主題 7	Computer Forensic Investigation Process: Contains the phases of a forensic investigation: first response, investigation planning, evidence collection, analysis, reporting, and post-investigation actions.
主題 8	Linux and Mac Forensics: This domain examines forensic investigation in Unix Linux and macOS systems, volatile memory capture, file systems (e.g., ext, APFS), logs, and operating system-specific artifacts.
主題 9	Understanding Hard Disks and File Systems: Deals with disk structure, partitioning, file systems (NTFS, FAT, ext, HFS), boot process of different OS (Windows, Linux, macOS), and low-level file system behaviors.
主題 10	Data Acquisition and Duplication: This domain focuses on techniques for acquiring forensic images, live vs dead acquisition, order of volatility, forensic duplication, and ensuring the integrity of data.
主題 11	Network Forensics: Covers capturing and analyzing network traffic, event correlation, investigating intrusions, identifying indicators of compromise (IoCs), and wireless forensics.
主題 12	Mobile Forensics: Includes forensic acquisition and analysis of mobile devices (Android, iOS), file systems, app data, call logs, SMS, rooting jailbreaking, and mobile OS artifacts.
主題 13	Dark Web Forensics: Focuses on forensic strategies for the dark web: understanding Tor networks, analyzing dark web artifacts, tracing hidden transactions, and dark web investigation best practices.

參考：https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/

最新的 Certified Ethical Hacker 312-49 免費考試真題：

問題 #1

You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work through Firewalls? (Choose two.)

A. 163
B. 161
C. 162
D. 160

顯示解答討論 0

答案：B,C 🗳️

問題 #2

Amelia has got an email from a well-reputed company stating in the subject line that she has won a prize money, whereas the email body says that she has to pay a certain amount for being eligible for the contest.
Which of the following acts does the email breach?

A. HIPAA
B. CAN-SPAM Act
C. SOX
D. GLBA

顯示解答討論 0

答案：B 🗳️

問題 #3

What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?

A. A compressed file
B. A reserved file
C. A Data stream file
D. An encrypted file

顯示解答討論 0

答案：C 🗳️

問題 #4

Microsoft Outlook maintains email messages in a proprietary format in what type of file?

A. .doc
B. .email
C. .pst
D. .mail

顯示解答討論 0

答案：C 🗳️

問題 #5

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

A. sign a statement attesting that the evidence is the same as it was when it entered the lab
B. make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
C. make an MD5 hash of the evidence and compare it to the standard database developed by NIST
D. there is no reason to worry about this possible claim because state labs are certified

顯示解答討論 0

答案：B 🗳️

正在檢視第 1 頁（共 107 頁）。
正在檢視第 1-5 題（共 534 題）。