312-49 practice questions 281–290

1. Question 281 · 647 in bank

   Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

   • AThe data is still present until the original location of the file is used
   • BThe data is moved to the Restore directory and is kept there indefinitely
   • CThe data will reside in the L2 cache on a Windows computer until it is manually deleted
   • DIt is not possible to recover data that has been emptied from the Recycle Bin

   Show answer

   Answer: A

   Next question

2. Question 282 · 647 in bank

   When is it appropriate to use computer forensics?

   • AIf copyright and intellectual property theft/misuse has occurred
   • BIf employees do not care for their boss management techniques
   • CIf sales drop off for no apparent reason for an extended period of time
   • DIf a financial institution is burglarized by robbers

   Show answer

   Answer: A

   Next question

3. Question 283 · 647 in bank

   Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?

   • ADirectory Table
   • BRainbow Table
   • CMaster file Table (MFT)
   • DPartition Table

   Show answer

   Answer: B

   Next question

4. Question 284 · 647 in bank

   Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

   • ASearch for disk errors within an image file
   • BBackup a disk to an image file
   • CCopy a partition to an image file
   • DRestore a disk from an image file

   Show answer

   Answer: D

   Next question

5. Question 285 · 647 in bank

   What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024

   • ACopy the master boot record to a file
   • BCopy the contents of the system folder to a file
   • CCopy the running memory to a file
   • DCopy the memory dump file to an image file

   Show answer

   Answer: C

   Next question

6. Question 286 · 647 in bank

   Before performing a logical or physical search of a drive in Encase, what must be added to the program?

   • AFile signatures
   • BKeywords
   • CHash sets
   • DBookmarks

   Show answer

   Answer: B

   Next question

7. Question 287 · 647 in bank

   When a router receives an update for its routing table, what is the metric value change to that path?

   • AIncreased by 2
   • BDecreased by 1
   • CIncreased by 1
   • DDecreased by 2

   Show answer

   Answer: C

   Next question

8. Question 288 · 647 in bank

   When operating systems mark a cluster as used but not allocated, the cluster is considered as _________

   • ACorrupt
   • BBad
   • CLost
   • DUnallocated

   Show answer

   Answer: C

   Next question

9. Question 289 · 647 in bank

   While looking through the IIS log file of a web server, you find the following entries:

   

   What is evident from this log file?

   • AWeb bugs
   • BCross site scripting
   • CHidden fields
   • DSQL injection is possible

   Show answer

   Answer: D

   Next question

10. Question 290 · 647 in bank

    Using Internet logging software to investigate a case of malicious use of computers, the investigator comes across some entries that appear odd.

    

    From the log, the investigator can see where the person in question went on the Internet. From the log, it appears that the user was manually typing in different user ID numbers. What technique this user was trying?

    • AParameter tampering
    • BCross site scripting
    • CSQL injection
    • DCookie Poisoning

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 281. 647 questions available.