EC-COUNCIL 312-49v11 Exam Syllabus Topics:

Reference: https://www.eccouncil.org/train-certify/computer-hacking-forensic-investigator-chfi/

EC-COUNCIL Computer Hacking Forensic Investigator (CHFI-v11) Sample Questions:

Question #1
A regional bank, operating across several cities, recently discovered discrepancies in account balances following routine audits. The issues were noticed across various branches, prompting an internal investigation. Upon deeper analysis, it was revealed that someone with prior authorization had altered financial records. The investigation uncovered that a former employee, whose credentials had not been deactivated after leaving the company, had retained full control over critical systems. This oversight allowed the individual to modify transactional data, leading to inaccurate financial reports and potential harm to the bank's reputation. The adjustments made by the former employee were intentional and impacted customer accounts. Despite the employee no longer being employed, the lack of action to revoke their permissions allowed these changes to occur without any barriers. What classification of cybercrimes best fits this event?

A. A breach caused by external actors bypassing firewalls.
B. An impersonation attempt using credential stuffing techniques.
C. An abuse of role-based access from within the network.
D. An authentication flaw due to expired password policies.

Question #2
Evelyn, a forensic investigator, is setting up a secure storage system to store critical evidence data. She purchases a new storage system that can support large disk sizes and ensures data integrity through the use of CRCs (Cyclic Redundancy Checks) and 64-bit Logical Block Addresses (LBAs). The system allows for partitions as large as 8 ZiB and can handle up to 128 partitions. After checking the specifications, Evelyn confirms that the partitioning scheme used by her system supports these capabilities. What partitioning scheme is Evelyn using for her storage system?

A. MBR
B. BPB
C. GPT
D. Clusters

Question #3
Assume there is a file named myfile.txt in C: drive that contains hidden data streams. Which of the following commands would you issue to display the contents of a data stream?

A. C:\>ECHO text_message > myfile.txt:stream1
B. echo text > program:source_file
C. C:\MORE < myfile.txt:stream1
D. myfile.dat:stream1

Question #4
In a large-scale healthcare breach in Boston, forensic investigators must archive several terabytes of compromised patient records for long-term evidence preservation. Since the data will be written once as forensic images and accessed infrequently, analysts require the storage technology that offers maximum capacity at lower cost, even if endurance and performance are reduced. What type of NAND flash memory is in the seized SSD best meets this forensic requirement?

A. Multi-level cell (MLC)
B. Triple-level cell (TLC)
C. Quad-level cell (QLC)
D. Single-level cell (SLC)

Question #5
During a forensic investigation, an examiner is analyzing a suspect's Windows machine and needs to locate the Windows shortcut files (LNK files) that might provide information about recently opened files. Which directory location should the examiner examine to find these LNK files?

A. C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\cookies.sqlite
B. C:\Users\Admin\AppDatal\Local\Microsoft\Windows\History
C. C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent
D. C:\Users\Admin\AppDatal\Local\Microsoft\Windows\WebCache

Solutions: