312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 7 of 18, with answer review and explanations.

Question 31

Examination of a computer by a technically unauthorized person will almost always result in:

  1. Rendering any evidence found inadmissible in a court of law
  2. Completely accurate results of the examination
  3. The chain of custody being fully maintained
  4. Rendering any evidence found admissible in a court of law

Question 32

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

  1. INFO2
  2. INFO1
  3. LOGINFO1
  4. LOGINFO2

Question 33

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

  1. /auth
  2. /proc
  3. /var/log/debug
  4. /var/spool/cron/

Question 34

You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a “simple backup copy” of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a “simple backup copy” will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

  1. Robust copy
  2. Incremental backup copy
  3. Bit-stream copy
  4. Full backup copy

Question 35

An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E” represent?

  1. Name of the Database
  2. Name of the SQL Server
  3. Operating system of the system
  4. Network credentials of the database