Free EC-COUNCIL 312-49v11 Exam Dumps Questions & Answers

Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee in order to hide their nefarious actions. What tool should Mark use to restore the data?

• A.  R-Studio
• B.  EFSDump
• C.  Diskmon
• D.  Diskview

Rule 1002 of Federal Rules of Evidence (US) talks about ______________.

• A.  Admissibility of duplicates
• B.  Requirement of original
• C.  Admissibility of original
• D.  Admissibility of other evidence of contents

You work as a forensic analyst for a prominent tech company that suspects one of its software developers has been selling proprietary source code. The suspect's computer, a macOS machine, has been secured and awaits examination. You've been tasked with obtaining a forensically sound copy of the suspect's system data. Given the situation and the potential for macOS-specific malware on the suspect's computer, which method would be the best approach to obtain a forensically sound copy of the data?

• A.  Disconnect the suspect's hard drive and connect it to a forensic workstation.
• B.  Remotely acquire the data via network-based acquisition.
• C.  Conduct a live acquisition using a software write-blocker.
• D.  Use a forensic boot disk to bypass the macOS and directly access the disk for acquisition.

As a cybersecurity analyst, recently, you detected an unusual increase in network traffic originating from multiple endpoints within the organization's network. Upon further investigation, you discovered that several employees received phishing emails containing seemingly innocuous attachments. However, these attachments are suspected to be part of a GootLoader campaign, a notorious malware distribution method. What could be concluded for the attachments?

• A.  The attachments might be serving as the first-stage payload in a GootLoader campaign.
• B.  The attachments may contain spyware designed to steal confidential information from the organization.
• C.  The attachments could be exploiting zero-day vulnerabilities to gain unauthorized access to the network.
• D.  The attachments may contain ransomware capable of encrypting sensitive data.

During an investigation, Noel found a SIM card from the suspect's mobile. The ICCID on the card is 8944245252001451548. What does the first four digits (89 and 44) in the ICCID represent?

• A.  TAC and industry identifier
• B.  Industry identifier and country code
• C.  Country code and industry identifier
• D.  Issuer identifier number and TAC