312-49 practice questions 581–590

1. Question 581 · 647 in bank

   A Computer Hacking Forensic Investigator (CHFI) is conducting an analysis of malware obtained from a Darknet source. The CHFI is preparing to run the malware in a controlled environment and plans to record the malware's behavior for further investigation. Based on the available supporting tools, which combination would best suit the CHFI's needs in this scenario?

   • AVirtual Box for virtualization, QualNet for network simulation, and Camtasia for screen capture and recording
   • BParallels Desktop 16 for virtualization, ns-3 for network simulation, and Ezvid for screen capture and recording
   • CVMware vSphere Hypervisor for virtualization, Riverbed Modeler for network simulation, and Genie Backup Manager Pro for OS backup and imaging
   • DVirtual Box for virtualization, NetSim for network simulation, and Snagit for screen capture and recording

   Show answer

   Answer: D

   Next question

2. Question 582 · 647 in bank

   A digital forensic investigator examines a Windows system to identify suspicious activity related to a recent cyber incident. She has collected volatile and non-volatile registry hives for analysis. The investigator has noticed modifications in a user's profile settings, including changes in desktop wallpaper and screen colors. Which hive and component cells in the registry should she examine more closely for further evidence of user-specific activity?

   • AExamine HKEY_CLASSES_ROOT; focus on security descriptor cells and value cells
   • BExamine HKEY_LOCAI MACHINE; focus on value cells and subkey list cells
   • CExamine HKEY_CURRENT_CONFIG: focus on subkey list cells and value cells
   • DExamine HKEY_CURRENT_USER; focus on key cells and value list cells

   Show answer

   Answer: D

   Next question

3. Question 583 · 647 in bank

   An investigator is examining a compromised system and comes across some files that have been compressed with a packer. The investigator knows that these files contain malicious content, but cannot access them due to a password protection mechanism. The investigator does not have the password. Which approach is the most suitable for accessing the contents of the packed files?

   • AThe investigator should attempt static analysis on the packed file
   • BThe investigator should run the packed executable in a controlled environment for dynamic analysis
   • CThe investigator should attempt to crack the password using a brute force attack
   • DThe investigator should attempt to reverse engineer the packed file in an attempt to bypass password protection

   Show answer

   Answer: B

   Next question

4. Question 584 · 647 in bank

   A digital forensics lab is working on a high-profile cybercrime case. The director has decided to include a new team member in the investigation team for his specialized expertise. Which of the following considerations should be considered in the context of maintaining the lab’s integrity, based on the given information?

   • AThe new team member should be directly handed the original hardware containing the evidence
   • BThe new team member should be allowed to bring his own hardware and software tools to the lab for investigation
   • CThe new team member should be given immediate access to the lab without maintaining a visitor's log register
   • DThe new team member should be provided with an electronic sign-in pass, and his entry should be logged in the register

   Show answer

   Answer: D

   Next question

5. Question 585 · 647 in bank

   A forensic investigator encounters a suspicious executable on a compromised system, believed to be packed using a known program packer, and is password-protected. The investigator has knowledge of the tool used for packing and has the corresponding unpacking tool. What should be the next best course of action to examine the executable?

   • AUse the unpacking tool to decompress the executable, without dealing with the password
   • BRun a dynamic analysis on the packed executable in a controlled environment
   • CDecrypt the password to unpack the executable before analyzing
   • DUse reverse engineering to understand the attack tool hidden inside

   Show answer

   Answer: C

   Next question

6. Question 586 · 647 in bank

   In a cyber-forensic investigation, a CHFI expert found a Linux system unexpectedly booting into a different OS kernel. The system was configured with the Grand Unified Bootloader (GRUB). The expert suspects that an attacker may have tampered with the bootloader stage of the Linux boot process. Which one of the following is NOT a step performed during the bootloader stage in a normal Linux boot process?

   • AExecution of the Linuxrc program to generate the real file system for the kernel
   • BDetecting the device that contains the file system and loading the necessary modules
   • CLoading the kernel into memory
   • DLoading the Linux kernel and optional initial RAM disk

   Show answer

   Answer: A

   Next question

7. Question 587 · 647 in bank

   In a forensic investigation on an Android device, a Computer Hacking Forensics Investigator is required to extract information from the SQLite database. They aim to recover the user's web browsing history. Which is the correct SQLite database path that the investigator should focus on?

   • A\data\com.android.providers.calendar\databases\calendar.db
   • B\data\data\com.android.browser\databases\browser2.db
   • C\data\data\com.android.providers.telephony\databases\mmssms.db
   • D\data\data\com.android.providers.contacts\databases\contacts2.db

   Show answer

   Answer: B

   Next question

8. Question 588 · 647 in bank

   After an unexpected shutdown of a company's database server, the IT forensics team is tasked with collecting data from the Database Plan Cache to investigate potential issues. What query should they use to retrieve the SQL text of all cached entries and acquire additional aggregate performance statistics?

   • AUse: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_plan_attributes(plan_handle) followed by: select * from sys.dm_exec_query_stats
   • BUse: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_sql_text(plan_handle) followed by: select * from sys.dm_exec_plan_attributes(plan_handle)
   • CUse: select * from sys.dm_exec_sql_text(plan_handle) cross apply sys.dm_exec_cached_plans followed by: select * from sys.dm_exec_query_stats
   • DUse: select * from sys.dm_exec_cached_plans cross apply sys.dm_exec_sql_text(plan_handle) followed by: select * from sys.dm_exec_query_stats

   Show answer

   Answer: D

   Next question

9. Question 589 · 647 in bank

   During a recent network intrusion investigation, a CHFI received logs from Juniper IDS, Check Point IPS, and a Kippo Honeypot. Which log provides information about the network traffic and bandwidth adjustment, aiding in business risk valuation?

   • AKippo Honeypot
   • BJuniper IDS
   • CNone of the above
   • DCheck Point IPS

   Show answer

   Answer: D

   Next question

10. Question 590 · 647 in bank

    In a situation where an investigator needs to acquire volatile data from a live Linux system, the physical access to the suspect machine is either restricted or unavailable. Which of the following steps will be the most suitable approach to perform this task?

    • AThe investigator should use the Belkasoft Live RAM Capturer on the forensic workstation, then remotely execute the tool on the suspect machine to acquire the RAM image
    • BThe investigator should initiate a listening session on the forensic workstation using 'netcat', then execute a 'dd' command on the suspect machine and pipe the output using 'netcat'
    • CThe investigator should leverage OSXPMem to remotely parse the physical memory in the Linux machine and create AFF4 format images for analysis
    • DThe investigator should employ the LiME tool and 'netcat', starting a listening session using tcp:port on the suspect machine and then establishing a connection from the forensic workstation using 'netcat'

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 581. 647 questions available.