Pass the ECCouncil CHFIv9 312-49v9 Questions and answers with CertsForce

Viewing page 11 out of 12 pages
Viewing questions 151-165 out of questions
Questions # 151:

Which of the following file system uses Master File Table (MFT) database to store information about every file and directory on a volume?

Options:

A.

FAT File System


B.

ReFS


C.

exFAT


D.

NTFS File System


Expert Solution
Questions # 152:

Which of the following processes is part of the dynamic malware analysis?

Options:

A.

Process Monitoring


B.

Malware disassembly


C.

Searching for the strings


D.

File fingerprinting


Expert Solution
Questions # 153:

Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

Options:

A.

Hex Editor


B.

Internet Evidence Finder


C.

Process Monitor


D.

Report Viewer


Expert Solution
Questions # 154:

An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?

Options:

A.

SysAnalyzer


B.

PEiD


C.

Comodo Programs Manager


D.

Dependency Walker


Expert Solution
Questions # 155:

What does the Rule 101 of Federal Rules of Evidence states?

Options:

A.

Scope of the Rules, where they can be applied


B.

Purpose of the Rules


C.

Limited Admissibility of the Evidence


D.

Rulings on Evidence


Expert Solution
Questions # 156:

Which of the following setups should a tester choose to analyze malware behavior?

Options:

A.

A virtual system with internet connection


B.

A normal system without internet connect


C.

A normal system with internet connection


D.

A virtual system with network simulation for internet connection


Expert Solution
Questions # 157:

Which among the following web application threats is resulted when developers expose various internal implementation objects, such as files, directories, database records, or key-through references?

Options:

A.

Remote File Inclusion


B.

Cross Site Scripting


C.

Insecure Direct Object References


D.

Cross Site Request Forgery


Expert Solution
Questions # 158:

In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims. What is the difference between pharming and phishing attacks?

Options:

A.

Both pharming and phishing attacks are purely technical and are not considered forms of social engineering


B.

In a pharming attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a phishing attack an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name


C.

In a phishing attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a pharming attack an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name


D.

Both pharming and phishing attacks are identical


Expert Solution
Questions # 159:

What do you call the process in which an attacker uses magnetic field over the digital media device to delete any previously stored data?

Options:

A.

Disk deletion


B.

Disk cleaning


C.

Disk degaussing


D.

Disk magnetization


Expert Solution
Questions # 160:

Which of the following tool can reverse machine code to assembly language?

Options:

A.

PEiD


B.

RAM Capturer


C.

IDA Pro


D.

Deep Log Analyzer


Expert Solution
Questions # 161:

What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

Options:

A.

Windows Services Monitoring


B.

System Baselining


C.

Start-up Programs Monitoring


D.

Host integrity Monitoring


Expert Solution
Questions # 162:

An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?

Options:

A.

Cloud as a subject


B.

Cloud as a tool


C.

Cloud as an object


D.

Cloud as a service


Expert Solution
Questions # 163:

NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

Options:

A.

Encrypted FEK


B.

Checksum


C.

EFS Certificate Hash


D.

Container Name


Expert Solution
Questions # 164:

Which of the following tool is used to locate IP addresses?

Options:

A.

SmartWhois


B.

Deep Log Analyzer


C.

Towelroot


D.

XRY LOGICAL


Expert Solution
Questions # 165:

Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?

Options:

A.

Email spamming


B.

Phishing


C.

Email spoofing


D.

Mail bombing


Expert Solution
Viewing page 11 out of 12 pages
Viewing questions 151-165 out of questions