検証済み312-49v11問題集と解答で2025年最新の312-49v11をダウンロード [Q45-Q65]

検証済み312-49v11問題集と解答で2025年最新の312-49v11をダウンロード

更新された100%カバー率リアル312-49v11試験問題で100%合格保証付いてます

質問 # 45
What feature of Windows is the following command trying to utilize?

A. Slack file
B. AFS
C. White space
D. ADS

正解：D

質問 # 46
An investigator has extracted the device descriptor for a 1GB thumb drive that looks like:
Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the "Geek_Squad" part represent?

A. Software or OS used
B. Manufacturer Details
C. Developer description
D. Product description

正解：D

質問 # 47
When collecting evidence from the RAM, where do you look for data?

A. SAM file
B. Swap file
C. Log file
D. Data file

正解：B

質問 # 48
Consider the scenario where a large multinational corporation suspects an internal security breach, with significant data possibly compromised. The corporate forensic team initiates the process of conducting a comprehensive forensic investigation following the search and seizure protocols. During this process, they want to ensure they capture all the required information and minimize disruption to the company's ongoing business operations. Which among the following activities should NOT be a part of their plan for this search and seizure operation?

A. Requesting a warrant for search and seizure detailing the exact locations and types of evidence expected to be found
B. Generating a comprehensive list of all potentially involved devices along with their specifications, status, and locations
C. Obtaining formal written consent from the company's owner before beginning the investigation process
D. Carrying out all search and seizure activities without seeking witness signatures for the activities performed

正解：D

質問 # 49
What is the default IIS log location?

A. SystemDrive\inetpub\LogFiles
B. %SystemDrive%\inetpub\logs\LogFiles
C. SystemDrive\logs\LogFiles
D. %SystemDrive\logs\LogFiles

正解：B

質問 # 50
In an echo data hiding technique, the secret message is embedded into a __________as an echo.

A. Cover audio signal
B. Pseudo- spectrum signal
C. Pseudo-random signal
D. Phase spectrum of a digital signal

正解：A

質問 # 51
This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.

A. Expert testimony
B. Civil litigation testimony
C. Technical testimony
D. Victim advocate testimony

正解：C

質問 # 52
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

A. A simple DOS copy will not include deleted files, file slack and other information
B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
C. A disk imaging tool would check for CRC32s for internal self checking and validation and have MD5 checksum
D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

正解：A

質問 # 53
SO/IEC 17025 is an accreditation for which of the following:

A. Chain of custody
B. Encryption
C. Forensics lab licensing
D. CHFI issuing agency

正解：C

質問 # 54
What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

A. Restore point interval
B. Automatically created restore points
C. Restore point functions
D. System CheckPoints required for restoring

正解：D

質問 # 55
Which of the following data structures stores attributes of a process, as well as pointers to other attributes and data structures?

A. EProcess
B. Lsproc
C. RegEdit
D. DumpChk

正解：A

質問 # 56
An image is an artifact that reproduces the likeness of some subject. These are produced by optical devices (i.e. cameras, mirrors, lenses, telescopes, and microscopes).
Which property of the image shows you the number of colors available for each pixel in an image?

A. Pixel
B. Image File Size
C. Bit Depth
D. File Formats

正解：C

質問 # 57
Forensic Investigator Alex has to collect data from a suspect's large drive in a time-bound investigation. The court would allow him to retain the original drive. Considering these factors, what should be Alex's primary considerations to ensure a forensically sound data acquisition?

A. Using Microsoft disk compression tools and validating the data acquisition process
B. Utilizing lossless compression tools and creating a bit-stream copy using a reliable acquisition tool
C. Enabling write protection on the evidence media and prioritizing data acquisition based on evidentiary value
D. Sanitizing the target media using the (German) VSITR method and acquiring volatile data

正解：B

質問 # 58
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document.
What is that code called?

A. the Microsoft Virtual Machine Identifier
B. the Globally Unique ID
C. the Personal Application Protocol
D. the Individual ASCII String

正解：B

質問 # 59
What is the following command trying to accomplish?
C:\> nmap -sU -p445 192.168.0.0/24

A. Verify that TCP port 445 is open for the 192.168.0.0 network
B. Verify that UDP port 445 is open for the 192.168.0.0 network
C. Verify that NETBIOS is running for the 192.168.0.0 network
D. Verify that UDP port 445 is closed for the 192.168.0.0 network

正解：B

質問 # 60
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

A. He should search in C:\Windows\System32\RECYCLED folder
B. The files are hidden and he must use switch to view them
C. Only FAT system contains RECYCLED folder and not NTFS
D. The Recycle Bin does not exist on the hard drive

正解：B

質問 # 61
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.

A. Check the Windows registry for connection data (You may or may not recover)
B. Seek the help of co-workers who are eye-witnesses
C. Approach the websites for evidence
D. Image the disk and try to recover deleted files

正解：D

質問 # 62
You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

A. You are not certified for using the tool
B. The tool hasn't been tested by the International Standards Organization (ISO)
C. Only the local law enforcement should use the tool
D. The total has not been reviewed and accepted by your peers

正解：D

質問 # 63
Which rule requires an original recording to be provided to prove the content of a recording?

A. 0
B. 1
C. 2
D. 3

正解：B

質問 # 64
After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?