1. Home
  2. EC-COUNCIL
  3. 312-49

ECCouncil Computer Hacking Forensic Investigator (V9)

Exam Details

  • Exam Code
    :312-49
  • Exam Name
    :ECCouncil Computer Hacking Forensic Investigator (V9)
  • Certification
    :EC-COUNCIL Certifications
  • Vendor
    :EC-COUNCIL
  • Total Questions
    :531 Q&As
  • Last Updated
    :Apr 11, 2025

EC-COUNCIL EC-COUNCIL Certifications 312-49 Questions & Answers

  • Question 471:

    What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

    A. forensic duplication of hard drive

    B. analysis of volatile data

    C. comparison of MD5 checksums

    D. review of SIDs in the Registry

  • Question 472:

    You should make at least how many bit-stream copies of a suspect drive?

    A. 1

    B. 2

    C. 3

    D. 4

  • Question 473:

    Why should you note all cable connections for a computer you want to seize as evidence?

    A. to know what outside connections existed

    B. in case other devices were connected

    C. to know what peripheral devices exist

    D. to know what hardware existed

  • Question 474:

    What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?

    A. ICMP header field

    B. TCP header field

    C. IP header field

    D. UDP header field

  • Question 475:

    Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?

    A. network-based IDS systems (NIDS)

    B. host-based IDS systems (HIDS)

    C. anomaly detection

    D. signature recognition

  • Question 476:

    Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.

    Which organization coordinates computer crimes investigations throughout the United States?

    A. Internet Fraud Complaint Center

    B. Local or national office of the U.S. Secret Service

    C. National Infrastructure Protection Center

    D. CERT Coordination Center

  • Question 477:

    Which of the following should a computer forensics lab used for investigations have?

    A. isolation

    B. restricted access

    C. open access

    D. an entry log

  • Question 478:

    Sectors in hard disks typically contain how many bytes?

    A. 256

    B. 512

    C. 1024

    D. 2048

  • Question 479:

    Area density refers to:

    A. the amount of data per disk

    B. the amount of data per partition

    C. the amount of data per square inch

    D. the amount of data per platter

  • Question 480:

    Corporate investigations are typically easier than public investigations because:

    A. the users have standard corporate equipment and software

    B. the investigator does not have to get a warrant

    C. the investigator has to get a warrant

    D. the users can load whatever they want on their machines

Related Exams:

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only EC-COUNCIL exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your 312-49 exam preparations and EC-COUNCIL certification application, do not hesitate to visit our Vcedump.com to find your solutions here.