312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 12 of 18, with answer review and explanations.

Question 56

Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?

  1. CacheInf
  2. FATKit
  3. Belkasoft Live RAM Capturer
  4. Coreography

Question 57

Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling it, the dates and times when it is being handled, and the place of storage of the evidence. What do you call this document?

  1. Authorization form
  2. Consent form
  3. Chain of custody
  4. Log book

Question 58

Which of the following is a requirement for senders as per the CAN-SPAM act?

  1. Emails must not contain information regarding how to stop receiving emails from the sender in future
  2. Senders should never share their physical postal address in the email
  3. Senders cannot use misleading or false header information
  4. Senders must use deceptive subject lines

Question 59

Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What is the next thing he should do as a security measure?

  1. Delete the OS disk of the affected VM altogether
  2. Delete the snapshot from the source resource group
  3. Recommend changing the access policies followed by the company
  4. Create another VM by using the snapshot

Question 60

Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.

  1. Drive:\RECYCLER
  2. Drive:\RECYCLED
  3. Drive:\$Recycle.Bin
  4. C:\RECYCLED