EC-COUNCIL 312-49v11 Actual Free Exam Questions & Community Discussion

Chris, a digital forensics expert, is investigating a compromised Windows system using the BIOS- MBR boot method. Upon reviewing the system's boot process, he confirms that the Power-On Self-Test (POST) has successfully completed. The BIOS has checked the hardware and verified the integrity of essential system components like the CPU, memory, and storage devices. After this, the BIOS loads the Master Boot Record (MBR) from the bootable device.
At this point in the process, the system's boot manager is expected to take over. The boot manager, located on the MBR, is responsible for locating and triggering the appropriate boot loader. Chris knows that the boot manager will locate a system file that is integral for starting the Windows operating system. This next step involves loading a critical system file that helps the OS load into memory.
Given that the system is using the BIOS-MBR method, Chris knows that after the BIOS completes POST and the MBR is loaded, the next task is the loading of this essential file, which is key to the boot process. What should Chris expect to happen next in the boot sequence?

David, a digital forensics examiner, is investigating a cybercrime incident involving the theft of sensitive data from his company's servers. As part of the investigation, he needs to ensure that the procedures followed for handling digital evidence comply with internationally recognized standards. Which ISO standard provides guidelines for the establishment, maintenance, and improvement of a digital forensic capability within an organization?

In a Filesystem Hierarchy Standard (FHS), which of the following directories contains the binary files required for working?

After initiating an internal fraud investigation in San Jose, California, examiners must obtain a forensically useful iPhone backup via Finder on a Mac. The lab requires that the backup be password-protected so it preserves credentials and other protected items for analysis. What action must be selected in the Finder workflow to meet this requirement?

During a phishing response at a banking call center in North Carolina, the team receives an Excel spreadsheet that opens cleanly but is suspected of concealing macro logic. Before any macro code extraction, which command should investigators run to list the OLE streams and identify which stream(s) contain macros (flagged with an uppercase "M")?

"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?

Sally accessed the computer system that holds trade secrets of the company where she is employed. She knows she accessed it without authorization and all access (authorized and unauthorized) to this computer is monitored. To cover her tracks, Sally deleted the log entries on this computer. What among the following best describes her action?

A cybersecurity firm has recently discovered a new strain of ransomware circulating on the internet, posing a significant threat to organizations worldwide. This ransomware is highly sophisticated and capable of evading traditional antivirus software. To effectively combat this threat, the cybersecurity firm decides to utilize a malware sandbox for detailed analysis. Given the scenario described, what would be the primary objective of using a malware sandbox in this situation?

During an insider data-exfiltration probe at a manufacturing firm in Salt Lake City, Utah, investigators load a captured packet file into NetworkMiner for offline analysis. The traffic includes various application-layer protocols, and the team requires a consolidated view of any identity and access evidence parsed from the traffic before proceeding to file reconstruction or host profiling.
Which tab should they open?