Free Computer Hacking Forensic Investigator 312-49 Exam Practice Test

A computer forensics Investigator or forensic analyst Is a specially trained professional who works with law enforcement as well as private businesses to retrieve Information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer. Which of the following is not a duty of the analyst during a criminal investigation?

• To create an investigation report
• To fill the chain of custody
• To recover data from suspect devices
• To enforce the security of all devices and software in the scene

You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab?

• make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
• make an MD5 hash of the evidence and compare it to the standard database developed by NIST
• there is no reason to worry about this possible claim because state labs are certified
• sign a statement attesting that the evidence is the same as it was when it entered the lab

You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?

• The X509 Address
• The SMTP reply Address
• The E-mail Header
• The Host Domain Name

An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the team have to respond to the incident?

• One working day
• Two working days
• Immediately
• Four hours

The investigator wants to examine changes made to the system's registry by the suspect program. Which of the following tool can help the investigator?

• TRIPWIRE
• RAM Capturer
• Regshot
• What's Running

Which of the following is a part of a Solid-State Drive (SSD)?

• Head
• Cylinder
• NAND-based flash memory
• Spindle

Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?

• Parameter/form tampering
• Unvalidated input
• Directory traversal
• Security misconfiguration

Steve, a forensic investigator, was asked to investigate an email incident in his organization. The organization has Microsoft Exchange Server deployed for email communications. Which among the following files will Steve check to analyze message headers, message text, and standard attachments?

• PUB.EDB
• PRIV.EDB
• PUB.STM
• PRIV.STM

If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?

• The zombie will not send a response
• 31402
• 31399
• 31401

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

• rules of evidence
• law of probability
• chain of custody
• policy of separation