Question 121 · 647 in bank
When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?
Show answer
Answer: C
312-49ProfessionalEC-CouncilAll questions freePage 13 of 65
312-49 practice questions 121–130
Computer Hacking Forensic Investigator (CHFI)647 questions across 65 pages are complete and free, with no account or card.
Official study references
647 questions in this bank
Free access · progress saved on this device
Question 122 · 647 in bank
Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company's domain controller goes down. From which system would you begin your investigation?
Show answer
Answer: C
Explanation
SIEM aggregates the logs if implemented properly. Would house all the necessary data needed for an investigation. If there is a misconfig in the SIEM or missing data, then you would go to the DC. but SIEM first
Source: Adapted from community discussion — Ariel235788
Question 123 · 647 in bank
Which of the following commands shows you all of the network services running on Windows-based servers?
Show answer
Answer: A
Explanation
The net command with start parameter will show you up all the running services, including network ones. https://ss64.com/nt/net-service.html netstat with no parameters displays active TCP connections. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
Source: Adapted from community discussion — Bodescu
References
Question 124 · 647 in bank
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?
Show answer
Answer: C
Question 125 · 647 in bank
Which among the following search warrants allows the first responder to get the victim's computer information such as service records, billing records, and subscriber information from the service provider?
Show answer
Answer: D
Explanation
100% sure D is the correct answer according to Computer Hacking Forensics Investigator (CHFI) Version 10 - EC-Council Pg. 120. Service Provider Search Warrant warrant allows the investigator to get the victim’s computer information such as service records, billing records, and subscriber information from the service provider
Source: Adapted from community discussion — Ceh2024
Question 126 · 647 in bank
Data is striped at a byte level across multiple drives, and parity information is distributed among all member drives.
What RAID level is represented here?
Show answer
Answer: B
Question 127 · 647 in bank
You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?
Show answer
Answer: C
Question 128 · 647 in bank
Which MySQL log file contains information on server start and stop?
Show answer
Answer: D
Explanation
Question should have the word 'unintended'. From the book : 'examine the error log files and check if there are any unintended startup/shutdown events'
Source: Adapted from community discussion — OrlandoC
Question 129 · 647 in bank
Which of the following is NOT a graphics file?
Show answer
Answer: C
Question 130 · 647 in bank
Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.
Show answer
Answer: C
Explanation
From the Official CHFI Exam guide: Chapter 4, pg. 208 "■ On FAT file systems, the folder is named Recycled. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLED. ■ On NTFS file systems used by Windows NT, 2000, and XP, this folder is named Recycler. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLER. ■ On NTFS file systems used by Windows Vista, this folder is named $Recycle.Bin. For example, on your C: the storage location of the Recycle Bin would be C:\RECYCLE.BIN." So seems clear, answer should be C
Source: Adapted from community discussion — Bodescu
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
312-49 practice, question 121. 647 questions available.
About this question bank
Version 1.0.0. How we source questions