Latest Eccouncil 312-49 Exam dumps 2026

Question No: 1

MultipleChoice

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

Options

AAutomate Collection from image files

BAvoiding copying data from the boot partition

CAcquire data from host-protected area on a disk

DPrevent Contamination to the evidence drive

Question No: 2

MultipleChoice

In Java, when multiple applications are launched, multiple Dalvik Virtual Machine instances occur that consume memory and time. To avoid that. Android Implements a process that enables low memory consumption and quick start-up time. What is the process called?

Options

Ainit

BMedia server

CZygote

DDaemon

Question No: 3

MultipleChoice

Consider that you are investigating a machine running an Windows OS released prior to Windows Vist

a. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:\Recycler\\. You read an entry named "Dd5.exe". What does Dd5.exe mean?

Options

AD drive. fifth file deleted, a .exe file

BD drive, fourth file restored, a .exe file

CD drive, fourth file deleted, a .exe file

DD drive, sixth file deleted, a .exe file

Question No: 4

MultipleChoice

An investigator Is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

Options

AThreat hunting

BThreat analysis

CStatic analysis

DDynamic analysis

Question No: 5

MultipleChoice

What does the Rule 101 of Federal Rules of Evidence states?

Options

AScope of the Rules, where they can be applied

BPurpose of the Rules

CLimited Admissibility of the Evidence

DRulings on Evidence

Question No: 6

MultipleChoice

Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away.

Eventually the wireless signal shows back up, but drops intermittently. What could be Tyler issue with his home wireless network?

Options

AComputers on his wired network

BSatellite television

C2.4Ghz Cordless phones

DCB radio

Question No: 7

MultipleChoice

WPA2 provides enterprise and Wi-Fi users with stronger data protection and network access control which of the following encryption algorithm is used DVWPA2?

Options

ARC4-CCMP

BRC4-TKIP

CAES-CCMP

DAES-TKIP

Question No: 8

MultipleChoice

When a file or folder is deleted, the complete path, including the original file name, is stored in a special hidden file called 'INF02' in the Recycled folder. If the INF02 file is deleted, it is re-created when you___________.

Options

ARestart Windows

BKill the running processes in Windows task manager

CRun the antivirus tool on the system

DRun the anti-spyware tool on the system

Question No: 9

MultipleChoice

File deletion is a way of removing a file from a computer's file system. What happens when a file is deleted in windows7?

Options

AThe last letter of a file name is replaced by a hex byte code E5h

BThe operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted

CCorresponding clusters in FAT are marked as used

DThe computer looks at the clusters occupied by that file and does not avails space to store a new file

Question No: 10

MultipleChoice

Which of the following statements does not support the case assessment?

Options

AReview the case investigator's request for service

BIdentify the legal authority for the forensic examination request

CDo not document the chain of custody

DDiscuss whether other forensic processes need to be performed on the evidence

Question No: 11

MultipleChoice

TCP/IP (Transmission Control Protocol/Internet Protocol) is a communication protocol used to connect different hosts in the Internet. It contains four layers, namely the network interface layer. Internet layer, transport layer, and application layer.

Which of the following protocols works under the transport layer of TCP/IP?

Options

AUDP

BHTTP

CFTP

DSNMP

Question No: 12

MultipleChoice

Network forensics allows Investigators to inspect network traffic and logs to identify and locate the attack system

Network forensics can reveal: (Select three answers)

Options

ASource of security incidents' and network attacks

BPath of the attack

CIntrusion techniques used by attackers

DHardware configuration of the attacker's system

Question No: 13

MultipleChoice

Determine the message length from following hex viewer record:

Options

A6E2F

B13

C27

D810D

Question No: 14

MultipleChoice

In which step of the computer forensics investigation methodology would you run MD5 checksum on the evidence?

Options

AObtain search warrant

BEvaluate and secure the scene

CCollect the evidence

DAcquire the data

Question No: 15

MultipleChoice

Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format.

SAM file in Windows is located at:

Options

AC:\windows\system32\config\SAM

BC:\windows\system32\con\SAM

CC:\windows\system32\Boot\SAM

DC:\windows\system32\drivers\SAM

Question No: 16

MultipleChoice

FAT32 is a 32-bit version of FAT file system using smaller clusters and results in efficient storage capacity. What is the maximum drive size supported?

Options

A1 terabytes

B2 terabytes

C3 terabytes

D4 terabytes

Question No: 17

MultipleChoice

Email archiving is a systematic approach to save and protect the data contained in emails so that it can tie easily accessed at a later date.

Options

ATrue

BFalse

Question No: 18

MultipleChoice

Which of the following commands shows you the NetBIOS name table each?

Options

Anbtstat -n

Bnbtstat -c

Cnbtstat -r

Dnbtstat -s

Question No: 19

MultipleChoice

What is the First Step required in preparing a computer for forensics investigation?

Options

ADo not turn the computer off or on, run any programs, or attempt to access data on a computer

BSecure any relevant media

CSuspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue

DIdentify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination

Question No: 20

MultipleChoice

Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.

Options

ATrue

BFalse

Free Eccouncil 312-49 Exam Dumps July 2026