[Nov-2023] The Best CHFI v10 Study Guide for the 312-49v10 Exam
312-49v10 certification guide Q&A from Training Expert ActualCollection
The CHFI-v10 exam covers a wide range of topics related to digital forensics including cybercrime laws, computer forensics, digital evidence, investigation methods, and more. Computer Hacking Forensic Investigator (CHFI-v10) certification requires candidates to have a solid understanding of various tools and techniques used in digital forensics. Professionals who hold this certification are equipped with the skills and knowledge necessary to investigate and analyze digital evidence in a wide range of scenarios.
NEW QUESTION # 321
How will you categorize a cybercrime that took place within a CSP's cloud environment?
- A. Cloud as an Object
- B. Cloud as an Audit
- C. Cloud as a Tool
- D. Cloud as a Subject
Answer: A
NEW QUESTION # 322
What will the following URL produce in an unpatched IIS Web Server?
http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\
- A. Insert a Trojan horse into the C: drive of the web server
- B. Directory listing of C: drive on the web server
- C. Directory listing of the C:\windows\system32 folder on the web server
- D. Execute a buffer flow in the C: drive of the web server
Answer: B
NEW QUESTION # 323
In which loT attack does the attacker use multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?
- A. Sybil attack
- B. Replay attack
- C. Blueborne attack
- D. Jamming attack
Answer: A
NEW QUESTION # 324
During a forensic investigation, a large number of files were collected. The investigator needs to evaluate ownership and accountability of those files. Therefore, he begins to Identify attributes such as "author name," "organization name." "network name," or any additional supporting data that is meant for the owner's Identification purpose. Which term describes these attributes?
- A. Data header
- B. Metabase
- C. Data index
- D. Metadata
Answer: D
NEW QUESTION # 325
Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\.
- A. All values in this subkey run when specific user logs on and then the values are deleted
- B. All the values in this subkey run when specific user logs on, as this setting is user-specific
- C. All the values in this key are executed at system start-up
- D. The string specified in the value run executes when user logs on
Answer: A
NEW QUESTION # 326
Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?
- A. End-to-end
- B. Thorough
- C. Complete event analysis
- D. Point-to-point
Answer: A
NEW QUESTION # 327
During an Investigation. Noel found a SIM card from the suspect's mobile. The ICCID on the card is
8944245252001451548.
What does the first four digits (89 and 44) In the ICCID represent?
- A. Industry identifier and country code
- B. TAC and industry identifier
- C. Issuer identifier number and TAC
- D. Country code and industry identifier
Answer: A
NEW QUESTION # 328
As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?
- A. The employees network usernames and passwords
- B. The IP address of the employees' computers
- C. Bank account numbers and the corresponding routing numbers
- D. The MAC address of the employees' computers
Answer: A
NEW QUESTION # 329
You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?
- A. locate:"logon page"
- B. intitle:"exchange server"
- C. outlook:"search"
- D. allinurl:"exchange/logon.asp"
Answer: D
NEW QUESTION # 330
Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?
- A. Partition Table
- B. Directory Table
- C. Master file Table (MFT)
- D. Rainbow Table
Answer: D
NEW QUESTION # 331
Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?
- A. 18 U.S.C. 1343 Fraud by wire, radio or television
- B. 18 U.S.C. 1362 Government communication systems
- C. 18 U.S.C. 1029 Possession of Access Devices
- D. 18 U.S.C. 1030 Fraud and related activity in connection with computers
- E. 18 U.S.C. 1832 Trade Secrets Act
- F. 18 U.S.C. 1831 Economic Espionage Act
- G. 18 U.S.C. 1361 Injury to Government Property
Answer: D
NEW QUESTION # 332
An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E" represent?
- A. Operating system of the system
- B. Name of the Database
- C. Name of SQL Server
- D. Network credentials of the database
Answer: B
NEW QUESTION # 333
Fred, a cybercrime Investigator for the FBI, finished storing a solid-state drive In a static resistant bag and filled out the chain of custody form. Two days later. John grabbed the solid-state drive and created a clone of It (with write blockers enabled) In order to Investigate the drive. He did not document the chain of custody though. When John was finished, he put the solid-state drive back in the static resistant and placed it back in the evidence locker. A day later, the court trial began and upon presenting the evidence and the supporting documents, the chief Justice outright rejected them. Which of the following statements strongly support the reason for rejecting the evidence?
- A. Write blockers were used while cloning the evidence
- B. John did not document the chain of custody
- C. John investigated the clone instead of the original evidence itself
- D. Block clones cannot be created with solid-state drives
Answer: B
NEW QUESTION # 334
Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet?
- A. Enable tunneling feature on the switch
- B. Poison the switch's MAC address table by flooding it with ACK bits
- C. Trick the switch into thinking it already has a session with Terri's computer
- D. Crash the switch with a DoS attack since switches cannot send ACK bits
Answer: C
NEW QUESTION # 335
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?
- A. Directory traversal
- B. Unvalidated input
- C. Security misconfiguration
- D. Parameter/form tampering
Answer: A
NEW QUESTION # 336
A(n) _____________________ is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.
- A. distributed attack
- B. central processing attack
- C. automated attack
- D. blackout attack
Answer: C
NEW QUESTION # 337
Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password?
- A. Rule-based attack
- B. Syllable attack
- C. Hybrid attack
- D. Brute force attack
Answer: A
NEW QUESTION # 338
Which network attack is described by the following statement?
"At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."
- A. Buffer Overflow
- B. Man-in-the-Middle Attack
- C. Sniffer Attack
- D. DDoS
Answer: D
NEW QUESTION # 339
Sectors in hard disks typically contain how many bytes?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
NEW QUESTION # 340
Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer's log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies' domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords. What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?
- A. Dictionary attack
- B. Syllable attack
- C. Hybrid attack
- D. Brute force attack
Answer: A
NEW QUESTION # 341
What is the investigator trying to view by issuing the command displayed in the following screenshot?
- A. List of services installed
- B. List of services closed recently
- C. List of services stopped
- D. List of services recently started
Answer: A
NEW QUESTION # 342
Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage information, and the size of the block groups?
- A. Inode bitmap block
- B. Block bitmap block
- C. Data block
- D. Superblock
Answer: D
NEW QUESTION # 343
You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?
- A. Only the local law enforcement should use the tool
- B. The total has not been reviewed and accepted by your peers
- C. You are not certified for using the tool
- D. The tool hasn't been tested by the International Standards Organization (ISO)
Answer: B
NEW QUESTION # 344
......
The CHFI-v10 certification is a valuable credential for professionals who work in the field of cybersecurity and digital forensics. It provides individuals with the knowledge and skills needed to conduct effective investigations and respond to cyber incidents. By earning this certification, professionals can demonstrate their expertise in the field and enhance their career prospects in the cybersecurity industry.
EC-COUNCIL 312-49v10 certification is highly valued by employers and can lead to higher salaries and better job opportunities. It is a globally recognized certification that demonstrates a candidate's expertise in computer forensics investigation and provides them with the skills and knowledge they need to excel in their field. If you are looking to enhance your cybersecurity skills and advance your career, the EC-COUNCIL 312-49v10 certification is an excellent choice.
The Best EC-COUNCIL 312-49v10 Study Guides and Dumps of 2023: https://quizguide.actualcollection.com/312-49v10-exam-questions.html