EC-COUNCIL 312-49v11 問題集

質問 1：
Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim's computer. The investigator uses Volatility Framework to analyze RAM contents: which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?
A. malfind
B. mallist
C. pslist
D. malscan
正解：A

質問 2：
During an investigation, a forensics analyst discovers an unusual increase in outbound network traffic, network traffic traversing on non-standard ports, and multiple failed login attempts on a host system. The analyst also found that certain programs were using these unusual ports, appearing to be legitimate. If these are the primary Indicators of Compromise, what should be the next immediate step in the investigation to contain the intrusion effectively?
A. Conducting a deep dive into user-agent strings to determine if there is any spoofing of device OS and browser information
B. Enforcing stringent password policies and re-authenticating all users to prevent further login anomalies
C. Examining the logs for repeated requests for the same file, indicating a possible exploit attempt
D. Analyzing Uniform Resource Locators for any signs of phishing or spamming activities
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
During call setup, a telecommunications service provider employs a multifaceted approach to verify the identity of both the calling and called parties, ensuring the legitimacy of the users involved. Sarah, a security analyst at the provider, oversees the process, utilizing a combination of unique identifiers to obtain subscriber information and perform location tracking.
Which specific mechanism stands out as the primary means for the service provider to ensure user identity during call setup?
A. By analyzing the duration of the call.
B. By tracking the location of the caller only.
C. By monitoring the content of the call.
D. By utilizing IMSI and IMEI information.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A CHFI professional is investigating a data breach in a Windows 10 system. The initial analysis revealed some alterations in the system event logs. As part of the investigation, the professional uses the 'wevtutil' command-line tool. The command 'wevtutil gl Security' was executed, but the results seemed abnormal. Which of the following could be a plausible reason for this outcome?
A. The 'wevtutil' command cannot retrieve data from XML-based EVTX file format
B. The EVTX file storing the Security log was corrupted or tampered with
C. The command 'wevtutil gl Security' does not exist in the 'wevtutil' command set
D. The Event Log service was temporarily unresponsive or down
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
During a forensic investigation of a compromised system, the investigator is analyzing various forensic artifacts to determine the nature and scope of the attack. The investigator is specifically looking for information related to failed sign-in attempts, security policy changes, alerts from intrusion detection systems, and unusual application malfunctions.
Which type of forensic artifact is most likely to contain this critical information?
A. Cryptographic artifacts that store information about encryption and decryption operations.
B. Log file anomalies that provide detailed records of events and errors on the device.
C. Browser artifacts that track user browsing history and website interactions.
D. Process and memory artifacts that contain information about running processes and system memory.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A company's network has been compromised by a malware attack that originated from a website seemingly offering a legitimate service. The user unknowingly visited the site, and after doing so, their system began exhibiting unusual behavior. The company discovered that the malware was executed as soon as the user visited the site, without any need for further interaction. Which technique is most likely responsible for this attack?
A. Distributing malware to the target network through malvertising.
B. Using spear-phishing sites to trigger the installation of malware in the target network.
C. Leveraging Black hat SEO techniques to implant malware in the target network.
D. Installing malware on the target system via the drive-by downloads method.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
As an IoT forensic investigator, you are tasked with investigating a cybercrime involving a compromised Smart TV and other IoT devices. The investigation requires extracting data from various IoT devices, including drones, wearables, and SD cards, to gather crucial evidence. You need a tool capable of performing both physical and logical extractions from these devices, covering mobile devices running Android, iOS, Tizen OS, and chip-off memory sources. Which of the following tools would be most suitable for this investigation?
A. Systemctl
B. EpochConverter
C. DoubleSpace
D. MD-NEXT
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
A regional bank, operating across several cities, recently discovered discrepancies in account balances following routine audits. The issues were noticed across various branches, prompting an internal investigation. Upon deeper analysis, it was revealed that someone with prior authorization had altered financial records. The investigation uncovered that a former employee, whose credentials had not been deactivated after leaving the company, had retained full control over critical systems. This oversight allowed the individual to modify transactional data, leading to inaccurate financial reports and potential harm to the bank's reputation. The adjustments made by the former employee were intentional and impacted customer accounts. Despite the employee no longer being employed, the lack of action to revoke their permissions allowed these changes to occur without any barriers. What classification of cybercrimes best fits this event?
A. A breach caused by external actors bypassing firewalls.
B. An impersonation attempt using credential stuffing techniques.
C. An abuse of role-based access from within the network.
D. An authentication flaw due to expired password policies.
正解：C
解説: (Topexam メンバーにのみ表示されます)