312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 16 of 18, with answer review and explanations.

Question 76

For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?

  1. SSN of the person collecting the evidence
  2. Exact location the evidence was collected from
  3. Relevant circumstances surrounding the collection
  4. General description of the evidence

Question 77

During an investigation, the first responders stored mobile devices in specific containers to provide network isolation. All the following are examples of such pieces of equipment, except for:

  1. Faraday bag
  2. VirtualBox
  3. Wireless StrongHold bag
  4. RF shield box

Question 78

What is the extension used by Windows OS for shortcut files present on the machine?

  1. .lnk
  2. .dat
  3. .log
  4. .pf

Question 79

Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?

  1. Swap files
  2. Security logs
  3. Files in Recycle Bin
  4. Prefetch files

Question 80

Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to instructions written in assembly language. Which tool should he use for this purpose?

  1. HashCalc
  2. Ollydbg
  3. BinText
  4. oledump