CHFIv9 312-49v9 Real Exam Questions and Answers FREE Updated on Oct 19, 2021
312-49v9 Ultimate Study Guide - Fast2test
NEW QUESTION 168
An expert witness is a witness, who by virtue of education, profession, or experience, is believed to have special knowledge of his/her subject beyond that of the average person, sufficient that others legally depend upon his/her opinion.
- A. True
- B. False
Answer: A
NEW QUESTION 169
Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader). In which stage of the booting process do the bootloaders become active?
- A. BootROM Stage
- B. BIOS Stage
- C. Kernel Stage
- D. Bootloader Stage
Answer: D
NEW QUESTION 170
While looking through the IIS log file of a web server, you find the following entries:
What is evident from this log file?
- A. SQL injection is possible
- B. Cross site scripting
- C. Hidden fields
- D. Web bugs
Answer: A
NEW QUESTION 171
When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel?
- A. So that the access points will work on different requencies
- B. Multiple access points can be set up on the same channel without any issues
- C. Avoid over-saturation of wireless signals
- D. Avoid cross talk
Answer: D
NEW QUESTION 172
This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.
- A. Disk Operating System (DOS)
- B. Master File Table (MFT)
- C. File Allocation Table (FAT)
- D. Master Boot Record (MBR)
Answer: C
Explanation:
A MBR is usually found on fixed disks, not floppy.
A MFT is part of NTFS, and NTFS is not used on floppy
DOS is an operating system, not a file structure database
NEW QUESTION 173
Raw data acquisition format creates _________ of a data set or suspect drive.
- A. Compressed image files
- B. Segmented image files
- C. Simple sequential flat files
- D. Segmented files
Answer: C
NEW QUESTION 174
During first responder procedure you should follow all laws while collecting the evidence, and contact a computer forensic examiner as soon as possible
- A. True
- B. False
Answer: A
NEW QUESTION 175
After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks.
What countermeasures could he take to prevent DDoS attacks?
- A. Enable direct broadcasts
- B. Disable BGP
- C. Enable BGP
- D. Disable direct broadcasts
Answer: D
NEW QUESTION 176
When you carve an image, recovering the image depends on which of the following skills?
- A. Recognizing the pattern of a corrupt file
- B. Recovering the image from the tape backup
- C. Recognizing the pattern of the header content
- D. Recovering the image from a tape backup
Answer: C
NEW QUESTION 177
Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet?
- A. Poison the switch's MAC address table by flooding it with ACK bits
- B. Trick the switch into thinking it already has a session with Terri's computer
- C. Crash the switch with a DoS attack since switches cannot send ACK bits
- D. Enable tunneling feature on the switch
Answer: B
NEW QUESTION 178
Before performing a logical or physical search of a drive in Encase, what must be added to the program?
- A. Keywords
- B. File signatures
- C. Hash sets
- D. Bookmarks
Answer: A
NEW QUESTION 179
A computer forensic report is a report which provides detailed information on the complete forensics investigation process.
- A. True
- B. False
Answer: A
NEW QUESTION 180
Which of the following filesystem is used by Mac OS X?
- A. EXT2
- B. HFS+
- C. NFS
- D. EFS
Answer: B
Explanation:
EFS (Encrypting File System) is part of NTFS and used on Windows
EXT2 is used on Linux
NFS (Network File System) is for access to a network file system over TCP/IP
NEW QUESTION 181
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?
- A. Association of Computer Forensics Software Manufactures (ACFSM)
- B. Computer Forensics Tools and Validation Committee (CFTVC)
- C. National Institute of Standards and Technology (NIST)
- D. Society for Valid Forensics Tools and Testing (SVFTT)
Answer: C
NEW QUESTION 182
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?
- A. He should search in C:\Windows\System32\RECYCLED folder
- B. The Recycle Bin does not exist on the hard drive
- C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
- D. Only FAT system contains RECYCLED folder and not NTFS
Answer: C
NEW QUESTION 183
Which list contains the most recent actions performed by a Windows User?
- A. Activity
- B. Windows Error Log
- C. Recents
- D. MRU
Answer: D
NEW QUESTION 184
Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately. Which organization coordinates computer crimes investigations throughout the United
States?
- A. Local or national office of the U.S. Secret Service
- B. CERT Coordination Center
- C. National Infrastructure Protection Center
- D. Internet Fraud Complaint Center
Answer: A
NEW QUESTION 185
Damaged portions of a disk on which no read/Write operation can be performed is known as ______________.
- A. Bad sector
- B. Empty sector
- C. Unused sector
- D. Lost sector
Answer: A
NEW QUESTION 186
Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform?
- A. ICMP ping sweep
- B. Smurf scan
- C. Tracert
- D. Ping trace
Answer: A
NEW QUESTION 187
Lance wants to place a honeypot on his network. Which of the following would be your recommendations?
- A. It doesn't matter as all replies are faked
- B. Use a system that has a dynamic addressing on the network
- C. Use it on a system in an external DMZ in front of the firewall
- D. Use a system that is not directly interacing with the router
Answer: A
NEW QUESTION 188
Analyze the hex representation of mysql-bin.000013 file in the screenshot below. Which of the following will be an inference from this analysis?
- A. A WordPress user has been created with the username anonymous_hacker
- B. An attacker with name anonymous_hacker has replaced a user bad_guy in the WordPress database
- C. A user with username bad_guy has logged into the WordPress web application
- D. A WordPress user has been created with the username bad_guy
Answer: D
NEW QUESTION 189
Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?
- A. Intruding into a honeypot is not illegal
- B. Intruding into a DMZ is not illegal
- C. Entrapment
- D. Enticement
Answer: C
NEW QUESTION 190
Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.
The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?
- A. A system Using Trojaned commands
- B. A Honeypot that traps hackers
- C. An environment set up after the user logs in
- D. An environment set up before a user logs in
Answer: B
NEW QUESTION 191
You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?
- A. The swapfile
- B. The recycle bin
- C. The metadata
- D. The registry
Answer: A
NEW QUESTION 192
......
Ultimate Guide to Prepare 312-49v9 Certification Exam for CHFIv9: https://www.fast2test.com/312-49v9-premium-file.html