Eccouncil CODE: 312-49v8 Exam Name: Eccouncil Computer Hacking Forensic Investigator v8
http://www.testsexpert.com/312-49v8.html
Type
Microsoft
1
IBM
Demo
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
Question: 1 If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure? A. Keep the device powered on B. Turn off the device immediately C. Remove the battery immediately D. Remove any memory cards immediately
Answer: A
Question: 2 What hashing method is used to password protect Blackberry devices? A. AES B. RC5 C. MD5 D. SHA-1
Answer: D
Question: 3 You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case? A. The registry B. The swapfile C. The recycle bin D. The metadata
Microsoft
2
IBM
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
Answer: B
Question: 4 With regard to using an antivirus scanner during a computer forensics investigation, you should: A. Scan the suspect hard drive before beginning an investigation B. Never run a scan on your forensics workstation because it could change your system configuration Never run a scan on your forensics workstation because it could change your system? configuration C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation D. Scan your forensics workstation before beginning an investigation
Answer: D
Question: 5 What layer of the OSI model do TCP and UDP utilize? A. Data Link B. Network C. Transport D. Session
Answer: C
Question: 6 When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having? A. One B. Two C. Three D. Four
Microsoft
3
IBM
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
Answer: B
Question: 7 When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time? A. On the individual computer ARP cache On the individual computer? ARP cache B. In the Web Server log files C. In the DHCP Server log files D. There is no way to determine the specific IP address
Answer: C
Question: 8 What type of equipment would a forensics investigator store in a StrongHold bag? A. PDAPDA? B. Backup tapes C. Hard drives D. Wireless cards
Answer: D
Question: 9 When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk? A. Write-blocker B. Protocol analyzer C. Firewall D. Disk editor
Microsoft
4
IBM
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
Answer: A
Question: 10 If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use? A. Lossful compression B. Lossy compression C. Lossless compression D. Time-loss compression
Answer: B
Question: 11 When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote? A. The year the evidence was taken B. The sequence number for the parts of the same exhibit C. The initials of the forensics analyst D. The sequential number of the exhibits seized
Answer: D
Question: 12 You are working in the Security Department of a law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server fake email to the attorney that appears to come from his boss. What port do you send
Microsoft
5
IBM
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
the email to on the company SMTP server? A. 10 B. 25 C. 110 D. 135
Answer: B
Question: 13 The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term? A. Detection B. Hearsay C. Spoliation D. Discovery
Answer: D
Question: 14 An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing? A. Smurf B. Ping of death C. Fraggle D. Nmap scan
Answer: B
Microsoft
6
IBM
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec
Eccouncil CODE: 312-49v8 Exam Name: Eccouncil Computer Hacking Forensic Investigator v8
http://www.testsexpert.com/312-49v8.html Microsoft
Cisco
IBM
MCTS 70-337
CCNA 640-802 640-822 640-816 640-460
MBS 98-361 70-332
CCNP 642-832 642-813 642-825 642-845
000-G01 000-M44
MCAS 77-602
CCSP 642-627 642-637 642-647 642-545
000-444 000-910
MCSE 70-282
CCIE 350-001 350-018 350-029 350-060
COG-105 COG-185
MCSA 2003 70-461 70-620
DATA CENTER 642-972 642-973 642-974 642-975
70-336 70-462
MB3-861
77-601 77-604 70-281 70-284 70-680
70-463
MB3-862
77-605 70-285
70-291
Microsoft
7
IBM
IBM Lotus
000-M42 000-M60
000-M41 000-M62
IBM Mastery
000-M43 000-M45
Solutions Expert
000-640 000-913
IBM Cognos
COG-180 COG-200
IBM Specialist
000-005 000-032
000-015 000-042
HP
Other
AIS
70-323 9L0-063 9L0-010 9L0-517 HP2-E53 70-321 650-179 1Y0-A20 00M-646 MB2-876 646-206 9L0-314 MB6-884 220-701 650-196 3305 MB6-871 HP2-Z22 9L0-407 9A0-146 HP2-H23 000-184 1Z0-527 HP2-B91 000-781 M70-201 M70-101 7004 HP3-X11 HP3-X08
HP0-311
HP0-M28
HP0-A25
HP0-M30
APC
HP0-D11 HP0-S29
HP0-J37 HP0-P14
MASE HP0-J33 HP0-M48 HP0-M49 HP0-M50 ASE
HP0-066 HP0-781
HP0-082 HP0-782
CSE
HP0-090 HP0-277
HP0-276 HP0-760
HP Cisco Oracle Instant download after purchase
http://www.testsexpert.com/312-49v8.html
Symantec