ECCouncil Computer Hacking Forensic Investigator (V10): All 312-49V10 exam questions have been updated in November. All examination questions have been verified to ensure that they are true and valid!
You can get the complete exam questions and answers in Lead4Pass 312-49V10 dumps https://www.leads4pass.com/312-49v10.html. 312-49V10 dumps contain two modes: PDF and VCE, you can choose any model you like! Guarantee to pass the exam smoothly!
This site provides ECCouncil 312-49V10 online test questions. You can participate in the test to verify your own strength. We will announce the answers at the end of the article. In order to facilitate the study habits of more people, we also shared the ECCouncil 312-49V10 exam PDF. All online content It’s free.
ECCouncil 312-49V10 exam practice questions
QUESTION 1
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from a
Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.
(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection
concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 ->
172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack:
0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=
03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20
DgmLen:84 Len: 64
01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 …………….
00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 …………….
00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 …………….
00 00 00 11 00 00 00 00 ……..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=
03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773
UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104
Len: 1084
47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8 G..c…………
00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20 ……………
3A B1 5E E5 00 00 00 09 6C 6F 63 61 6C 68 6F 73 :.^…..localhost
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=+=+
03/15-20:21:36.539731 211.185.125.124:4450 -> 172.16.1.108:39168
TCP TTL:43 TOS:0x0 ID:31660 IpLen:20 DgmLen:71 DF
***AP*** Seq: 0x9C6D2BFF Ack: 0x59606333 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 23679878 2880015
63 64 20 2F 3B 20 75 6E 61 6D 65 20 2D 61 3B 20 cd /; uname -a;
69 64 3B id;
A. The attacker has conducted a network sweep on port 111
B. The attacker has scanned and exploited the system using Buffer Overflow
C. The attacker has used a Trojan on port 32773
D. The attacker has installed a backdoor
QUESTION 2
Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?
A. pstree
B. pgrep
C. ps
D. grep
Reference: https://askubuntu.com/questions/180336/how-to-find-the-process-id-pid-of-a-running-terminalprogram
QUESTION 3
Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes
pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van
and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation.
Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the
procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should
Michael use when creating copies of the evidence for the investigation?
A. Two
B. One
C. Three
D. Four
QUESTION 4
Madison is on trial for allegedly breaking into her university\\’s internal network. The police raided her dorm room and
seized all of her computer equipment. Madison\\’s lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison\\’s lawyer trying to prove the police violated?
A. The 4th Amendment
B. The 1st Amendment
C. The 10th Amendment
D. The 5th Amendment
QUESTION 5
A law enforcement officer may only search for and seize criminal evidence with _______________________, which are
facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be
committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.
A. Mere Suspicion
B. A preponderance of the evidence
C. Probable cause
D. Beyond a reasonable doubt
QUESTION 6
What is the location of a Protective MBR in a GPT disk layout?
A. Logical Block Address (LBA) 2
B. Logical Block Address (LBA) 0
C. Logical Block Address (LBA) 1
D. Logical Block Address (LBA) 3
QUESTION 7
You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You
conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix
Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are reQuired MCSA desired, MCSE,
CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?
A. Trade secret
B. Social engineering exploit
C. Competitive exploit
D. Information vulnerability
QUESTION 8
Which MySQL log file contains information on server start and stop?
A. Slow query log file
B. General query log file
C. Binary log
D. Error log file
QUESTION 9
On Linux/Unix based Web servers, what privilege should the daemon service be run under?
A. Something other than root
B. Root
C. Guest
D. You cannot determine what privilege runs the daemon service
QUESTION 10
How many possible sequence number combinations are there in TCP/IP protocol?
A. 320 billion
B. 1 billion
C. 4 billion
D. 32 million
QUESTION 11
An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?
A. Security event was monitored but not stopped
B. Malicious URL detected
C. An email marked as potential spam
D. Connection rejected
QUESTION 12
What must be obtained before an investigation is carried out at a location?
A. Search warrant
B. Subpoena
C. Habeas corpus
D. Modus operandi
QUESTION 13
Jason discovered a file named $RIYG6VR.doc in the C:\$Recycle.Bin\\ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?
A. It is a doc file deleted in seventh sequential order
B. RIYG6VR.doc is the name of the doc file deleted from the system
C. It is file deleted from R drive
D. It is a deleted doc file
Verify answer:
Q1 | Q2 | Q3 | Q4 | Q5 | Q6 | Q7 | Q8 | Q9 | Q10 | Q11 | Q12 | Q13 |
A | B | A | A | C | C | D | D | A | C | C | A | D |
ECCouncil 312-49V10 Exam PDF
Google Drive: https://drive.google.com/file/d/1qzW-LCI9htI2zF8Sc5pU5E9iGcw2iFi_/
Above I have shared the practice questions and answers of the ECCouncil 312-49V10 exam, you can check your own strength! Pass the exam successfully for the first time and get the certification of your dreams. You should choose the complete ECCouncil 312-49V10 dumps https://www.leads4pass.com/312-49v10.html.
Guarantee to pass the exam successfully! Enhance your value! Finally, thanks for reading! Like to bookmark and share!