Free 312-49v11 Sample Questions and 100% Cover Real Exam Questions (Updated 637 Questions) [Q290-Q310]

Q290. Jeff is a forensics investigator for a government agency’s cyber security office. Jeff Is tasked with acquiring a memory dump of a Windows 10 computer that was involved In a DDoS attack on the government agency’s web application. Jeff is onsite to collect the memory. What tool could Jeff use?

Q291. Which among the following acts has been passed by the U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?

Q292. A Computer Hacking Forensics Investigator (CHFI) has been asked to retrieve specific email files from a large RAID server after a data breach. Additionally, fragments of unallocated (deleted) data are also required. However, there is a severe constraint on time and resources. Considering these requirements, which type of data acquisition should the investigator primarily focus on?

Q293. Edgar is part of the FBI’s forensic media and malware analysis team; he is analyzing a current malware and is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar’s approach is to execute the malware code to know how it interacts with the host system and its impacts on it. He is also using a virtual machine and a sandbox environment. What type of malware analysis is Edgar performing?

Q294. Sophia, a forensic investigator, has been working on a significant corporate data theft case. The suspect, an IT employee, allegedly downloaded hundreds of confidential files onto his laptop before resigning abruptly. Sophia obtained a search and seizure warrant, and during the execution, she found the suspect’s laptop, a desktop computer, and several storage devices. To ensure she maintains the chain of custody and abides by the ACPO principles of digital evidence, what should be her next step?

Q295. Jessica is conducting a forensic analysis on a Windows machine suspected of being involved in data exfiltration. She wants to identify any suspicious login attempts and track the number of failed login attempts to see if a brute-force attack was attempted. Which of the following event IDs will provide this information?

Q296. Which of the following statements is incorrect when preserving digital evidence?

Q297. Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

Q298. As a Computer Hacking Forensic Investigator, you ‘ re working on a case involving the unauthorized alteration of financial records within a major bank. The network administrators have identified a specific terminal where they believe the alterations originated. You have been tasked with examining this workstation.
The administrators inform you that the machine has been powered down for fear of further alterations. In this scenario, which of the following would be your first step?

Q299. Which of the following is not a part of disk imaging tool requirements?

Q300. During a coordinated investigation in Miami, agents track a darknet marketplace operator whose infrastructure spans multiple countries and hosting providers. Mutual legal assistance requests stall, and prosecutors warn that conflicting national rules may block timely access to records needed for attribution and seizure. What factor most directly accounts for this obstruction in accessing required records?

Q301. A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at
/System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?

Q302. During a corporate cyber espionage case in Austin, Texas, forensic investigators analyze how the company’s storage systems were accessed during exfiltration. They discover that attackers mapped a shared folder accessible via SMB protocol from multiple departments, while critical databases remained on a separate high-speed Fibre Channel storage fabric. Which storage model does the shared folder system represent?

Q303. During a malware investigation on a Linux server in Phoenix, investigators suspect that the malicious process is making frequent system calls to access protected resources. To analyze this behavior, they decide to trace and log the system calls made by the process. Which strace command provides a summary count of time, calls, and errors for each system call?

Q304. During a phishing response at a banking call center in North Carolina, the team receives an Excel spreadsheet that opens cleanly but is suspected of concealing macro logic. Before any macro code extraction, which command should investigators run to list the OLE streams and identify which stream(s) contain macros (flagged with an uppercase “M”)?

Q305. Emily, a network security analyst, is reviewing the logs generated by a Cisco firewall after a suspected attack on the company’s network. She encounters a log message related to a connection attempt that seems suspicious. The log shows an entry with mnemonic 106022.
Based on the firewall’s logging patterns, which of the following best describes the log message Emily found?

Q306. Liam, a digital forensic investigator, is examining evidence from a cyber-attack that targeted a Linux-based system. While analyzing the system, he discovers that several files are missing. Upon further inspection, he notices that a particular executable file, which had been running at the time of the attack, erased its own content, making recovery more challenging. To recover the lost file, Liam needs to identify the correct command in Linux that would help him retrieve the file. Which of the following commands should Liam use to recover the lost file on the Linux system?

Q307. A file requires 10 KB space to be saved on a hard disk partition. An entire cluster of 32 KB has been allocated for this file. The remaining, unused space of 22 KB on this cluster will be identified as ____________.

Q308. Forensic Investigator Patel is analyzing network traffic related to a cyber-attack. The traffic was routed through the Tor network, making it challenging to trace the origin of malicious activities. During the investigation, Patel identifies suspicious traffic leaving the Tor network through a specific relay. In the investigation, which type of Tor relay is most likely to face legal scrutiny and complaints due to its visibility to destination servers, even if it is not the origin of malicious traffic?

Q309. Jason discovered a file named $RIYG6VR.doc in the C:$Recycle.Bin<USER SID> while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?

Q310. In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.