Unique Top-selling 312-49v11 Exams - New 2025 EC-COUNCIL Pratice Exam
Certified Ethical Hacker Dumps 312-49v11 Exam for Full Questions - Exam Study Guide
NEW QUESTION # 324
George was recently fired from his job as an IT analyst at Pitts and Company in Dallas Texas.
His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company's network by cracking some of the service accounts he knows about.
Which password cracking technique should George use in this situation?
- A. Syllable attack
- B. Dictionary attack
- C. Rule-based attack
- D. Brute force attack
Answer: C
NEW QUESTION # 325
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where, "X" represents the _________.
- A. Original file name
- B. Drive name
- C. Original file name's extension
- D. Sequential number
Answer: B
NEW QUESTION # 326
During an intense cybercrime investigation, an inexperienced first responder mistakenly mishandled a piece of digital evidence. It was later discovered that the chain of custody was also incomplete. If not properly documented, which of the following details would make the chain of custody deficient?
- A. The color of the digital device from which the evidence was extracted
- B. The manufacturing company of the device from which evidence was extracted
- C. The reason and process for obtaining the evidence
- D. The exact number of photos taken at the crime scene
Answer: C
NEW QUESTION # 327
Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password. Which password cracking technique would be optimal to crack her password?
- A. Syllable attack
- B. Rule-based attack
- C. Brute force attack
- D. Hybrid attack
Answer: B
NEW QUESTION # 328
Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to Instructions written in assembly language. Which tool should he use for this purpose?
- A. HashCalc
- B. oledump
- C. Ollydbg
- D. BinText
Answer: C
NEW QUESTION # 329
An Expert witness gives an opinion if:
- A. The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
- B. To define the issues of the case for determination by the finder of fact
- C. To stimulate discussion between the consulting expert and the expert witness
- D. To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
Answer: A
NEW QUESTION # 330
companyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The employee of CompanyXYZ is aware.
- A. Interviewing employees and network engineers
- B. Reviewing the firewalls configuration
- C. Source code review
- D. Data items and vulnerability scanning
Answer: C
NEW QUESTION # 331
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device.
Where is TAC located in mobile devices?
- A. Integrated circuit card identifier (ICCID)
- B. International Mobile Equipment Identifier (IMEI)
- C. Equipment Identity Register (EIR)
- D. International mobile subscriber identity (IMSI)
Answer: B
NEW QUESTION # 332
You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?
- A. A web server and the database server facing the Internet, an application server on the internal network
- B. All three servers need to face the Internet so that they can communicate between themselves
- C. A web server facing the Internet, an application server on the internal network, a database server on the internal network
- D. All three servers need to be placed internally
Answer: B
NEW QUESTION # 333
Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?
- A. ff d8 ff
- B. 25 50 44 46
- C. 50 41 03 04
- D. d0 0f 11 e0
Answer: A
NEW QUESTION # 334
During an Investigation. Noel found a SIM card from the suspect's mobile. The ICCID on the card is 8944245252001451548.
What does the first four digits (89 and 44) In the ICCID represent?
- A. TAC and industry identifier
- B. Industry identifier and country code
- C. Country code and industry identifier
- D. Issuer identifier number and TAC
Answer: B
NEW QUESTION # 335
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?
- A. The Recycle Bin does not exist on the hard drive
- B. The files are hidden and he must use switch to view them
- C. Only FAT system contains RECYCLED folder and not NTFS
- D. He should search in C:\Windows\System32\RECYCLED folder
Answer: B
NEW QUESTION # 336
Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida. They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good. Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa. She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, reQuested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for.
What principal of social engineering did Julia use?
- A. Social Validation
- B. Friendship/Liking
- C. Scarcity
- D. Reciprocation
Answer: D
NEW QUESTION # 337
You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.
Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?
- A. All forms should be placed in an approved secure container because they are now primary evidence in the case
- B. All forms should be placed in the report file because they are now primary evidence in the case
- C. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container
- D. The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file
Answer: C
NEW QUESTION # 338
In an ongoing cybercrime investigation, Laura, a certified Computer Hacking Forensics Investigator (CHFI), has identified a system involved in illegal activities. The system is connected to a network with many other users. Laura needs to gather evidence related to the identified system's internet usage. Which legal and privacy considerations should be her utmost priority?
- A. Obtaining explicit consent from the system owner before starting the investigation
- B. Informing the authorities about the identified illegal activities
- C. Acquiring a search warrant specifically mentioning the identified system
- D. Maintaining the anonymity of non-target users connected to the system
Answer: C
NEW QUESTION # 339
Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?
- A. Sparse or Logical Acquisition
- B. Bit-stream disk-to-disk Acquisition
- C. Bit-by-bit Acquisition
- D. Static Acquisition
Answer: A
NEW QUESTION # 340
Email spoofing refers to:
- A. The forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source
- B. A sudden spike of "Reply All" messages on an email distribution list, caused by one misdirected message
- C. The criminal act of sending an illegitimate email, falsely claiming to be from a legitimate site in an attempt to acquire the user's personal or account information
- D. Sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address Is hosted to cause a denial-of-service attack
Answer: A
NEW QUESTION # 341
Consider a scenario where the perpetrator of a dark web crime has unlnstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can Investigate It for artifacts of Tor browser usage. Which of the following should the Investigators examine to establish the use of Tor browser on the suspect machine?
- A. Files in Recycle Bin
- B. Swap files
- C. Prefetch files
- D. Security logs
Answer: B
NEW QUESTION # 342
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?
- A. Directory traversal
- B. Security misconfiguration
- C. Unvalidated input
- D. Parameter/form tampering
Answer: A
NEW QUESTION # 343
Cloud forensic investigations impose challenges related to multi-jurisdiction and multi-tenancy aspects. To have a better understanding of the roles and responsibilities between the cloud service provider (CSP) and the client, which document should the forensic investigator review?
- A. National and local regulation
- B. Service level agreement
- C. Key performance indicator
- D. Service level management
Answer: B
NEW QUESTION # 344
A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week.
What can the investigator infer from the screenshot seen below?
- A. A smurf attack has been attempted
- B. A denial of service has been attempted
- C. Network intrusion has occurred
- D. Buffer overflow attempt on the firewall.
Answer: C
NEW QUESTION # 345
A digital forensics investigator performs a browser history analysis after a suspected breach. The investigator deals with three web browsers: Mozilla Firefox, Coogle Chrome, and Microsoft Edge.
The suspect was using Windows. The investigator must locate the cache, cookies, and history for all three browsers. What are the correct locations?
- A. Firefox: History - C:\Users\\AppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cookies.sqlite; Chrome: Cache - C:\Users\{user}\AppData\Local\Coogle\Chrome\User Data\Default\Cache; Edge: Cookies - C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxxxxxxx\AC\MicrosoftEdg e\Cookies
- B. Firefox: Cookies - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\cookies.sqlite; Chrome: Cache - C:\Users\{user}\AppData\Local\Coogle\Chrome\User Data\Default\Cache; Edge: History - C:\Users\Admin\AppData\Local\Microsoft\Windows\History
- C. Firefox: Cache - C:\UsersWAppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cache2; Chrome: History - C:\Users\{user)\AppData\Local\Google\Crrome\User Data\Default; Edge: Cookies - C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxxxxxxx\AC\MicrosoftEdg e\Cookies
- D. Firefox: Cache - C:\UsersWAppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\places.sqlite; Chrome: Cookies - C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default; Edge: History - C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache
Answer: B
NEW QUESTION # 346
"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle Is advocated by which of the following?
- A. Scientific Working Group on Imaging Technology (SWGIT)
- B. FBI Cyber Division
- C. The Association of Chief Police Officers (ACPO) Principles of Digital Evidence
- D. Locard's exchange principle
Answer: C
NEW QUESTION # 347
Which of the following tools will allow a forensic Investigator to acquire the memory dump of a suspect machine so that It may be Investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?
- A. Hex Editor
- B. DB Browser SQLite
- C. Belkasoft Live RAM Capturer and AccessData FTK imager
- D. Bulk Extractor
Answer: C
NEW QUESTION # 348
Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.
Which organization coordinates computer crimes investigations throughout the United States?
- A. Local or national office of the U.S. Secret Service
- B. National Infrastructure Protection Center
- C. CERT Coordination Center
- D. Internet Fraud Complaint Center
Answer: B
NEW QUESTION # 349
......
Best way to practice test for EC-COUNCIL 312-49v11: https://www.certkingdompdf.com/312-49v11-latest-certkingdom-dumps.html
312-49v11 Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1HdAm1IpR8H3eJvDG2x6POV5f2skyvBTZ