最新的CHFI認證 312-49v8考試題庫

問題1

Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion.

A. False

B. True

正確答案: B

問題2

Task list command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer.
Which of the following task list commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

A. tasklist/u

B. tasklist/v

C. tasklist/s

D. tasklist/p

正確答案: B

問題3

Raw data acquisition format creates ____________of a data set or suspect drive.

A. Segmented image files

B. Segmented files

C. Simple sequential flat files

D. Compressed image files

正確答案: C

問題4

Which of the following is not correct when documenting an electronic crime scene?

A. Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer

B. Write down the color of shirt and pant the suspect was wearing

C. Document related electronic components that are difficult to find

D. Document the physical scene, such as the position of the mouse and the location of components near the system

正確答案: B

問題5

What is static executable file analysis?

A. It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances

B. It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment

C. It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances

D. It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment

正確答案: C

問題6

Which wireless standard has bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz?

A. 802.11a

B. 802.11b

C. 802.11g

D. 802.11i

正確答案: A

問題7

A computer forensic report is a report which provides detailed information on the complete forensics investigation process.

A. False

B. True

正確答案: B

問題8

What is the goal of forensic science?

A. It is a disciple to deal with the legal processes

B. Mitigate the effects of the information security breach

C. Save the good will of the investigating organization

D. To determine the evidential value of the crime scene and related evidence

正確答案: D

問題9

When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.

A. Empty clusters

B. Bad clusters

C. Unused clusters

D. Lost clusters

正確答案: D

問題10

When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code

A. First 22

B. First 24

C. First 12

D. First 16

正確答案: D

問題11

Depending upon the Jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?

A. 18 USC 7029

B. 18 USC 7371

C. 18 USC 7030

D. 18 USC 7361

正確答案: C

問題12

Hard disk data addressing is a method of allotting addresses to each ___________of data on a hard disk

A. Logical block

B. Physical block

C. Operating system block

D. Hard disk block

正確答案: B

問題13

What is the first step that needs to be carried out to crack the password?

A. A word list is created using a dictionary generator program or dictionaries

B. The list of dictionary words is hashed or encrypted

C. If it matches, that password has been cracked and the password cracker displays the unencrypted version of the password

D. The hashed wordlist is compared against the target hashed password, generally one word at a time

正確答案: A

問題14

Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information?

A. MountedDevices key

B. UserAssist Key

C. RunMRU key

D. TypedURLs key

正確答案: C

問題15

Recovery of the deleted partition is the process by which the investigator evaluates and extracts the deleted partitions.

A. False

B. True

正確答案: B

最新的EC-COUNCIL Computer Hacking Forensic Investigator - 312-49v8免費考試真題

最新更新

站內鏈接

聯系我們