EC-COUNCIL 312-49v11 問題集

質問 1：
You ' re a digital forensics investigator tasked with analyzing a bitmap image file (BMP) to gather information about its structure and contents. Understanding the file structure and data components is essential for conducting a thorough analysis. Which component of a bitmap image file contains data about the type, size, and layout of the file?
A. File header
B. RGBQUAD array
C. Information header
D. Image data
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
During a post-incident investigation at an energy company, analysts are tasked with identifying coordinated malicious activity by examining security data generated from multiple control points, including network defenses and server systems. The investigation requires a platform that can ingest diverse event sources, relate activity across those sources as it occurs, and surface actionable findings to support analyst-led investigation through a unified interface. How should analysts enable this type of real-time, cross-source event analysis and investigation?
A. ELK Stack Elasticsearch, Logstash, Kibana
B. OSSEC HIDS
C. IBM QRadar
D. ManageEngine EventLog Analyzer
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
James is a seasoned digital forensic investigator at an international law firm dealing with a convoluted case of industrial espionage. The attacker, believed to be a disgruntled former employee, allegedly used a sophisticated network of compromised internal and external systems to steal sensitive data. Multiple jurisdictions and regulations are involved, with systems located in various countries. The firm's legal team is concerned about the rules of evidence and obtaining the necessary warrants for search and seizure across different legal systems. To make matters more complex, some of the firm's clients are refusing to give consent for James to access and investigate their systems, further complicating the evidence-gathering process. What should James ' s initial approach be in such a complex scenario?
A. Forego the search warrants and start the investigation based on available data
B. Proceed to access the clients ' systems covertly, as the firm owns the data
C. Work with the legal team to understand and respect each jurisdiction ' s laws and seek necessary warrants
D. Limit the investigation to the firm ' s internal systems to avoid legal complications
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
In a high-stakes antitrust case at a multinational corporation headquartered in Chicago, Illinois, the legal team is facing processing delays and budget scrutiny. The forensic coordinator is asked to implement an oversight control that will track all activities and changes during the process, ensuring transparency and liability, without interrupting ongoing review. Which foundational practice should be established as a core element of the eDiscovery oversight framework?
A. Maintain chain of custody
B. Define metrics and KPIs
C. Track costs
D. Audit trails
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
During a targeted phishing follow-up at a financial firm in New York, forensic analysts parse a compromised endpoint ' s raw Event Log File Format records to validate a timeline. They need to differentiate per-event timestamps from overall file-level status flags to see whether late writes occurred around shutdown. In this format, which component provides the per-event timestamps needed for that comparison?
A. EVENTLOGRECORD structure
B. ELF_LOGFILE_HEADER structure
C. ELF_LOGFILE_HEADER_WRAP
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Alice, a seasoned iOS developer, dives into her latest project, an immersive gaming app. She delves into utilizing cutting-edge technologies like OpenGL ES, OpenAL, and AV Foundation. As the lines of code intertwine with her creativity, she inches closer to realizing her dream of delivering an app that mesmerizes users on every level. Which layer of the iOS architecture is Alice primarily focusing on for implementing functionalities?
A. Core Services Layer
B. Media Services Layer
C. Cocoa Touch Layer
D. Core OS Layer
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
During a malware investigation at a tech firm in Miami, forensic analysts suspect that the attacker attempted to conceal activity by removing traces of previously executed programs on the compromised workstation.
What source of evidence would best allow investigators to reconstruct execution activity and attempts to remove traces of prior programs?
A. Clipboard contents
B. Openfiles command output
C. Prefetch files
D. Hash values
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
During a financial-records tampering case in Denver, Colorado, forensic examiners struggle to analyze digital evidence because the suspect used advanced anti-forensic measures that have corrupted file integrity, renamed key data sets, and encrypted drives. Which challenge best illustrates the type of obstacle caused by anti- forensics in such investigations?
A. Creating falsified evidence can redirect investigators to the wrong conclusion
B. Intentional data corruption weakens the integrity and reliability of digital evidence
C. Modifying timestamps eliminates server logging, thereby erasing digital footprints
D. Files obfuscated with packer programs can avoid detection by anti-malware tools
正解：B
解説: (Topexam メンバーにのみ表示されます)