01. Which Internet standard extends the email message format so that a single message can carry non-ASCII content, such as video, graphics and audio attachments, as separate parts each labeled with a content type?
a) BinHex
b) Uuencode
c) MIME
d) UTF-16
02. Brian analyzes malware for a software security company. He has set up a virtual environment of virtual machines running various operating system versions, divided into separate virtual networks. The environment connects neither to the company intranet nor to the Internet.
Brian receives an executable from a client that suffered a cyberattack and runs it inside the virtual environment to see what it does.
What type of analysis did Brian perform?
a) Malware disassembly
b) Dynamic malware analysis
c) Static malware analysis
d) Static OS analysis
03. On a Windows 10 system, an investigator examines a browser in its original (pre-Chromium) version.
Which browser stored its browsing records, including history, cache and cookies, in an Extensible Storage Engine (ESE) database?
a) Google Chrome
b) Safari
c) Mozilla Firefox
d) Microsoft Edge
04. Which SWGDE Standards and Criteria item states that "the agency must use hardware and software that are appropriate and effective for the seizure or examination procedure"?
a) Standards and Criteria 1.5
b) Standards and Criteria 1.6
c) Standards and Criteria 1.4
d) Standards and Criteria 1.7
05. Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders gained access through the company firewalls by overloading them with IP packets. She then finds that the intruders hacked into the company phone system and used the hard drives in its PBX system to store shared music files.
What is this attack on the company PBX system called?
a) Pretexting
b) Phreaking
c) Crunching
d) Squatting
06. Tyler is setting up a wireless network for the business he runs from his home. He has followed all the directions from his ISP and the wireless router manual. He has not set any encryption, and the SSID is being broadcast.
His laptop picks up the wireless signal for short periods, then the connection drops and the signal disappears. The signal eventually returns but keeps dropping intermittently.
What is the most likely cause of Tyler's problem?
a) 2.4 GHz cordless phones
b) Satellite television
c) Computers on his wired network
d) CB radio
07. A law enforcement officer may search for and seize criminal evidence only when facts and circumstances would lead a reasonable person to believe that a crime has been or is about to be committed, that evidence of that specific crime exists, and that the evidence is at the place to be searched.
What is this legal standard called?
a) Mere suspicion
b) A preponderance of the evidence
c) Beyond a reasonable doubt
d) Probable cause
08. During a forensic investigation, a large number of files were collected. The investigator needs to establish ownership and accountability for them, so he examines attributes such as author name, organization name, network name and other data embedded for identification.
Which term describes these attributes?
a) Metadata
b) Metabase
c) Data index
d) Data header
09. Which directory on a Linux system contains the binaries required for system maintenance and administrative tasks?
a) /bin
b) /lib
c) /sbin
d) /usr
10. Your company uses Cisco routers throughout its network. An outside security firm was able to enumerate the model, IOS version and capabilities of every router with very little effort, simply by passively capturing the Layer 2 advertisements the routers send to directly connected devices.
Which feature should you disable to eliminate this exposure?
a) Border Gateway Protocol
b) Simple Network Management Protocol
c) Hot Standby Router Protocol
d) Cisco Discovery Protocol
The purpose of this Sample Question Set is to provide you with information about the EC-Council Computer Hacking Forensic Investigator exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 312-49 certification test. To get familiar with real exam environment, we suggest you try our Sample EC-Council CHFI Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual EC-Council Computer Hacking Forensic Investigator (CHFI) certification exam.
