312-49v11 Exam Questions and Answers

QUESTION: 9

Annie is searching for certain deleted files on a system running Windows XP OS.
Where will she find the files if they were not completely deleted from the system?

C: $Recycled.Bin
C: \$Recycle.Bin
C:\RECYCLER
C:\$RECYCLER

Answer(s): B

Reveal Solution Next Question

QUESTION: 10

Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?

filecache.db
config.db
sigstore.db
Sync_config.db

Answer(s): D

Reveal Solution Next Question

QUESTION: 11

An expert witness is a __________________ who is normally appointed by a party to assist the formulation and preparation of a party's claim or defense.

Expert in criminal investigation
Subject matter specialist
Witness present at the crime scene
Expert law graduate appointed by attorney

Answer(s): B

Reveal Solution Next Question

Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers.
What should be his first response while maintaining the integrity of evidence?

Record the system state by taking photographs of physical system and the display
Perform data acquisition without disturbing the state of the systems
Open the systems, remove the hard disk and secure it
Switch off the systems and carry them to the laboratory

Answer(s): A

Reveal Solution Next Question

QUESTION: 13

Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?

HIPAA
GLBA
SOX
FISMA

Answer(s): C

Reveal Solution Next Question

QUESTION: 14

Jacky encrypts her documents using a password. It is known that she uses her daughter's year of birth as part of the password.
Which password cracking technique would be optimal to crack her password?

Rule-based attack
Brute force attack
Syllable attack
Hybrid attack

Answer(s): A

Reveal Solution Next Question

QUESTION: 15

Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

Bayesian Correlation
Vulnerability-Based Approach
Rule-Based Approach
Route Correlation

Answer(s): A

Reveal Solution Next Question

QUESTION: 16

Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card.
What can Jason do in this scenario to reset the PIN and access SIM data?

He should contact the network operator for a Temporary Unlock Code (TUK)
Use system and hardware tools to gain access
He can attempt PIN guesses after 24 hours
He should contact the network operator for Personal Unlock Number (PUK)

Answer(s): D

Reveal Solution Next Question

EC-Council 312-49v11 Exam (page: 2)
EC-Council Computer Hacking Forensic Investigator
Updated on: 07-Feb-2026

QUESTION: 9

QUESTION: 10

QUESTION: 11

QUESTION: 12

QUESTION: 13

QUESTION: 14

QUESTION: 15

QUESTION: 16

EC-Council 312-49v11 Exam (page: 2) EC-Council Computer Hacking Forensic Investigator Updated on: 07-Feb-2026

QUESTION: 9

QUESTION: 10

QUESTION: 11

QUESTION: 12

QUESTION: 13

QUESTION: 14

QUESTION: 15

QUESTION: 16

EC-Council 312-49v11 Exam (page: 2)
EC-Council Computer Hacking Forensic Investigator
Updated on: 07-Feb-2026