Eccouncil 312-49 Computer Hacking Forensic Investigator Exam Practice Test Questions

• Question 1

  Which is a standard procedure to perform during all computer forensics investigations?

  • With the hard drive removed from the suspect PC, check the date and time in the system's CMOS
  • With the hard drive in the suspect PC, check the date and time in the File Allocation Table
  • With the hard drive removed from the suspect PC, check the date and time in the system's RAM
  • With the hard drive in the suspect PC, check the date and time in the system's CMOS

  Show Answer Answer: A Next

• Question 2

  Which of the following tool can reverse machine code to assembly language?

  • PEiD
  • RAM Capturer
  • IDA Pro
  • Deep Log Analyzer

  Show Answer Answer: C Next

• Question 3

  The offset in a hexadecimal code is:

  • The last byte after the colon
  • The 0x at the beginning of the code
  • The 0x at the end of the code
  • The first byte after the colon

  Show Answer Answer: B Next

• Question 4

  What does the command ''C:\>wevtutil gl <log name>'' display?

  • Configuration information of a specific Event Log
  • Event logs are saved in .xml format
  • Event log record structure
  • List of available Event Logs

  Show Answer Answer: A Next

• Question 5

  Which set of anti-forensic tools/techniques allows a program to compress and/or encrypt an executable file to hide attack tools from being detected by reverse-engineering or scanning?

  • Packers
  • Emulators
  • Password crackers
  • Botnets

  Show Answer Answer: A Next