Improve 312-49v10 Test For Computer Hacking Forensic Investigator (CHFI-v10) Certification

NEW QUESTION 1

A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect’s available information but without any success. Which of the following tool can help the investigator to solve this issue?

• A. Cain & Abel
• B. Xplico
• C. Recuva
• D. Colasoft’s Capsa

Answer: A

NEW QUESTION 2

Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?

• A. Justification
• B. Authentication
• C. Reiteration
• D. Certification

Answer: B

NEW QUESTION 3

Which command line tool is used to determine active network connections?

• A. netsh
• B. nbstat
• C. nslookup
• D. netstat

Answer: D

NEW QUESTION 4

An investigator has found certain details after analysis of a mobile device. What can reveal the manufacturer information?

• A. Equipment Identity Register (EIR)
• B. Electronic Serial Number (ESN)
• C. International mobile subscriber identity (IMSI)
• D. Integrated circuit card identifier (ICCID)

Answer: B

NEW QUESTION 5

The process of restarting a computer that is already turned on through the operating system is called?

• A. Warm boot
• B. Ice boot
• C. Hot Boot
• D. Cold boot

Answer: A

NEW QUESTION 6

The offset in a hexadecimal code is:

• A. The last byte after the colon
• B. The 0x at the beginning of the code
• C. The 0x at the end of the code
• D. The first byte after the colon

Answer: B

NEW QUESTION 7

Which network attack is described by the following statement?
“At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries.”

• A. DDoS
• B. Sniffer Attack
• C. Buffer Overflow
• D. Man-in-the-Middle Attack

Answer: A

NEW QUESTION 8

Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

• A. Linux/Unix computers are easier to compromise
• B. Linux/Unix computers are constantly talking
• C. Windows computers are constantly talking
• D. Windows computers will not respond to idle scans

Answer: C

NEW QUESTION 9

Which of the following is a list of recently used programs or opened files?

• A. Most Recently Used (MRU)
• B. Recently Used Programs (RUP)
• C. Master File Table (MFT)
• D. GUID Partition Table (GPT)

Answer: A

NEW QUESTION 10

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

• A. EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
• B. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
• C. The EFS Revoked Key Agent can be used on the Computer to recover the information
• D. When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.

Answer: B

NEW QUESTION 11

Which of the following standard represents a legal precedent sent in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses’ testimony during federal legal proceedings?

• A. IOCE
• B. SWGDE & SWGIT
• C. Frye
• D. Daubert

Answer: D

NEW QUESTION 12

What must an investigator do before disconnecting an iPod from any type of computer?

• A. Unmount the iPod
• B. Mount the iPod
• C. Disjoin the iPod
• D. Join the iPod

Answer: A

NEW QUESTION 13

Who is responsible for the following tasks?

• A. Non-forensics staff
• B. Lawyers
• C. System administrators
• D. Local managers or other non-forensic staff

Answer: A

NEW QUESTION 14

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

• A. Speculation or opinion as to the cause of the incident
• B. Purpose of the report
• C. Author of the report
• D. Incident summary

Answer: A

NEW QUESTION 15

You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

• A. 8
• B. 1
• C. 4
• D. 2

Answer: C

NEW QUESTION 16

What type of equipment would a forensics investigator store in a StrongHold bag?

• A. PDAPDA?
• B. Backup tapes
• C. Hard drives
• D. Wireless cards

Answer: D

NEW QUESTION 17
......