ECCouncil 312-49v11 - Computer Hacking Forensic Investigator Exam
Page: 3 / 91
Total 452 questions
Question #11 (Topic: Exam A)
An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party’s claim or defense.
A. Expert in criminal investigation
B. Subject matter specialist
C. Witness present at the crime scene
D. Expert law graduate appointed by attorney
Answer: B
Question #12 (Topic: Exam A)
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?
A. Record the system state by taking photographs of physical system and the display
B. Perform data acquisition without disturbing the state of the systems
C. Open the systems, remove the hard disk and secure it
D. Switch off the systems and carry them to the laboratory
Answer: A
Question #13 (Topic: Exam A)
Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?
A. HIPAA
B. GLBA
C. SOX
D. FISMA
Answer: C
Question #14 (Topic: Exam A)
Jacky encrypts her documents using a password. It is known that she uses her daughter’s year of birth as part of the password. Which password cracking technique would be optimal to crack her password?
A. Rule-based attack
B. Brute force attack
C. Syllable attack
D. Hybrid attack
Answer: A
Question #15 (Topic: Exam A)
Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?
A. Bayesian Correlation
B. Vulnerability-Based Approach
C. Rule-Based Approach
D. Route Correlation
Answer: A
