312-49 practice questions 471–480

1. Question 471 · 647 in bank

   Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?

   • Apstree
   • Bpgrep
   • Cps
   • Dgrep

   Show answer

   Answer: B

   Next question

2. Question 472 · 647 in bank

   Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

   • ASignature-Based Detection
   • BIntegrity-Based Detection
   • CCross View-Based Detection
   • DHeuristic/Behavior-Based Detection

   Show answer

   Answer: B

   Next question

3. Question 473 · 647 in bank

   Which program uses different techniques to conceal a malware's code, thereby making it difficult for security mechanisms to detect or remove it?

   • ADropper
   • BPacker
   • CInjector
   • DObfuscator

   Show answer

   Answer: D

   Next question

4. Question 474 · 647 in bank

   What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

   • AJump instruction and the OEM ID
   • BBIOS Parameter Block (BPB) and the OEM ID
   • CBIOS Parameter Block (BPB) and the extended BPB
   • DBootstrap code and the end of the sector marker

   Show answer

   Answer: C

   Next question

5. Question 475 · 647 in bank

   What does the Rule 101 of Federal Rules of Evidence states?

   • AScope of the Rules, where they can be applied
   • BPurpose of the Rules
   • CLimited Admissibility of the Evidence
   • DRulings on Evidence

   Show answer

   Answer: A

   Next question

6. Question 476 · 647 in bank

   What document does the screenshot represent?

   

   • AExpert witness form
   • BSearch warrant form
   • CChain of custody form
   • DEvidence collection form

   Show answer

   Answer: D

   Next question

7. Question 477 · 647 in bank

   James is dealing with a case regarding a cybercrime that has taken place in Arizona, USA. James needs to lawfully seize the evidence from an electronic device without affecting the user's anonymity. Which of the following law should he comply with, before retrieving the evidence?

   • AFirst Amendment of the U.S. Constitution
   • BFourth Amendment of the U.S. Constitution
   • CThird Amendment of the U.S. Constitution
   • DFifth Amendment of the U.S. Constitution

   Show answer

   Answer: D

   Next question

8. Question 478 · 647 in bank

   Which of the following stand true for BIOS Parameter Block?

   • AThe BIOS Partition Block describes the physical layout of a data storage volume
   • BThe BIOS Partition Block is the first sector of a data storage device
   • CThe length of BIOS Partition Block remains the same across all the file systems
   • DThe BIOS Partition Block always refers to the 512-byte boot sector

   Show answer

   Answer: A

   Next question

9. Question 479 · 647 in bank

   MAC filtering is a security access control methodology, where a ___________ is assigned to each network card to determine access to the network.

   • A48-bit address
   • B24-bit address
   • C16-bit address
   • D32-bit address

   Show answer

   Answer: A

   Next question

10. Question 480 · 647 in bank

    Which of the following files store the MySQL database data permanently, including the data that had been deleted, helping the forensic investigator in examining the case and finding the culprit?

    • Amysql-bin
    • Bmysql-log
    • Ciblog
    • Dibdata1

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 471. 647 questions available.