Eccouncil Chfi 312-49 Hacking Forensic Investigator Exam

Requirements

• Any one who want to do ECCouncil CHFI 312-49 Hacking Forensic Investigator Exam

Description

Sample Questions

Q) When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

a) All virtual mempry will be deleted

b) The wrong partition may be set to active

c) This action can corrupt the disk

d) The computer will be set in a constant reboot state

Q) If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?

a) Keep the device powered on

b) Turn off the device immediately

c) Remove the battery immediately

d) Remove any memory cards immediately

Q) When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

a) One

b) Two

c) Three

d) Four

Q) A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

a) Searching for evidence themselves would not have any ill effects

b) Searching could possibly crash the machine or device

c) Searching creates cache files, which would hinder the investigation

d) Searching can change date/time stamps

Author(s): Mind Link Technology

Source: Udemy.com