312-49v11 Practice Questions

Evelyn, a forensic investigator, is tasked with analyzing a Linux machine suspected of harboring malicious activity. She needs to examine open files and identify which processes are associated with those files. Which Volatility Framework plugin should Evelyn use to list the open files and their associated processes from a RAM image?

James, a highly skilled digital forensics expert, is working on a case involving an online crime. The suspect is believed to have conducted fraudulent activities through a network of compromised devices. The evidence trail is digital, leaving behind a complex web of data across various systems, including logs, metadata, and system/application timestamps. James focuses his investigation on collecting metadata from the suspect ' s devices, scrutinizing system/application logs, and analyzing the timestamps of files and actions that occurred during the suspected time of the crime.

As James sifts through this digital trail, he is attempting to find data that will either directly link the suspect to the crime or provide supporting evidence that confirms the events that transpired. He understands that metadata and logs can reveal actions such as file access, document creation, application use, and network activity, all of which could help piece together the timeline of the suspect ' s activities. What role does this evidence serve in the investigation?

During triage of a suspicious Android application, an examiner sets up a local static-analysis environment using MobSF on a forensic workstation. Before any application artifacts can be submitted or results reviewed, the examiner must initialize the analysis environment so that MobSF ' s interface becomes available for use. Which action enables this environment to become operational?

Following a post-breach investigation at a manufacturing company in Denver, Colorado, forensic analysts begin capturing and examining live network traffic between internal and external hosts. The objective is to analyze communication patterns, detect unauthorized activity, and determine the attacker ' s methods. What activity falls outside the primary objectives of network traffic investigation?

You ' re a forensic investigator tasked with analyzing a potential security breach on an Internet Information Services (IIS) web server. Your objective is to collect and analyze IIS logs to determine how and from where the attack occurred. Where are IIS log files typically stored by default on Windows Server operating systems?

Alex, a forensic investigator, has been assigned to investigate a damaged Android device that may contain critical evidence related to a cybercrime. The device has physical damage and is not booting up or responding to normal recovery procedures. Alex needs to determine the best way to acquire the data from this damaged device.

Given the situation, Alex must decide on the first step to take during the Android forensics process to ensure data is properly extracted. Which of the following operations must Alex first perform during the Android forensics process when the evidentiary device is damaged?

As a Computer Hacking Forensic Investigator, you ' re working on a case involving the unauthorized alteration of financial records within a major bank. The network administrators have identified a specific terminal where they believe the alterations originated. You have been tasked with examining this workstation. The administrators inform you that the machine has been powered down for fear of further alterations. In this scenario, which of the following would be your first step?

In the aftermath of a sophisticated cyber-attack on a financial institution, forensic investigators are tasked with retrieving critical evidence from a compromised server. However, upon examination, they encounter encrypted files and password-protected directories, indicating attempts to thwart forensic analysis through password protection.

To counter these anti-forensic measures effectively, which of the following strategies would be most effective?

During a document-recovery effort at a publishing house in New York City, forensic examiners carve fragmented text strings from a suspect ' s deleted email archive. The recovered characters represent only English letters, numbers, and basic punctuation encoded in a compact 7-bit format limited to 128 specified symbols. Which encoding standard best matches this constraint for reconstructing readable English content?

During an incident-response project at a biotech company in San Diego, California, the team must move 600 TB of research datasets from an isolated lab network to Google Cloud, but the site has limited bandwidth and no direct peering. They need a secure, offline method to ship the data to Google for upload into Cloud Storage. Which Google Cloud service fits this requirement?