최신EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v11) - 312-49v11무료샘플문제
문제1
Lucas, a forensic investigator, has been tasked with analyzing the behavior of a malware sample that has infected a Linux-based system. After executing the malware, Lucas suspects that the malware is performing suspicious activities such as modifying system files, accessing restricted resources, and interacting with the kernel. In order to track the malware's interaction with the operating system, Lucas decides to monitor the system calls made by the malware during its execution. To gather this data, which of the following tools should Lucas use to effectively track and analyze the system calls initiated by the malware, providing insights into how the malware communicates with the OS and performs its malicious activities?
Lucas, a forensic investigator, has been tasked with analyzing the behavior of a malware sample that has infected a Linux-based system. After executing the malware, Lucas suspects that the malware is performing suspicious activities such as modifying system files, accessing restricted resources, and interacting with the kernel. In order to track the malware's interaction with the operating system, Lucas decides to monitor the system calls made by the malware during its execution. To gather this data, which of the following tools should Lucas use to effectively track and analyze the system calls initiated by the malware, providing insights into how the malware communicates with the OS and performs its malicious activities?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제2
During a forensic investigation, Robert discovers that the attacker modified the file extensions of certain malicious files to make them appear benign. These files were originally executable but had their extensions changed to disguise their true nature. Robert needs to identify and extract these files despite their misleading extensions. Which of the following tools can help Robert detect file extension mismatches and recover the actual file types during the investigation?
During a forensic investigation, Robert discovers that the attacker modified the file extensions of certain malicious files to make them appear benign. These files were originally executable but had their extensions changed to disguise their true nature. Robert needs to identify and extract these files despite their misleading extensions. Which of the following tools can help Robert detect file extension mismatches and recover the actual file types during the investigation?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제3
Detective Patel is investigating a cross-border cybercrime that impacted victims in the United States and Europe. To obtain timely evidence and coordinate actions across jurisdictions, which primary function of international agencies is most critical in this scenario?
Detective Patel is investigating a cross-border cybercrime that impacted victims in the United States and Europe. To obtain timely evidence and coordinate actions across jurisdictions, which primary function of international agencies is most critical in this scenario?
정답: B
설명: (ITDumpsKR 회원만 볼 수 있음)
문제4
Tom, a digital forensics investigator, is assigned to investigate a potential insider threat at a company. He arrives at the scene to find that a workstation has been compromised. The suspect, a former employee, allegedly used a malicious USB device to access sensitive files before being caught. Tom quickly begins his investigation, and after isolating the workstation from the network, he powers up the system in a controlled environment. His first task is to collect data stored in the system's memory, including active processes, network connections, and clipboard content. Tom knows that this type of data can provide critical information about the actions of the suspect during the time of the attack. Why is Tom prioritizing this data over other types of evidence in this case?
Tom, a digital forensics investigator, is assigned to investigate a potential insider threat at a company. He arrives at the scene to find that a workstation has been compromised. The suspect, a former employee, allegedly used a malicious USB device to access sensitive files before being caught. Tom quickly begins his investigation, and after isolating the workstation from the network, he powers up the system in a controlled environment. His first task is to collect data stored in the system's memory, including active processes, network connections, and clipboard content. Tom knows that this type of data can provide critical information about the actions of the suspect during the time of the attack. Why is Tom prioritizing this data over other types of evidence in this case?
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제5
During an after-hours breach at a Boston data center, an on-duty responder is concerned about preserving in-memory runtime information (e.g., active process state, session data, and encryption material) for later analysis. Which action would most jeopardize preservation of this information?
During an after-hours breach at a Boston data center, an on-duty responder is concerned about preserving in-memory runtime information (e.g., active process state, session data, and encryption material) for later analysis. Which action would most jeopardize preservation of this information?
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제6
Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?
Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?
정답: C
문제7
Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?
Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?
정답: C
문제8
During a data breach investigation at a financial firm in Houston, forensic examiners analyze an event log file to determine its integrity status after a system crash. The log indicates that records were written but the file was not properly closed, suggesting potential corruption. Which flag in the ELF_LOGFILE_HEADER structure reflects this condition of uncommitted changes?
During a data breach investigation at a financial firm in Houston, forensic examiners analyze an event log file to determine its integrity status after a system crash. The log indicates that records were written but the file was not properly closed, suggesting potential corruption. Which flag in the ELF_LOGFILE_HEADER structure reflects this condition of uncommitted changes?
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)