Real Exam Questions 312-49 Dumps Exam Questions in here [Aug-2021]
Get Latest Aug-2021 Conduct effective penetration tests using 312-49
NEW QUESTION 56
John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that?
- A. Firewalk cannot be detected by network sniffers
- B. Firewalk sets all packets with a TTL of zero
- C. Firewalk sets all packets with a TTL of one
- D. Firewalk cannot pass through Cisco firewalls
Answer: C
NEW QUESTION 57
Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to findThese 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather? responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused. In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples?desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other. What type of cipher was used by the accused in this case?
- A. Null cipher
- B. Visual semagram
- C. Text semagram
- D. Grill cipher
Answer: D
NEW QUESTION 58
Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?
- A. SDW Encryption
- B. EFS Encryption
- C. DFS Encryption
- D. IPS Encryption
Answer: B
Explanation:
Explanation
NEW QUESTION 59
Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror
- A. Restore a disk from an image file
- B. Backup a disk to an image file
- C. Search for disk errors within an image file
- D. Copy a partition to an image file
Answer: A
NEW QUESTION 60
To check for POP3 traffic using Ethereal, what port should an investigator search by?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
NEW QUESTION 61
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
- A. The wrong partition may be set to active
- B. The computer will be set in a constant reboot state
- C. All virtual memory will be deleted
- D. This action can corrupt the disk
Answer: D
NEW QUESTION 62
When should an MD5 hash check be performed when processing evidence?
- A. Before the evidence examination has been completed
- B. On an hourly basis during the evidence examination
- C. After the evidence examination has been completed
- D. Before and after evidence examination
Answer: D
NEW QUESTION 63
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?
- A. rules of evidence
- B. law of probability
- C. chain of custody
- D. policy of separation
Answer: C
NEW QUESTION 64
An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the team have to respond to the incident?
- A. Two working days
- B. One working day
- C. Immediately
- D. Four hours
Answer: B
NEW QUESTION 65
Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?
- A. Swap space
- B. Files and documents
- C. Slack space
- D. Application data
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 66
You are running through a series of tests on your network to check for any security vulnerabilities.
After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall.
What has happened?
- A. The firewall ACL has been purged
- B. The firewall failed-closed
- C. The firewall failed-bypass
- D. The firewall failed-open
Answer: D
NEW QUESTION 67
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
- A. Every byte of the file(s) is copied to three different hard drives
- B. Every byte of the file(s) is verified using 32-bit CRC
- C. Every byte of the file(s) is given an MD5 hash to match against a master file
- D. Every byte of the file(s) is encrypted using three different methods
Answer: B
NEW QUESTION 68
In the following email header, where did the email first originate from?
- A. Simon1.state.ok.gov.us
- B. Smtp1.somedomain.com
- C. Somedomain.com
- D. David1.state.ok.gov.us
Answer: A
NEW QUESTION 69
When investigating a computer forensics case where Microsoft Exchange and Blackberry
Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?
- A. Microsoft Exchange server
- B. Blackberry desktop redirector
- C. Blackberry Enterprise server
- D. RIM Messaging center
Answer: A
NEW QUESTION 70
What must be obtained before an investigation is carried out at a location?
- A. Subpoena
- B. Search warrant
- C. Habeas corpus
- D. Modus operandi
Answer: B
NEW QUESTION 71
When investigating a wireless attack, what information can be obtained from the DHCP logs?
- A. The operating system of the attacker and victim computers
- B. IP traffic between the attacker and the victim
- C. If any computers on the network are running in promiscuous mode
- D. MAC address of the attacker
Answer: D
NEW QUESTION 72
A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?
- A. DVD-18
- B. HD-DVD
- C. Blu-Ray dual-layer
- D. Blu-Ray single-layer
Answer: C
NEW QUESTION 73
When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?
- A. The sequential number of the exhibits seized
- B. The initials of the forensics analyst
- C. The year the evidence was taken
- D. The sequence number for the parts of the same exhibit
Answer: A
NEW QUESTION 74
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything.
What is the reason for this?
- A. He should search in C:\Windows\System32\RECYCLED folder
- B. The Recycle Bin does not exist on the hard drive
- C. The files are hidden and he must use switch to view them
- D. Only FAT system contains RECYCLED folder and not NTFS
Answer: C
NEW QUESTION 75
What method of copying should always be performed first before carrying out an investigation?
- A. Bit-stream copy
- B. Parity-bit copy
- C. MS-DOS disc copy
- D. System level copy
Answer: A
NEW QUESTION 76
......
Authentic Best resources for 312-49 Online Practice Exam: https://www.validbraindumps.com/312-49-exam-prep.html