Eccouncil 312-49v10 practice test

Computer Hacking Forensic Investigator (CHFI-v10) Exam

Last exam update: Apr 12 ,2024
Page 1 out of 41. Viewing questions 1-15 out of 601

Question 1

Which tool allows dumping the contents of process memory without stopping the process?
A. psdump.exe
B. pmdump.exe
C. processdump.exe
D. pdump.exe

Answer:

B

Discussions
0 / 1000

Question 2

Which of the following files store the MySQL database data permanently, including the data that had
been deleted, helping the forensic investigator in examining the case and finding the culprit?

  • A. mysql-bin
  • B. mysql-log
  • C. iblog
  • D. ibdata1
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

MAC filtering is a security access control methodology, where a ___________ is assigned to each
network card to determine access to the network.

  • A. 48-bit address
  • B. 24-bit address
  • C. 16-bit address
  • D. 32-bit address
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

Which Event Correlation approach assumes and predicts what an attacker can do next after the
attack by studying statistics and probability?

  • A. Profile/Fingerprint-Based Approach
  • B. Bayesian Correlation
  • C. Time (Clock Time) or Role-Based Approach
  • D. Automated Field Correlation
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

Which of the following stand true for BIOS Parameter Block?

  • A. The BIOS Partition Block describes the physical layout of a data storage volume
  • B. The BIOS Partition Block is the first sector of a data storage device
  • C. The length of BIOS Partition Block remains the same across all the file systems
  • D. The BIOS Partition Block always refers to the 512-byte boot sector
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

James is dealing with a case regarding a cybercrime that has taken place in Arizona, US

  • A. First Amendment of the U.S. Constitution
  • B. Fourth Amendment of the U.S. Constitution
  • C. Third Amendment of the U.S. Constitution
  • D. Fifth Amendment of the U.S. Constitution
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

You are asked to build a forensic lab and your manager has specifically informed you to use copper
for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor
with copper?

  • A. To control the room temperature
  • B. To strengthen the walls, ceilings, and floor
  • C. To avoid electromagnetic emanations
  • D. To make the lab sound proof
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

What document does the screenshot represent?

  • A. Expert witness form
  • B. Search warrant form
  • C. Chain of custody form
  • D. Evidence collection form
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

What does the Rule 101 of Federal Rules of Evidence states?

  • A. Scope of the Rules, where they can be applied
  • B. Purpose of the Rules
  • C. Limited Admissibility of the Evidence
  • D. Rulings on Evidence
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?
A. Jump instruction and the OEM ID
B. BIOS Parameter Block (BPB) and the OEM ID
C. BIOS Parameter Block (BPB) and the extended BPB
D. Bootstrap code and the end of the sector marker

Answer:

C

Discussions
0 / 1000

Question 11

Which program uses different techniques to conceal a malware's code, thereby making it difficult for
security mechanisms to detect or remove it?

  • A. Dropper
  • B. Packer
  • C. Injector
  • D. Obfuscator
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

Which of these rootkit detection techniques function by comparing a snapshot of the file system,
boot records, or memory with a known and trusted baseline?

  • A. Signature-Based Detection
  • B. Integrity-Based Detection
  • C. Cross View-Based Detection
  • D. Heuristic/Behavior-Based Detection
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

Which forensic investigation methodology believes that criminals commit crimes solely to benefit
their criminal enterprises?

  • A. Scientific Working Group on Digital Evidence
  • B. Daubert Standard
  • C. Enterprise Theory of Investigation
  • D. Fyre Standard
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

Which of the following Linux command searches through the current processes and lists the process
IDs those match the selection criteria to stdout?

  • A. pstree
  • B. pgrep
  • C. ps
  • D. grep
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

Which of these ISO standards define the file system for optical storage media, such as CD-ROM and
DVD-ROM?

  • A. ISO 9660
  • B. ISO 13346
  • C. ISO 9960
  • D. ISO 13490
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2