NEWQUESTION: 1
 Which list contains the most recent actions performed by a Windows User?
 A. Recents
 B. Activity
 C. Windows Error Log
 D. MRU
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 2
 Which of the following Event Correlation Approach is an advanced correlation method that
 assumes and predicts what an attacker can do next after the attack by studying the statistics and
 probability and uses only two variables?
 A. Bayesian Correlation
 B. Rule-Based Approach
 C. Vulnerability-Based Approach
 D. Route Correlation
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 3
 Which of the following is a part of a Solid-State Drive (SSD)?
 A. Head
 B. Cylinder
 C. NAND-based flash memory
 D. Spindle
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 4
Which of the following tool enables data acquisition and duplication?
 A. Xplico
 B. Wireshark
 C. DriveSpy
 D. Colasoft's Capsa
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 5
 You are working as a Computer forensics investigator for a corporation on a computer abuse
 case. You discover evidence that shows the subject of your investigation is also embezzling
 money from the company. The company CEO and the corporate legal counsel advise you to
 contact law enforcement and provide them with the evidence that you have found. The law
 enforcement officer that responds requests that you put a network sniffer on your network and
 monitor all traffic to the subject's computer. You inform the officer that you will not be able to
 comply with that request because doing so would:
 A. Make you an agent of law enforcement
 B. Cause network congestion
 C. Violate your contract
 D. Write information to the subject's hard drive
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 6
 George is the network administrator of a large Internet company on the west coast. Per corporate
 policy, none of the employees in the company are allowed to use FTP or SFTP programs without
 obtaining approval from the IT department. Few managers are using SFTP program on their
 computers. Before talking to his boss, George wants to have some proof of their activity. George
 wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network.
 What filter should George use in Ethereal?
 A. src port 22 and dst port 22
 B. net port 22
 C. udp port 22 and host 172.16.28.1/24
 D. src port 23 and dst port 23
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 7
 When monitoring for both intrusion and security events between multiple computers, it is essential
 that the computers' clocks are synchronized. Synchronized time allows an administrator to
 reconstruct what took place during an attack against multiple computers. Without synchronized
 time, it is very difficult to determine exactly when specific events took place, and how events
 interlace. What is the name of the service used to synchronize time among multiple computers?
 A. Time-Sync Protocol
B. Universal Time Set
 C. Network Time Protocol
 D. SyncTime Service
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 8
 In conducting a computer abuse investigation you become aware that the suspect of the
 investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and
 request that they provide you assistance with your investigation. What assistance can the ISP
 provide?
 A. ISP's never maintain log files so they would be of no use to your investigation
 B. The ISP can't conduct any type of investigations on anyone and therefore can't assist you
 C. The ISP can investigate computer abuse committed by their employees, but must preserve the
 privacy of their customers and therefore cannot assist you without a warrant
 D. The ISP can investigate anyone using their service and can provide you with assistance
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 9
 A(n) _____________________ is one that's performed by a computer program rather than the
 attacker manually performing the steps in the attack sequence.
 A. blackout attack
 B. central processing attack
 C. distributed attack
 D. automated attack
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 10
 A. Trade secrets
 B. ISO 17799
 C. the attorney-work-product rule
 D. Good manners
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 11
 When a user deletes a file or folder, the system stores complete path including the original
 filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted,
 it is recovered when you ______________________.
 A. Download the file from Microsoft website
B. Undo the last action performed on the system
 C. Use a recovery tool to undelete the file
 D. Reboot Windows
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 12
 Which forensic investigating concept trails the whole incident from how the attack began to how
 the victim was affected?
 A. Thorough
 B. Complete event analysis
 C. End-to-end
 D. Point-to-point
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 13
 Which of the following ISO standard defines file systems and protocol for exchanging data
 between optical disks?
 A. ISO/IEC 13940
 B. ISO 9060
 C. IEC 3490
 D. ISO 9660
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 14
 Where are files temporarily written in Unix when printing?
 A. /usr/spool
 B. /spool
 C. /var/print
 D. /var/spool
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 15
 A picture file is recovered from a computer under investigation. During the investigation process,
 the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at
 all from this process. What kind of picture is this file. What kind of picture is this file?
 A. Raster image
 B. Metafile image
 C. Catalog image
 D. Vector image
 Answer: (
 SHOWANSWER)
NEWQUESTION: 16
 After passively scanning the network of Department of Defense (DoD), you switch over to active
 scanning to identify live hosts on their network. DoD is a large organization and should respond to
 any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast
 address. Only five hosts respond to your ICMP pings; definitely not the number of hosts you were
 expecting. Why did this ping sweep only produce a few responses?
 A. A switched network will not respond to packets sent to the broadcast address
 B. Only Unix and Unix-like systems will reply to this scan
 C. Only IBM AS/400 will reply to this scan
 D. Only Windows systems will reply to this scan
 Answer: (
 SHOWANSWER)
 Valid 312-49v10 Dumps shared by PassTestKing.com for Helping Passing 312-49v10 Exam!
 PassTestKing.com now offer the newest 312-49v10 exam dumps, the PassTestKing.com
 312-49v10 exam questions have been updated and answers have been corrected get the
 newest PassTestKing.com 312-49v10 dumps with Test Engine here:
 https://www.passtestking.com/EC-COUNCIL/312-49v10-practice-exam-dumps.html (706 Q&As
 Dumps, 35%OFF Special Discount Code: freecram)
 NEWQUESTION: 17
 Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant
 Unavailable.
 A. Statement of personal or family history
 B. Statement under belief of impending death
 C. Prior statement by witness
 D. Statement against interest
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 18
 What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source
 address to the IP broadcast address of a large network?
 A. SYN flood
 B. Fraggle
 C. Smurf scan
 D. Teardrop
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 19
 What is the smallest physical storage unit on a hard drive?
A. Platter
 B. Sector
 C. Cluster
 D. Track
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 20
 A. Media Framework
 B. Application Framework
 C. Resource Manager
 D. Surface Manager
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 21
 Consider that you are investigating a machine running an Windows OS released prior to Windows
 Vist a. You are trying to gather information about the deleted files by examining the master
 database file named INFO2 located at C:\Recycler\<USER SID>\. You read an entry named
 "Dd5.exe". What does Dd5.exe mean?
 A. D drive. fifth file deleted, a .exe file
 B. D drive, fourth file deleted, a .exe file
 C. D drive, fourth file restored, a .exe file
 D. D drive, sixth file deleted, a .exe file
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 22
 In the following email header, where did the email first originate from?
 A. Somedomain.com
 B. Simon1.state.ok.gov.us
 C. Smtp1.somedomain.com
 D. David1.state.ok.gov.us
 Answer: B (
 LEAVE AREPLY)
NEWQUESTION: 23
 If a PDA is seized in an investigation while the device is turned on, what would be the proper
 procedure?
 A. Remove the battery immediately
 B. Turn off the device immediately
 C. Remove any memory cards immediately
 D. Keep the device powered on
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 24
 In a virtual test environment, Michael is testing the strength and security of BGP using multiple
 routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis
 on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends
 millions of RESET packets to the routers in an attempt to shut one or all of them down. After a
 few hours, one of the routers finally shuts itself down. What will the other routers communicate
 between themselves?
 A. RESTART packets to the affected router to get it to power back up
 B. More RESET packets to the affected router to get it to power back up
 C. STOP packets to all other routers warning of where the attack originated
 D. The change in the routing fabric to bypass the affected router
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 25
 What will the following URL produce in an unpatched IIS Web Server?
 http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir
 +c:\
 A. Insert a Trojan horse into the C: drive of the web server
 B. Directory listing of C: drive on the web server
 C. Directory listing of the C:\windows\system32 folder on the web server
 D. Execute a buffer flow in the C: drive of the web server
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 26
 What does the part of the log, "% SEC-6-IPACCESSLOGP", extracted from a Cisco router
 represent?
 A. A packet matching the log criteria for the given access list has been detected (TCP or UDP)
 B. The system was not able to process the packet because there was not enough room for all of
 the desired IP header options
 C. Immediate action required messages
D. Some packet-matching logs were missed because the access list log messages were rate
 limited, or no access list log buffers were available
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 27
 Steven has been given the task of designing a computer forensics lab for the company he works
 for. He has found documentation on all aspects of how to design a lab except the number of exits
 needed. How many exits should Steven include in his design for the computer forensics lab?
 A. Two
 B. One
 C. Three
 D. Four
 Answer: B (
 LEAVE AREPLY)
 NEWQUESTION: 28
 Which of the following registry hive gives the configuration information about which application
 was used to open various files on the system?
 A. HKEY_CLASSES_ROOT
 B. HKEY_USERS
 C. HKEY_LOCAL_MACHINE
 D. HKEY_CURRENT_CONFIG
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 29
 Law enforcement officers are conducting a legal search for which a valid warrant was obtained.
 While conducting the search, officers observe an item of evidence for an unrelated crime that was
 not included in the warrant. The item was clearly visible to the officers and immediately identified
 as evidence. What is the term used to describe how this evidence is admissible?
 A. Plain view doctrine
 B. Locard Exchange Principle
 C. Ex Parte Order
 D. Corpus delicti
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 30
 A. All virtual memory will be deleted
 B. The wrong partition may be set to active
 C. This action can corrupt the disk
 D. The computer will be set in a constant reboot state
 Answer: (
 SHOWANSWER)
NEWQUESTION: 31
 This organization maintains a database of hash signatures for known software.
 A. American National standards Institute
 B. International Standards Organization
 C. National Software Reference Library
 D. Institute of Electrical and Electronics Engineers
 Answer: (
 SHOWANSWER)
 Valid 312-49v10 Dumps shared by PassTestKing.com for Helping Passing 312-49v10 Exam!
 PassTestKing.com now offer the newest 312-49v10 exam dumps, the PassTestKing.com
 312-49v10 exam questions have been updated and answers have been corrected get the
 newest PassTestKing.com 312-49v10 dumps with Test Engine here:
 https://www.passtestking.com/EC-COUNCIL/312-49v10-practice-exam-dumps.html (706 Q&As
 Dumps, 35%OFF Special Discount Code: freecram)
 NEWQUESTION: 32
 In a forensic examination of hard drives for digital evidence, what type of user is most likely to
 have the most file slack to analyze?
 A. one who has NTFS 4 or 5 partitions
 B. one who uses dynamic swap file capability
 C. one who uses hard disk writes on IRQ 13 and 21
 D. one who has lots of allocation units per block or cluster
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 33
 A master boot record (MBR) is the first sector ("sector zero") of a data storage device. What is the
 size of MBR?
 A. Depends on the capacity of the storage device
 B. 1048 Bytes
 C. 4092 Bytes
 D. 512 Bytes
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 34
 Jim performed a vulnerability analysis on his network and found no potential problems. He runs
 another utility that executes exploits against his system to verify the results of the vulnerability
 test.
The second utility executes five known exploits against his network in which the vulnerability
 analysis said were not exploitable. What kind of results did Jim receive from his vulnerability
 analysis?
 A. False negatives
 B. False positives
 C. True positives
 D. True negatives
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 35
 Data is striped at a byte level across multiple drives, and parity information is distributed among
 all member drives.
 What RAID level is represented here?
 A. RAID Level 1
 B. RAID Level 3
 C. RAID Level 0
 D. RAID Level 5
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 36
 Select the data that a virtual memory would store in a Windows-based system.
 A. Running processes
 B. Application data
 C. Documents and other files
 D. Information or metadata of the files
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 37
A small law firm located in the Midwest has possibly been breached by a computer hacker looking
 to obtain information on their clientele. The law firm does not have any on-site IT employees, but
 wants to search for evidence of the breach themselves to prevent any possible media attention.
 Why would this not be recommended?
 A. Searching could possibly crash the machine or device
 B. Searching creates cache files, which would hinder the investigation
 C. Searching for evidence themselves would not have any ill effects
 D. Searching can change date/time stamps
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 38
 Select the tool appropriate for examining the dynamically linked libraries of an application or
 malware.
 A. ResourcesExtract
 B. PEiD
 C. DependencyWalker
 D. SysAnalyzer
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 39
 What type of analysis helps to identify the time and sequence of events in an investigation?
 A. Relational
 B. Temporal
 C. Functional
 D. Time-based
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 40
 A. Logon Failure- Unknown user name or bad password
 B. Logon Failure- User not allowed to logon at this computer
 C. Logon Failure- Account currently disabled
 D. Logon Failure- Account logon time restriction violation
 Answer: D (
 LEAVE AREPLY)
 NEWQUESTION: 41
 What value of the "Boot Record Signature" is used to indicate that the boot-loader exists?
 A. AA00
 B. A100
 C. 00AA
 D. AA55
Answer: (
 SHOWANSWER)
 NEWQUESTION: 42
 When you carve an image, recovering the image depends on which of the following skills?
 A. Recovering the image from a tape backup
 B. Recovering the image from the tape backup
 C. Recognizing the pattern of the header content
 D. Recognizing the pattern of a corrupt file
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 43
 The MD5 program is used to:
 A. view graphics files on an evidence drive
 B. wipe magnetic media before recycling it
 C. verify that a disk is not altered when you examine it
 D. make directories on an evidence disk
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 44
 Which among the following web application threats is resulted when developers expose various
 internal implementation objects, such as files, directories, database records, or key-through
 references?
 A. Cross Site Scripting
 B. Cross Site Request Forgery
 C. Remote File Inclusion
 D. Insecure Direct Object References
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 45
 Raw data acquisition format creates _________ of a data set or suspect drive.
 A. Compressed image files
 B. Segmented image files
 C. Segmented files
 D. Simple sequential flat files
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 46
 You are working for a local police department that services a population of 1,000,000 people and
 you have been given the task of building a computer forensics lab. How many law-enforcement
 computer investigators should you request to staff the lab?
 A. 1
B. 8
 C. 4
 D. 2
 Answer: (
 SHOWANSWER)
 Valid 312-49v10 Dumps shared by PassTestKing.com for Helping Passing 312-49v10 Exam!
 PassTestKing.com now offer the newest 312-49v10 exam dumps, the PassTestKing.com
 312-49v10 exam questions have been updated and answers have been corrected get the
 newest PassTestKing.com 312-49v10 dumps with Test Engine here:
 https://www.passtestking.com/EC-COUNCIL/312-49v10-practice-exam-dumps.html (706 Q&As
 Dumps, 35%OFF Special Discount Code: freecram)
 NEWQUESTION: 47
 An "idle" system is also referred to as what?
 A. PC not connected to the Internet
 B. Zombie
 C. PC not being used
 D. Bot
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 48
 While looking through the IIS log file of a web server, you find the following entries:
 What is evident from this log file?
 A. Hidden fields
 B. SQL injection is possible
 C. Cross site scripting
 D. Web bugs
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 49
 Which of the following statements is true regarding SMTP Server?
 A. SMTP Server breaks the recipient's address into Recipient's name and recipient's address
 before passing it to the DNS Server
 B. SMTP Server breaks the recipient's address into Recipient's name and his/her designation
 before passing it to the DNS Server
C. SMTP Server breaks the recipient's address into Recipient's name and his/her initial before
 passing it to the DNS Server
 D. SMTP Server breaks the recipient's address into Recipient's name and domain name before
 passing it to the DNS Server
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 50
 A. 32
 B. 48
 C. 64
 D. 16
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 51
 With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode
 internal link count reaches ________.
 A. 100
 B. 1
 C. 0
 D. 10
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 52
 What operating system would respond to the following command?
 A. FreeBSD
 B. Windows 95
 C. Mac OS X
 D. Windows XP
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 53
 You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the
 Internet. What search string will you use to locate them?
 A. allinurl:"exchange/logon.asp"
 B. intitle:"exchange server"
 C. outlook:"search"
 D. locate:"logon page"
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 54
You have been given the task to investigate web attacks on a Windows-based server. Which of
 the following commands will you use to look at the sessions the machine has opened with other
 systems?
 A. Net use
 B. Net sessions
 C. Net config
 D. Net share
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 55
 You should make at least how many bit-stream copies of a suspect drive?
 A. 1
 B. 3
 C. 4
 D. 2
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 56
 Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive
 files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the
 operating system in use.
 A. Windows 8.1
 B. Linux
 C. Windows XP
 D. Windows 98
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 57
 The investigator wants to examine changes made to the system's registry by the suspect
 program. Which of the following tool can help the investigator?
 A. What's Running
 B. RAMCapturer
 C. TRIPWIRE
 D. Regshot
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 58
 When analyzing logs, it is important that the clocks of all the network devices are synchronized.
 Which protocol will help in synchronizing these clocks?
 A. PTP
 B. UTC
C. Time Protocol
 D. NTP
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 59
 Why is it a good idea to perform a penetration test from the inside?
 A. It is never a good idea to perform a penetration test from the inside
 B. It is easier to hack from the inside
 C. Because 70% of attacks are from inside the organization
 D. To attack a network from a hacker's perspective
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 60
 A. DVD-18
 B. Blu-Ray dual-layer
 C. Blu-Ray single-layer
 D. HD-DVD
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 61
 What information do you need to recover when searching a victim's computer for a crime
 committed with specific e-mail message?
 A. Firewall log
 B. E-mail header
 C. Username and password
 D. Internet service provider information
 Answer: (
 SHOWANSWER)
 Valid 312-49v10 Dumps shared by PassTestKing.com for Helping Passing 312-49v10 Exam!
 PassTestKing.com now offer the newest 312-49v10 exam dumps, the PassTestKing.com
 312-49v10 exam questions have been updated and answers have been corrected get the
 newest PassTestKing.com 312-49v10 dumps with Test Engine here:
 https://www.passtestking.com/EC-COUNCIL/312-49v10-practice-exam-dumps.html (706 Q&As
 Dumps, 35%OFF Special Discount Code: freecram)
 NEWQUESTION: 62
The rule of thumb when shutting down a system is to pull the power plug. However, it has certain
 drawbacks. Which of the following would that be?
 A. The /tmp directory will be flushed
 B. All running processes will be lost
 C. Power interruption will corrupt the pagefile
 D. Any data not yet flushed to the system will be lost
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 63
 Julie is a college student majoring in Information Systems and Computer Science. She is
 currently writing an essay for her computer crimes class. Julie paper focuses on white-collar
 crimes in America and how forensics investigators investigate the cases. Julie would like to focus
 the subject. Julie would like to focus the subject of the essay on the most common type of crime
 found in corporate Americ a. What crime should Julie focus on?
 A. Physical theft
 B. Denial of Service attacks
 C. Industrial espionage
 D. Copyright infringement
 Answer: C (
 LEAVE AREPLY)
 NEWQUESTION: 64
 Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer
 hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house.
 Daryl packs all the items found in his van and takes them back to his lab for further examination.
 At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training,
 Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to
 copy all the data off the computer and peripheral devices. How many data acquisition tools should
 Michael use when creating copies of the evidence for the investigation?
 A. One
 B. Four
 C. Two
 D. Three
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 65
 What does ICMP Type 3/Code 13 mean?
 A. Port Unreachable
 B. Host Unreachable
 C. Administratively Blocked
 D. Protocol Unreachable
 Answer: (
 SHOWANSWER)
NEWQUESTION: 66
 Bob works as information security analyst for a big finance company. One day, the anomaly
based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the
 main web server was occurring. What kind of attack is it?
 A. IDS attack
 B. Web application attack
 C. APT
 D. Network attack
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 67
 When a router receives an update for its routing table, what is the metric value change to that
 path?
 A. Increased by 1
 B. Decreased by 1
 C. Increased by 2
 D. Decreased by 2
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 68
 Which US law does the interstate or international transportation and receiving of child
 pornography fall under?
 A. ¡×18. U.S.C 252
 B. ¡×18. U.S.C 2252
 C. ¡×18. U.S.C. 1466A
 D. ¡×18. U.S.C 146A
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 69
 Where should the investigator look for the Edge browser's browsing records, including history,
 cache, and cookies?
 A. ESE Database
 B. Sparse files
 C. Slack Space
 D. Virtual Memory
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 70
 A. It is the process of restarting a computer that is already in sleep mode
B. It is the process of restarting a computer that is already turned on through the operating
 system
 C. It is the process of shutting down a computer from a powered-on or on state
 D. It is the process of starting a computer from a powered-down or off state
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 71
 Centralized binary logging is a process in which many websites write binary and unformatted log
 data to a single log file. What extension should the investigator look to find its log file?
 A. .log
 B. .ibl
 C. .txt
 D. .cbl
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 72
 With Regard to using an Antivirus scanner during a computer forensics investigation, You should:
 A. Scan your forensics workstation at intervals of no more than once every five minutes during an
 investigation
 B. Scan the suspect hard drive before beginning an investigation
 C. Scan your Forensics workstation before beginning an investigation
 D. Never run a scan on your forensics workstation because it could change your systems
 configuration
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 73
 Which Intrusion Detection System (IDS) usually produces the most false alarms due to the
 unpredictable behaviors of users and networks?
 A. network-based IDS systems (NIDS)
 B. signature recognition
 C. anomaly detection
 D. host-based IDS systems (HIDS)
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 74
 Which of the following techniques can be used to beat steganography?
 A. Steganalysis
 B. Encryption
 C. Decryption
 D. Cryptanalysis
 Answer: (
 SHOWANSWER)
NEWQUESTION: 75
 Chris has been called upon to investigate a hacking incident reported by one of his clients. The
 company suspects the involvement of an insider accomplice in the attack. Upon reaching the
 incident scene, Chris secures the physical area, records the scene using visual medi a. He shuts
 the system down by pulling the power plug so that he does not disturb the system in any way. He
 labels all cables and connectors prior to disconnecting any. What do you think would be the next
 sequence of events?
 A. Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the
 media
 B. Prepare the system for acquisition; Connect the target media; copy the media; Secure the
 evidence
 C. Connect the target media; prepare the system for acquisition; Secure the evidence; Copy the
 media
 D. Secure the evidence; prepare the system for acquisition; Connect the target media; copy the
 media
 Answer: (
 SHOWANSWER)
 NEWQUESTION: 76
 The surface of a hard disk consists of several concentric rings known as tracks; each of these
 tracks has smaller partitions called disk blocks. What is the size of each block?
 A. 256 bytes
 B. 512 bytes
 C. 512 bits
 D. 256 bits
 Answer: B (
 LEAVE AREPLY)
 Valid 312-49v10 Dumps shared by PassTestKing.com for Helping Passing 312-49v10 Exam!
 PassTestKing.com now offer the newest 312-49v10 exam dumps, the PassTestKing.com
 312-49v10 exam questions have been updated and answers have been corrected get the
 newest PassTestKing.com 312-49v10 dumps with Test Engine here:
 https://www.passtestking.com/EC-COUNCIL/312-49v10-practice-exam-dumps.html (706 Q&As
 Dumps, 35%OFF Special Discount Code: freecram)