Full Access ECCouncil 312-49v10 Tutorials

Computer Hacking Forensic Investigator (CHFI-v10) Questions and Answers

Question 57

When should an MD5 hash check be performed when processing evidence?

After the evidence examination has been completed

On an hourly basis during the evidence examination

Before and after evidence examination

Before the evidence examination has been completed

Question 58

What does the 63.78.199.4(161) denotes in a Cisco router log?

Mar 14 22:57:53.425 EST: %SEC-6-IPACCESSLOGP: list internet-inbound denied udp 66.56.16.77(1029) -> 63.78.199.4(161), 1 packet

Destination IP address

Source IP address

None of the above

Question 59

Which of the following commands shows you all of the network services running on Windows-based servers?

Netstart

Net Session

Net use

Net config

Question 60

What will the following Linux command accomplish?

dd if=/dev/mem of=/home/sam/mem.bin bs=1024

Copy the master boot record to a file

Copy the contents of the system folder to a file

Copy the running memory to a file

Copy the memory dump file to an image file