Eccouncil 312-49v10 practice test

Question 1

Which tool allows dumping the contents of process memory without stopping the process?
A. psdump.exe
B. pmdump.exe
C. processdump.exe
D. pdump.exe

Question 2

Which of the following files store the MySQL database data permanently, including the data that had
been deleted, helping the forensic investigator in examining the case and finding the culprit?

• A. mysql-bin
• B. mysql-log
• C. iblog
• D. ibdata1

Question 3

MAC filtering is a security access control methodology, where a ___________ is assigned to each
network card to determine access to the network.

• A. 48-bit address
• B. 24-bit address
• C. 16-bit address
• D. 32-bit address

Question 4

Which Event Correlation approach assumes and predicts what an attacker can do next after the
attack by studying statistics and probability?

• A. Profile/Fingerprint-Based Approach
• B. Bayesian Correlation
• C. Time (Clock Time) or Role-Based Approach
• D. Automated Field Correlation

Question 5

Which of the following stand true for BIOS Parameter Block?

• A. The BIOS Partition Block describes the physical layout of a data storage volume
• B. The BIOS Partition Block is the first sector of a data storage device
• C. The length of BIOS Partition Block remains the same across all the file systems
• D. The BIOS Partition Block always refers to the 512-byte boot sector

Question 6

James is dealing with a case regarding a cybercrime that has taken place in Arizona, US

• A. First Amendment of the U.S. Constitution
• B. Fourth Amendment of the U.S. Constitution
• C. Third Amendment of the U.S. Constitution
• D. Fifth Amendment of the U.S. Constitution

Question 7

You are asked to build a forensic lab and your manager has specifically informed you to use copper
for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor
with copper?

• A. To control the room temperature
• B. To strengthen the walls, ceilings, and floor
• C. To avoid electromagnetic emanations
• D. To make the lab sound proof

Question 8

What document does the screenshot represent?

• A. Expert witness form
• B. Search warrant form
• C. Chain of custody form
• D. Evidence collection form

Question 9

What does the Rule 101 of Federal Rules of Evidence states?

• A. Scope of the Rules, where they can be applied
• B. Purpose of the Rules
• C. Limited Admissibility of the Evidence
• D. Rulings on Evidence

Question 10

What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?
A. Jump instruction and the OEM ID
B. BIOS Parameter Block (BPB) and the OEM ID
C. BIOS Parameter Block (BPB) and the extended BPB
D. Bootstrap code and the end of the sector marker

Question 11

Which program uses different techniques to conceal a malware's code, thereby making it difficult for
security mechanisms to detect or remove it?

• A. Dropper
• B. Packer
• C. Injector
• D. Obfuscator

Question 12

Which of these rootkit detection techniques function by comparing a snapshot of the file system,
boot records, or memory with a known and trusted baseline?

• A. Signature-Based Detection
• B. Integrity-Based Detection
• C. Cross View-Based Detection
• D. Heuristic/Behavior-Based Detection

Question 13

Which forensic investigation methodology believes that criminals commit crimes solely to benefit
their criminal enterprises?

• A. Scientific Working Group on Digital Evidence
• B. Daubert Standard
• C. Enterprise Theory of Investigation
• D. Fyre Standard

Question 14

Which of the following Linux command searches through the current processes and lists the process
IDs those match the selection criteria to stdout?

• A. pstree
• B. pgrep
• C. ps
• D. grep

Question 15

Which of these ISO standards define the file system for optical storage media, such as CD-ROM and
DVD-ROM?

• A. ISO 9660
• B. ISO 13346
• C. ISO 9960
• D. ISO 13490