312-49 practice questions 641–647

1. Question 641 · 647 in bank

   In the middle of a high-pressure cybercrime investigation, you stumble upon a cryptic message. It appears to be encoded with the ASCII standard. The encrypted message contains a combination of lower ASCII and higher ASCII codes. Which statement is the most accurate concerning the interpretation of this message?

   • AThe lower ASCII codes refer to non-printable system codes, while the higher ASCII codes represent alphanumeric characters and punctuation
   • BBoth lower and higher ASCII codes primarily contain alphanumeric characters and punctuation
   • CASCII codes at the lower end represent alphanumeric characters and punctuation. On the other hand, those at the higher end are typically used to denote non-printable system codes
   • DThe lower ASCII codes represent basic alphanumeric characters and punctuation, while the higher ASCII codes are generally used for graphics and non-ASCII characters in documents

   Show answer

   Answer: D

   Next question

2. Question 642 · 647 in bank

   A Computer Hacking Forensic Investigator (CHFI) arrives at the crime scene in an incident involving cybercrime. While performing the initial search of the scene, the investigator spots a GPS device, a keyboard, and a telephone line connected to a caller ID box. Considering the steps involved in searching for evidence, which of the following actions should the investigator perform first?

   • ASecure the keyboard to protect any potential fingerprints
   • BInitiate the search and seizure evidence log to document details of the identified devices
   • CRecord observations about the current situation at the scene
   • DSurvey the GPS device to explore potential sources of digital information

   Show answer

   Answer: A

   Next question

3. Question 643 · 647 in bank

   A CHFI professional is investigating a data breach in a Windows 10 system. The initial analysis revealed some alterations in the system event logs. As part of the investigation, the professional uses the ‘wevtutil’ command-line tool. The command ‘wevtutil gl Security’ was executed, but the results seemed abnormal. Which of the following could be a plausible reason for this outcome?

   • AThe command ‘wevtutil gl Security’ does not exist in the ‘wevtutil’ command set
   • BThe ‘wevtutil’ command cannot retrieve data from XML-based EVTX file format
   • CThe Event Log service was temporarily unresponsive or down
   • DThe EVTX file storing the Security log was corrupted or tampered with

   Show answer

   Answer: D

   Next question

4. Question 644 · 647 in bank

   In a computer forensics investigation, an investigator is dealing with a system that has been recently shut down. The data they need is of a non-volatile nature. Which type of data acquisition methodology should the investigator adopt in this scenario and why?

   • AThe investigator should not perform any data acquisition as the system is already powered off
   • BThe investigator should use either live or dead data acquisition as both methods can collect non-volatile data from the system
   • CThe investigator should use live data acquisition since it is intended to capture dynamic data from the computer's memory, caches, and registries
   • DThe investigator should use dead data acquisition because it is designed to collect unaltered data from storage devices such as hard drives and USB thumb drives

   Show answer

   Answer: D

   Next question

5. Question 645 · 647 in bank

   A CHFI has been asked to recover browser history from a seized Microsoft Edge browser on a Windows system. This is important to pinpoint the suspect's online activities. The suspect was known to clear their browser history frequently. Which tool and path would most efficiently recover the required data?

   • AMZCacheView tool; Path: C:\UsersWAppData\Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\cache2
   • BMZHistoryView tool; Path: C:\UsersWAppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\places.sqlite
   • CBrowsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\History
   • DBrowsing HistoryView tool; Path: C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache

   Show answer

   Answer: D

   Next question

6. Question 646 · 647 in bank

   During an investigation, a forensics analyst discovers an unusual increase in outbound network traffic, network traffic traversing on non-standard ports, and multiple failed login attempts on a host system. The analyst also found that certain programs were using these unusual ports, appearing to be legitimate. If these are the primary Indicators of Compromise, what should be the next immediate step in the investigation to contain the intrusion effectively?

   • AEnforcing stringent password policies and re-authenticating all users to prevent further login anomalies
   • BExamining the logs for repeated requests for the same file, indicating a possible exploit attempt
   • CAnalyzing Uniform Resource Locators for any signs of phishing or spamming activities
   • DConducting a deep dive into user-agent strings to determine if there is any spoofing of device OS and browser information

   Show answer

   Answer: B

   Next question

7. Question 647 · 647 in bank

   A forensics investigator is studying the Event ID logs on a domain controller for a corporation, following a suspected security breach. He notices that a domain user account was created, then modified, and then added to a group in a very short span of time. The investigator realizes that he must cross-verify the audit policies on the local system to understand if any changes were made to it. Assuming that the investigator has the correct audit policy settings, which of the following Event IDs should he focus on?

   • AEvent ID 642
   • BEvent ID 644
   • CEvent ID 624
   • DEvent ID 612

   Show answer

   Answer: C

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 641. 647 questions available.