Sign in

Free 312-49v10 sample questions

Real questions from the Computer Hacking Forensic Investigator (v10) practice bank, with the correct answer and an explanation for each one. No junk, no filler.

Try them in the simulator Same questions, with study, timed and flashcard modes.

Showing 10 of 20 free sample questions.

Question 1Choose one

An investigator is analyzing a memory dump from a compromised Linux server that hosted multiple Docker containers. The attacker allegedly used a fileless malware variant that executed entirely in memory. The investigator suspects the malware manipulated system calls using a kernel module. Which Volatility 3 plugin would be most effective for initially identifying anomalous kernel modules and their hooks?

Question 2Choose one

A financial institution's internal audit team is investigating a case of suspected insider trading facilitated through corporate email. The investigation is subject to strict eDiscovery protocols under the EDRM framework. The legal team has issued a hold on all relevant mailboxes. At which stage of the EDRM cycle would the forensic team use keyword searching, date filtering, and de-duplication on the collected mailbox data?

Question 3Choose one

During a forensic investigation of a compromised web server, an analyst discovers that the attacker manipulated the timestamps of several critical log files using the `touch` command to cover their tracks. This action is a form of trail obfuscation. Which of the following artifacts is most likely to reveal the discrepancy between the modified timestamps and the actual time of file system changes?

Question 4Choose one

A forensic investigator in the European Union is conducting an investigation into corporate fraud that involves employee data from Germany and France. The investigator must ensure compliance with the General Data Protection Regulation (GDPR). Which GDPR principle is most critical when deciding how much data to collect and ensuring that only data strictly relevant to the fraud case is acquired?

Question 5Choose 2

A forensic analyst is examining an Android device and needs to recover deleted SQLite database entries from a third-party messaging application. The database file itself is intact, but records have been removed. Which artifact within the SQLite file structure should the analyst focus on to potentially recover the deleted content? (Select TWO).

Question 6Choose one

A CHFI is tasked with creating a forensic image of a 2TB NVMe SSD from a suspect's laptop. To ensure the integrity of the evidence, the investigator must use a hardware write blocker. The primary reason for using a hardware write blocker over a software-based one in this scenario is that hardware blockers:

Question 7Choose one

True or False: In a RAID 5 configuration consisting of four 1TB drives, a forensic investigator can reconstruct the full data set even if two of the drives have failed simultaneously.

Question 8Choose one

An investigator is analyzing network traffic from a suspected ransomware attack. They observe a large volume of DNS queries for domains ending in `.onion`. This activity is a strong indicator that the malware is attempting to communicate with a Command and Control (C2) server hosted on:

Question 9Choose one

A forensic investigator is using Python to automate the extraction of EXIF data from a large set of image files. The investigator writes a script to parse GPS coordinates, camera model, and timestamps. Which Python library is most commonly used and specifically suited for this task?

Question 10Choose one

A hospital's IT security team is responding to a breach where a medical IoT device (an infusion pump) was compromised. The forensic investigator needs to acquire data from the device, which has limited storage and a proprietary embedded operating system. The device is still running. According to the order of volatility, which of the following pieces of evidence should be collected FIRST?

10 more free samples are waiting

Create a free account to unlock the whole 312-49v10 sample bank, or get full access to all 264 practice questions in the simulator.

Create account