312-49v10 Free Practice Test

- (Exam Topic 4)
Edgar is part of the FBI's forensic media and malware analysis team; he Is analyzing a current malware and Is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar's approach Is to execute the malware code to know how It Interacts with the host system and Its Impacts on It. He is also using a virtual machine and a sandbox environment.
What type of malware analysis is Edgar performing?

1. A. Malware disassembly
2. B. VirusTotal analysis
3. C. Static analysis
4. D. Dynamic malware analysis/behavioral analysis

Correct Answer: D

- (Exam Topic 3)
An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:

1. A. Type Allocation Code (TAC)
2. B. Integrated Circuit Code (ICC)
3. C. Manufacturer Identification Code (MIC)
4. D. Device Origin Code (DOC)

Correct Answer: A

- (Exam Topic 2)
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?

1. A. RestrictAnonymous must be set to "10" for complete security
2. B. RestrictAnonymous must be set to "3" for complete security
3. C. RestrictAnonymous must be set to "2" for complete security
4. D. There is no way to always prevent an anonymous null session from establishing

Correct Answer: C

- (Exam Topic 2)
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:RECYCLED using a command line tool but does not find anything. What is the reason for this?

1. A. He should search in C:\Windows\System32\RECYCLED folder
2. B. The Recycle Bin does not exist on the hard drive
3. C. The files are hidden and he must use switch to view them
4. D. Only FAT system contains RECYCLED folder and not NTFS

Correct Answer: C

- (Exam Topic 1)
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

1. A. rules of evidence
2. B. law of probability
3. C. chain of custody
4. D. policy of separation

Correct Answer: C