FREE CHFI (312-49) Questions and Answers

Question 1

The Inspect Pane can be used to view the file content of evidence files.
To display file content, the View pane offers a number of tabs.
Which of these tabs offers native views of the formats that Oracle supports outside of its own technology?

Accepted Answer

Doc tab

Answer

Text tab

Answer

Hex tab

Answer

Picture tab

Question 2

You can access and examine a large portion of the Registry's data during live response, and all of it during post-mortem analysis. Which registry Hive in the system stores configuration data connected to the software that is used to open different file types?

Accepted Answer

HKEY_CLASSES_ROOT

Answer

HKEY_CURRENT_CONFIG

Answer

HKEY_USERS

Answer

HKEY_CURRENT_USER

Question 3

Which of the following is a hard disk's smallest allocation unit? Depending on the formatting system, a hard disk can have anywhere between 2 and 32 tracks and sectors.

Accepted Answer

Cluster

Answer

Sector

Answer

4Platter

Answer

Track

Question 4

The gathering, evaluation, and reporting of evidence are standard investigation procedures that are automated and streamlined using Source Processor. Which of these source processor modules can access the target computer's disks and memory?

Accepted Answer

Acquisition Module

Answer

Personal Information Module

Answer

File Processor Module

Answer

Internet Artifacts Module

Question 5

Which of these attack methods combines a dictionary attack and a brute-force attack to break a password?

Accepted Answer

Hybrid Attack

Answer

Rule-based Attack

Answer

Fusion Attack

Answer

Syllable Attack

Question 6

Computer forensic investigator Carlo is. He was given an assignment by a company to look into a forensic case. The computer at the crime site was turned off when Carlo arrived at the company to investigate the location. What do you think Carlo ought to do in this situation?

Accepted Answer

He should leave the computer off

Answer

He should turn on the computer

Answer

He should turn on the computer and should start analyzing it

Answer

He should turn on the computer and extract the data

Question 7

The link between the four panes of the EnCase interface reflects the cyclical nature of the process of reviewing obtained evidence. Which of the following panes displays an organized view of all acquired evidence in a folder hierarchy similar to Windows?

Accepted Answer

Tree pane

Answer

Filter Pane

Answer

Table Pane

Answer

View Pane