312-49 practice questions 411–420

1. Question 411 · 647 in bank

   In a Linux-based system, what does the command `Last -F` display?

   • ALogin and logout times and dates of the system
   • BLast run processes
   • CLast functions performed
   • DRecently opened files

   Show answer

   Answer: A

   Next question

2. Question 412 · 647 in bank

   Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

   • ACross Examination
   • BDirect Examination
   • CIndirect Examination
   • DWitness Examination

   Show answer

   Answer: A

   Next question

3. Question 413 · 647 in bank

   NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

   • AEncrypted FEK
   • BChecksum
   • CEFS Certificate Hash
   • DContainer Name

   Show answer

   Answer: B

   Next question

4. Question 414 · 647 in bank

   After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

   • APRIV.STM
   • BPUB.EDB
   • CPRIV.EDB
   • DPUB.STM

   Show answer

   Answer: D

   Next question

5. Question 415 · 647 in bank

   Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?

   • ASparse File
   • BMaster File Table
   • CMeta Block Group
   • DSlack Space

   Show answer

   Answer: A

   Next question

6. Question 416 · 647 in bank

   Which of the following is a tool to reset Windows admin password?

   • AR-Studio
   • BWindows Password Recovery Bootdisk
   • CWindows Data Recovery Software
   • DTestDisk for Windows

   Show answer

   Answer: B

   Next question

7. Question 417 · 647 in bank

   Select the data that a virtual memory would store in a Windows-based system.

   • AInformation or metadata of the files
   • BDocuments and other files
   • CApplication data
   • DRunning processes

   Show answer

   Answer: D

   Next question

8. Question 418 · 647 in bank

   Which of the following does not describe the type of data density on a hard disk?

   • AVolume density
   • BTrack density
   • CLinear or recording density
   • DAreal density

   Show answer

   Answer: A

   Next question

9. Question 419 · 647 in bank

   During an investigation, Noel found the following SIM card from the suspect's mobile. What does the code 89 44 represent?

   

   • AIssuer Identifier Number and TAC
   • BIndustry Identifier and Country code
   • CIndividual Account Identification Number and Country Code
   • DTAC and Industry Identifier

   Show answer

   Answer: B

   Next question

10. Question 420 · 647 in bank

    What system details can an investigator obtain from the NetBIOS name table cache?

    • AList of files opened on other systems
    • BList of the system present on a router
    • CList of connections made to other systems
    • DList of files shared between the connected systems

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 411. 647 questions available.