EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v11) - 312-49v11 模擬練習
In a Filesystem Hierarchy Standard (FHS), which of the following directories contains the binary files required for working?
正解: D
In a complex cybercrime investigation, forensic experts encounter a severely fragmented hard drive that lacks usable file system metadata. By employing advanced file carving techniques, they successfully recover crucial evidence hidden by a suspect who deliberately manipulated file extensions to obfuscate data.
What advanced method do forensic investigators employ to recover hidden files from a fragmented hard drive lacking file system metadata?
What advanced method do forensic investigators employ to recover hidden files from a fragmented hard drive lacking file system metadata?
正解: B
解説: (PassTest メンバーにのみ表示されます)
A CHFI professional is investigating a data breach in a Windows 10 system. The initial analysis revealed some alterations in the system event logs. As part of the investigation, the professional uses the 'wevtutil' command-line tool. The command 'wevtutil gl Security' was executed, but the results seemed abnormal. Which of the following could be a plausible reason for this outcome?
正解: A
解説: (PassTest メンバーにのみ表示されます)
During a forensic investigation into a recent security incident within an organization, the investigator is tasked with documenting every action taken with the evidence to ensure proper chain of custody. The investigator carefully documents every action taken with the evidence in a logbook. The evidence is tagged with unique identifiers to prevent confusion. A detailed chain of custody record is also created to track the evidence's movement and handling throughout the investigation. Which investigation step is the investigator performing in this scenario?
正解: A
解説: (PassTest メンバーにのみ表示されます)
Rachel, a forensic investigator, is examining a network-attached storage (NAS) device to recover files from a shared storage system used by a company. She needs to understand how files are being accessed and shared across different users. Which of the following file-sharing protocols should Rachel examine to understand how the files are accessed in this environment?
正解: A
解説: (PassTest メンバーにのみ表示されます)
"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?
正解: A
Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?
正解: C
Which of the following is considered as the starting point of a database and stores user data and database objects in an MS SQL server?
正解: D
"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?
正解: D
Edward, an experienced CHFI professional, was conducting an investigation into potential intellectual property theft at a major corporation. The company had identified the suspected system, and Edward was tasked with collecting data. Given the high-stakes nature of the investigation, Edward needed to ensure that the collected data was forensically sound, maintained its integrity, and could withstand scrutiny in a court of law. To accomplish this, which rule of thumb for data acquisition should Edward adhere to?
正解: C
解説: (PassTest メンバーにのみ表示されます)
An organization investigates a series of cyberattacks that seem to originate from a prominent hacker collective. The attacks appear highly coordinated and use advanced malware, with command-and-control infrastructure resembling that of an organization with a specific geopolitical agenda. However, investigators suspect the attackers might be using tools to mimic the collective's established tactics and obscure their true identity. Which attribution challenge is the organization most likely facing?
正解: C
解説: (PassTest メンバーにのみ表示されます)
In the wake of a cyberattack, a large e-commerce platform experiences widespread system downtime, leading to significant financial losses and tarnished customer trust. As they scramble to regain control, it becomes evident that sensitive customer data has been compromised, posing a threat to data security and the platform's reputation. Amidst the aftermath of the cyberattack on the e-commerce platform, which of the following consequences is not the result of a lack of forensic readiness?
正解: D
解説: (PassTest メンバーにのみ表示されます)
As a malware analyst, you're tasked with scrutinizing a suspicious program on a Windows workstation, particularly focusing on its interactions with system registry files. Monitoring registry artifacts provides insights into malware behavior, aiding in identifying persistence mechanisms and malicious activities. How do forensic investigators gain insights into malware behavior on Windows systems by monitoring registry artifacts?
正解: A
解説: (PassTest メンバーにのみ表示されます)