Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: simple70

Pass the ECCouncil CHFIv9 312-49v9 Questions and answers with ValidTests

Exam 312-49v9 All Questions
Exam 312-49v9 Premium Access

View all detail and faqs for the 312-49v9 exam

Viewing page 1 out of 14 pages
Viewing questions 1-10 out of questions
Questions # 1:

How many possible sequence number combinations are there in TCP/IP protocol?

Options:

A.

1 billion

B.

320 billion

C.

4 billion

D.

32 million

Expert Solution
Questions # 2:

Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?

Options:

A.

Click-jacking

B.

Compromising a legitimate site

C.

Spearphishing

D.

Malvertising

Expert Solution
Questions # 3:

When investigating a wireless attack, what information can be obtained from the DHCP logs?

Options:

A.

The operating system of the attacker and victim computers

B.

IP traffic between the attacker and the victim

C.

MAC address of the attacker

D.

If any computers on the network are running in promiscuous mode

Expert Solution
Questions # 4:

Which of the following Registry components include offsets to other cells as well as the LastWrite time for the key?

Options:

A.

Value list cell

B.

Value cell

C.

Key cell

D.

Security descriptor cell

Expert Solution
Questions # 5:

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

Options:

A.

All virtual memory will be deleted

B.

The wrong partition may be set to active

C.

This action can corrupt the disk

D.

The computer will be set in a constant reboot state

Expert Solution
Questions # 6:

How often must a company keep log files for them to be admissible in a court of law?

Options:

A.

All log files are admissible in court no matter their frequency

B.

Weekly

C.

Monthly

D.

Continuously

Expert Solution
Questions # 7:

Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

Options:

A.

Point-to-point

B.

End-to-end

C.

Thorough

D.

Complete event analysis

Expert Solution
Questions # 8:

To check for POP3 traffic using Ethereal, what port should an investigator search by?

Options:

A.

143

B.

25

C.

110

D.

125

Expert Solution
Questions # 9:

When marking evidence that has been collected with the “aaa/ddmmyy/nnnn/zz” format, what does the “nnnn” denote?

Options:

A.

The initials of the forensics analyst

B.

The sequence number for the parts of the same exhibit

C.

The year he evidence was taken

D.

The sequential number of the exhibits seized by the analyst

Expert Solution
Questions # 10:

Which of the following tool creates a bit-by-bit image of an evidence media?

Options:

A.

Recuva

B.

FileMerlin

C.

AccessData FTK Imager

D.

Xplico

Expert Solution
Viewing page 1 out of 14 pages
Viewing questions 1-10 out of questions