EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v11) (312-49v11) Free Practice Test
Question 1
Which among the following acts has been passed by the U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?
Correct Answer: B
Question 2
The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux.
Identify the Apache error log from the following logs.
Identify the Apache error log from the following logs.
Correct Answer: C
Question 3
An investigator is working on a complex financial fraud case involving multiple government agencies. As part of the investigation, the investigator seeks to acquire certain government records to help uncover potentially fraudulent activities and determine the full scope of the crime.
However, one of the government agencies involved denies access to some of the requested records, citing national security concerns and invoking a statutory exemption. Which law governs the investigator's right to request these records, and which exemption might prevent disclosure?
However, one of the government agencies involved denies access to some of the requested records, citing national security concerns and invoking a statutory exemption. Which law governs the investigator's right to request these records, and which exemption might prevent disclosure?
Correct Answer: C
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 4
Madison, a forensic investigator, has been assigned to investigate a case of email fraud, where the suspect allegedly used a compromised email account to send phishing emails to several victims. As part of the investigation, Madison must first obtain permission to conduct an on-site examination of the suspect's machine and the email server used for the fraudulent emails.
What is the initial step that Madison must take before proceeding with the forensic examination?
What is the initial step that Madison must take before proceeding with the forensic examination?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 5
During a live-response investigation on a compromised Ubuntu web server, analysts capture a memory image to examine suspicious behavior observed within a running process. The objective is to identify evidence of anomalous memory regions that may indicate unauthorized code execution within the address space of a specific process. How should investigators use Volatility to locate this type of memory anomaly?
Correct Answer: C
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 6
James, a forensic investigator, is tasked with examining a suspect's computer system that is believed to have been used for illegal activities. During his investigation, he finds multiple files with unusual extensions and encrypted contents. One of the files, in particular, appears to be a password-protected ZIP file. As part of his investigation, James needs to extract and analyze the contents of this file to check if it contains any evidence of criminal activity. What should James do next?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 7
A computer forensics investigator or forensic analyst is a specially trained professional who works with law enforcement as well as private businesses to retrieve information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer. Which of the following is not a duty of the analyst during a criminal investigation?
Correct Answer: D
Question 8
During a digital forensics investigation, suspicious activity is detected in a Google Cloud Platform (GCP) environment. The investigation team gains access to logs and metadata from the GCP services.
In Google Cloud forensics, what role do logs and metadata play in the investigation process?
In Google Cloud forensics, what role do logs and metadata play in the investigation process?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 9
During a data-exfiltration case at a Seattle design firm, investigators need the macOS encrypted container that securely stores user account names and passwords for Mac, apps, servers, and websites and can also hold confidential information such as credit card numbers or bank account PIN numbers. What type of the Mac forensics data source should they examine?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 10
During a multinational fraud investigation, forensic analysts are asked to verify where evidence stored in Microsoft Azure can legally reside. The organization's Azure environment includes multiple region pairs designed for redundancy and compliance, each operating under the same market-level policies for data residency. Which Azure component best represents this configuration?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 11
During a forensic investigation, Robert discovers that the attacker modified the file extensions of certain malicious files to make them appear benign. These files were originally executable but had their extensions changed to disguise their true nature. Robert needs to identify and extract these files despite their misleading extensions. Which of the following tools can help Robert detect file extension mismatches and recover the actual file types during the investigation?
Correct Answer: B
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 12
"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?
Correct Answer: B
Question 13
During a forensic investigation, the team is responsible for ensuring that the forensic laboratory remains secure. As part of the security protocols, the lab has implemented a system to record all visitors, including details such as name, address, time of visit, and the purpose of the visit. This helps maintain an accurate record of admittance and ensures that only authorized personnel can enter the facility. Which of the following considerations is being followed to maintain this level of security in the lab?
Correct Answer: D
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).
Question 14
During an intellectual property breach inquiry at a publishing house in New York City, the executive director provides consent for examiners to inspect company laptops. Before any device handling begins, an additional individual is present to validate that the authorization was properly executed. Which responsibility best explains the purpose of that individual's presence?
Correct Answer: A
Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).