312-49v10 Free Practice Test

- (Exam Topic 3)
Select the data that a virtual memory would store in a Windows-based system.

1. A. Information or metadata of the files
2. B. Documents and other files
3. C. Application data
4. D. Running processes

Correct Answer: D

- (Exam Topic 3)
Which tool allows dumping the contents of process memory without stopping the process?

1. A. psdump.exe
2. B. pmdump.exe
3. C. processdump.exe
4. D. pdump.exe

Correct Answer: B

- (Exam Topic 1)
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

1. A. A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
2. B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
3. C. A simple DOS copy will not include deleted files, file slack and other information
4. D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

Correct Answer: C

- (Exam Topic 3)
As part of extracting the system data, Jenifer has used the netstat command. What does this tool reveal?

1. A. Status of users connected to the internet
2. B. Net status of computer usage
3. C. Information about network connections
4. D. Status of network hardware

Correct Answer: C

- (Exam Topic 3)
To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https. Which of the following firewall rules meets this requirement?

1. A. if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit
2. B. if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 80 or 443) then permit
3. C. if (source matches 10.10.10.0 and destination matches 10.20.20.1 and port matches 443) then permit

Correct Answer: A