312-49 by EC-COUNCIL Actual Free Exam Q&As

Question 1

To preserve digital evidence, an investigator should ____________

A. Make a single copy of each evidence item using an approved imaging tool B. Make two copies of each evidence item using a single imaging tool C. Make two copies of each evidence item using different imaging tools D. Only store the original evidence item

Discussion 0

Correct Answer: C Vote an answer

Question 2

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

A. Fill the disk with zeros B. Copy files from the master disk to the slave disk on the secondary IDE controller C. Fill the disk with 4096 zeros D. Low-level format

Discussion 0

Correct Answer: A Vote an answer

Question 3

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

A. Create a sparse data copy of a folder or file B. Make a bit-stream disk-to-image file C. Create a compressed copy of the file with DoubleSpace D. Make a bit-stream disk-to-disk file

Discussion 0

Correct Answer: A Vote an answer

Question 4

Why is it still possible to recover files that have been emptied from the Recycle Bin on a
Windows computer?

A. The data is moved to the Restore directory and is kept there indefinitely B. The data is still present until the original location of the file is used C. The data will reside in the L2 cache on a Windows computer until it is manually deleted D. It is not possible to recover data that has been emptied from the Recycle Bin

Discussion 0

Correct Answer: B Vote an answer

Question 5

What is the CIDR from the following screenshot?

A. /8/8/8 B. /32 /32 /32 C. /24/24/24 D. /16 /16 /16

Discussion 0

Correct Answer: A Vote an answer

Question 6

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

A. Lossful compression B. Lossless compression C. Time-loss compression D. Lossy compression

Discussion 0

Correct Answer: D Vote an answer

EC-COUNCIL Computer Hacking Forensic Investigator - 312-49 Exam Practice Test