[Aug 27, 2026] Get Unlimited Access to 312-49 Certification Exam Cert Guide [Q34-Q57]

NEW QUESTION 34
A packet is sent to a router that does not have the packet destination address in its route table.
How will the packet get to its proper destination?

NEW QUESTION 35
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.

NEW QUESTION 36
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue access point outside the corporate perimeter and then lure the employees of the organization to connect to it?

NEW QUESTION 37
How often must a company keep log files for them to be admissible in a court of law?

NEW QUESTION 38
Why would a company issue a dongle with the software they sell?

NEW QUESTION 39
How often must a company keep log files for them to be admissible in a court of law?

NEW QUESTION 40
Which of the following tools is not a data acquisition hardware tool?

NEW QUESTION 41
BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

NEW QUESTION 42
What does the superblock in Linux define?

NEW QUESTION 43
What will the following Linux command accomplish?
dd if=/dev/mem of=/home/sam/mem.bin bs=1024

NEW QUESTION 44
Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader). In which stage of the booting process do the bootloaders become active?

NEW QUESTION 45
Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

NEW QUESTION 46
Examination of a computer by a technically unauthorized person will almost always result in:

NEW QUESTION 47
When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.
What is the actual error code that you would see in the log for resource not found?

NEW QUESTION 48
What is the following command trying to accomplish?

NEW QUESTION 49
If a suspect computer is located in an area that may have toxic chemicals, you must:

NEW QUESTION 50
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?

NEW QUESTION 51
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.

He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

NEW QUESTION 52
When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called “INFO2” in the Recycled folder. If the INFO2 file is deleted, it is recovered when you
______________________.

NEW QUESTION 53
On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

NEW QUESTION 54
A law enforcement officer may only search for and seize criminal evidence with
_______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

NEW QUESTION 55
If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

NEW QUESTION 56
What is the location of the binary files required for the functioning of the OS in a Linux system?

NEW QUESTION 57
Joshua is analyzing an MSSQL database for finding the attack evidence and other details, where should he look for the database logs?