EC-Council CHFI (312-49) Certification Sample Questions 100% Pass

EC-Council CHFI (312-49) Certification Sample Questions 100% Pass 01. The file content of evidence files can be viewed using the View Pane. The View pane provides several tabs to view file content. Which of this tab provides native views of formats supported by Oracle outside in technology? a) Text tab b) Hex tab c) Doc tab d) Picture tab Answer: c) Doc tab 02. During live response, you can retrieve and analyze much of the information in the Registry, and the complete data during post-mortem investigation. Which of this registry Hive contains configuration information relating to which application is used to open various files on the system? a) HKEY_USERS b) HKEY_CURRENT_USER c) HKEY_CLASSES_ROOT d) HKEY_CURRENT_CONFIG Answer: c) HKEY_CLASSES_ROOT 03. Which one of the following is the smallest allocation unit of a hard disk, which contains a set of tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme? a) Sector b) Cluster c) Track d) 4Platter Answer: b) Cluster 04. Source Processor automates and streamlines common investigative tasks that collect, analyze, and report on evidence. Which of this source processor module obtains drives and memory from a target machine? a) Personal Information Module b) TInternet Artifacts Module c) Acquisition Module d) File Processor Module Answer: c) Acquisition Module 05. Which of this attack technique is the combination of both a brute-force attack and a dictionary attack to crack a password? a) Hybrid Attack