312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 17 of 18, with answer review and explanations.

Question 81

Maria has executed a suspicious executable file in a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for in this scenario?

  1. Event ID 4657
  2. Event ID 4688
  3. Event ID 7040
  4. Event ID 4624

Question 82

Edgar is part of the FBI's forensic media and malware analysis team; he is analyzing a current malware and is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar's approach is to execute the malware code to know how it interacts with the host system and its impacts on it. He is also using a virtual machine and a sandbox environment. What type of malware analysis is Edgar performing?

  1. VirusTotal analysis
  2. Static analysis
  3. Malware disassembly
  4. Dynamic malware analysis/behavioral analysis

Question 83

An investigator is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

  1. Dynamic analysis
  2. Threat hunting
  3. Threat analysis
  4. Static analysis

Question 84

Rule 1002 of Federal Rules of Evidence (US) talks about ______________.

  1. Admissibility of duplicates
  2. Admissibility of original
  3. Admissibility of other evidence of contents
  4. Requirement of original

Question 85

Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?

  1. Helix
  2. Datagrab
  3. Coreography
  4. Ethereal