最新的EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v11) - 312-49v11免費考試真題
問題1
James, a forensic investigator, is tasked with examining a suspect's computer system that is believed to have been used for illegal activities. During his investigation, he finds multiple files with unusual extensions and encrypted contents. One of the files, in particular, appears to be a password-protected ZIP file. As part of his investigation, James needs to extract and analyze the contents of this file to check if it contains any evidence of criminal activity. What should James do next?
正確答案: D
說明：（僅 VCESoft 成員可見）
問題2
During Dynamic Malware Analysis in a sandbox at a healthcare provider in Nashville, the sample shows no immediate network activity. After a controlled restart, the executable launches automatically at logon without user interaction. To capture the system changes responsible for this behavior across a reboot cycle, what area of system activity should investigators focus on monitoring?
正確答案: C
說明：（僅 VCESoft 成員可見）
問題3
Imagine you, as a forensic investigator, are assigned to investigate a cybercrime involving a Windows-based system. The system has experienced significant file loss due to the attack, and retrieving the missing files is essential for the investigation. To facilitate this, you choose an automated tool capable of restoring critical files that were lost during the incident, ensuring the integrity of the evidence.
Which tool would be the most suitable for this task?
Which tool would be the most suitable for this task?
正確答案: C
問題4
In a multifaceted cybersecurity operation, analysts deploy a suite of cutting-edge IDS tools like Juniper, Check Point, and Snort to meticulously scrutinize logs. These logs, brimming with intricate data on network events, serve as the cornerstone of the defense, enabling analysts to discern subtle anomalies amidst the deluge of information.
Amidst the labyrinth of cybersecurity defenses, which multifaceted function do intrusion detection systems (IDS) primarily undertake, alongside their role of monitoring and analyzing events?
Amidst the labyrinth of cybersecurity defenses, which multifaceted function do intrusion detection systems (IDS) primarily undertake, alongside their role of monitoring and analyzing events?
正確答案: C
說明：（僅 VCESoft 成員可見）
問題5
Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?
正確答案: C
問題6
Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.
正確答案: D
問題7
A company's network has been compromised by a malware attack that originated from a website seemingly offering a legitimate service. The user unknowingly visited the site, and after doing so, their system began exhibiting unusual behavior. The company discovered that the malware was executed as soon as the user visited the site, without any need for further interaction. Which technique is most likely responsible for this attack?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題8
A medium-sized company's IT department noticed a sudden surge in network traffic and peculiar DNS requests originating from their internal servers. Realizing it could be a malware attack, they recruited Lisa, a seasoned forensic investigator, to probe into the situation. Lisa decided to use a tool to analyze this unusual network behavior and particularly focus on monitoring DNS requests.
What tool should Lisa use for this?
What tool should Lisa use for this?
正確答案: C
說明：（僅 VCESoft 成員可見）
問題9
Nora, a forensic investigator, is examining the Windows Registry of a compromised system as part of her investigation into a potential insider threat. She wants to determine which folders were most recently accessed by the user. After reviewing the Registry, she discovers that a particular Registry key stores information about the folders the user recently accessed, including the folder names and their paths in the file system. Based on her findings, which of the following Registry keys contains this information?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題10
An investigator seized a notebook device installed with a Microsoft Windows OS. Which type of files would support an investigation of the data size and structure in the device?
正確答案: B
問題11
Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?
正確答案: C
問題12
A forensic investigator is examining a system that has experienced a failure during booting. The investigator discovers that the boot process was interrupted after the BIOS had initialized the system hardware. What is the next step in the boot process that would have occurred had it not failed?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題13
Detective Sarah, a skilled digital forensics investigator, begins probing a compromised computer system linked to a cybercrime ring. Prioritizing volatile data, she meticulously plans her evidence- collection strategy. Amidst the investigation, various data sources emerge, each holding potential clues to unraveling the illicit scheme.
Which data source should you prioritize for collection, considering the order of volatility outlined in the RFC 3227 guidelines?
Which data source should you prioritize for collection, considering the order of volatility outlined in the RFC 3227 guidelines?
正確答案: A
說明：（僅 VCESoft 成員可見）
