無料EC-COUNCIL 312-49v11試験問題と解答トレーニングを提供しています
トップクラスEC-COUNCIL 312-49v11オンライン問題集
質問 # 535
What type of equipment would a forensics investigator store in a StrongHold bag?
- A. Hard drives
- B. Wireless cards
- C. Backup tapes
- D. PDAPDA?
正解：B
質問 # 536
This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.
- A. European Anti-Spam act
- B. Telemarketing act
- C. The CAN-SPAM act
- D. Federal Spam act
正解：C
質問 # 537
Robert, a cloud architect, received a huge bill from the cloud service provider, which usually doesn't happen. After analyzing the bill, he found that the cloud resource consumption was very high. He then examined the cloud server and discovered that a malicious code was running on the server, which was generating huge but harmless traffic from the server. This means that the server has been compromised by an attacker with the sole intention to hurt the cloud customer financially. Which attack is described in the above scenario?
- A. EDoS Attack (Economic Denial of Service)
- B. XSS Attack
- C. DDoS Attack (Distributed Denial of Service)
- D. Man-in-the-cloud Attack
正解：C
質問 # 538
A mobile operating system manages communication between the mobile device and other compatible devices like computers, televisions, or printers.
Which mobile operating system architecture is represented here?
- A. Windows Phone 7 Architecture
- B. Symbian OS Architecture
- C. webOS System Architecture
- D. Android OS Architecture
正解：D
質問 # 539
What type of analysis helps to identify the time and sequence of events in an investigation?
- A. Functional
- B. Temporal
- C. Time-based
- D. Relational
正解：B
質問 # 540
Frank, a cloud administrator in his company, needs to take backup of the OS disks of two Azure VMs that store business-critical data.
Which type of Azure blob storage can he use for this purpose?
- A. Page blob
- B. Block blob
- C. Medium blob
- D. Append blob
正解：A
質問 # 541
The NMAP command above performs which of the following?
> NMAP -sn 192.168.11.200-215
- A. A trace sweep
- B. An operating system detect
- C. A ping scan
- D. A port scan
正解：C
質問 # 542
A forensic investigator is analyzing a Windows 10 machine that has unexpectedly crashed several times in the past week. The investigator needs to determine whether these crashes are due to an internal error or caused by a remote attacker who exploited a bug in the operating system. The investigator has crash dump files and access to various tools. What should be the investigator's most immediate action?
- A. Use the Process Dumper tool to dump the entire process space and analyze the contents in the RAM dump file
- B. Apply Handle.exe to see the object types and names of all the handles of the crashed programs
- C. Analyze the crash dump files using DumpChk to examine the system crash's cause and identify any errors in the applications or the operating system
- D. Utilize Redline to perform Indicators of Compromise (IOC) analysis and construct a timeline of potential cyber incidents
正解：C
質問 # 543
Jeff is a forensics investigator for a government agency's cyber security office. Jeff Is tasked with acquiring a memory dump of a Windows 10 computer that was involved In a DDoS attack on the government agency's web application. Jeff is onsite to collect the memory. What tool could Jeff use?
- A. RAM Mapper
- B. Volatility
- C. Autopsy
- D. Memcheck
正解：B
質問 # 544
Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform?
- A. Tracert
- B. Smurf scan
- C. ICMP ping sweep
- D. Ping trace
正解：C
質問 # 545
Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?
22,164 cylinders/disk
80 heads/cylinder
63 sectors/track
- A. 10 GB
- B. 11.17 GB
- C. 57.19 GB
- D. 53.26 GB
正解：D
質問 # 546
An individual skilled in Forensic Investigation has been summoned to look into a potentially unlawful transaction, believed to have unfolded on the shadowy expanses of the dark web. The investigator knows that the suspect used the Tor network for the transaction. Which of the following aspects of the Tor network should the investigator focus on primarily to trace the origin of the data transmission?
- A. The Tor Bridge Node, as it helps to circumvent restrictions on the Tor network
- B. The Entry/Guard Relay, as it provides an entry point to the Tor network
- C. The Middle Relay, as it transmits the data in an encrypted format
- D. The Exit Relay, as it sends the data to the destination server
正解：D
質問 # 547
In Windows 7 system files, which file reads the Boot.ini file and loads Ntoskrnl.exe. Bootvid.dll.
Hal.dll, and boot-start device drivers?
- A. Gdi32.dll
- B. Kernel32.dll
- C. Boot.in
- D. Ntldr
正解：D
質問 # 548
Who is responsible for the following tasks?
- Secure the scene and ensure that it is maintained In a secure state
until the Forensic Team advises
- Make notes about the scene that will eventually be handed over to the Forensic Team
- A. Non-Laboratory Staff
- B. Lawyers
- C. Local managers or other non-forensic staff
- D. System administrators
正解：A
質問 # 549
Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?
- A. Click-jacking
- B. Spearphishing
- C. Compromising a legitimate site
- D. Malvertising
正解：D
質問 # 550
Shortcuts are the files with the extension .Ink that are created and are accessed by the users.
These files provide you with information about:
- A. Files or network shares
- B. Running application
- C. Application logs
- D. System logs
正解：A
質問 # 551
When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.
- A. Lost clusters
- B. Bad clusters
- C. Empty clusters
- D. Unused clusters
正解：A
質問 # 552
An investigator is analyzing EXIF metadata in a case involving cybercrime. She finds that the timestamp data has been modified, potentially misleading the investigation. What is the best next step she should take in her forensic examination?
- A. Accept the tampered EXIF metadata as it's the only information available
- B. Discard the EXIF metadata as it has been tampered with and is no longer useful
- C. Change the focus of the investigation, as tampered EXIF metadata indicates a false lead
- D. Validate the EXIF metadata with other sources of information to corroborate its accuracy
正解：D
質問 # 553
What is the default IIS log location?
- A. %SystemDrive\logs\LogFiles
- B. SystemDrive\logs\LogFiles
- C. SystemDrive\inetpub\LogFiles
- D. %SystemDrive%\inetpub\logs\LogFiles
正解：D
質問 # 554
Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers.
Bill protects the PDF documents with a password and sends them to their intended recipients.
Why PDF passwords do not offer maximum protection?
- A. PDF passwords are converted to clear text when sent through E-mail
- B. PDF passwords are not considered safe by Sarbanes-Oxley
- C. PDF passwords can easily be cracked by software brute force tools
- D. When sent through E-mail, PDF passwords are stripped from the document completely
正解：C
質問 # 555
What is static executable file analysis?
- A. It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances
- B. It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment
- C. It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment
- D. It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances
正解：A
質問 # 556
Which of the following is NOT a graphics file?
- A. Picture3.nfo
- B. Picture4.psd
- C. Picture2.bmp
- D. Picture1.tga
正解：A
質問 # 557
To reach a bank web site, the traffic from workstations must pass through a firewall.
You have been asked to review the firewall configuration to ensure that workstations in network
10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https.
Which of the following firewall rules meets this requirement?
- A. if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 443) then permit
- B. if (source matches 10.10.10.0/24 and destination matches 10.20.20.1 and port matches 80 or
443) then permit - C. if (source matches 10.10.10.0 and destination matches 10.20.20.1 and port matches 443) then permit
正解：A
質問 # 558
At the time of evidence transfer, both sender and receiver need to give the information about date and time of transfer in the chain of custody record.
- A. True
- B. False
正解：A
質問 # 559
......
最新（2026)EC-COUNCIL 312-49v11試験問題集：https://www.goshiken.com/EC-COUNCIL/312-49v11-mondaishu.html
312-49v11練習問題集で検証済みのGoShiken更新された1006問題あります：https://drive.google.com/open?id=17EDovmWb3Zt6yK1dj6K0rI16B9zwVD8U