Free ECCouncil 312-49v11 Practice Exam with Questions & Answers | Set: 8

This question aligns with CHFI v11 objectives under Operating System Forensics and Live Data Acquisition . When investigating a compromised Windows system, collecting volatile data such as running processes and active services is critical, as this information exists only in memory and can be lost if the system is shut down. CHFI v11 emphasizes the use of native, low-impact system utilities during live forensic response to minimize changes to the system state.

The tasklist command is a built-in Windows utility that displays a list of currently running processes along with associated process IDs (PIDs), memory usage, and service relationships. It is specifically designed for real-time process enumeration and is commonly used in forensic investigations to identify suspicious or malicious processes with minimal system interaction. Because tasklist is native to Windows, it does not introduce external binaries that could alter evidence integrity.

ExifTool is used for metadata analysis, Wireshark captures network traffic rather than process data, and Hexinator is a hex editor used for file-level analysis, not live process enumeration. Therefore, in accordance with CHFI v11 best practices for volatile evidence collection on Windows systems, tasklist is the correct and most forensically sound tool for this scenario.

This scenario directly aligns with CHFI v11 objectives under Data Acquisition and Duplication and Digital Forensic Imaging and Recovery Tools . In large-scale enterprise investigations—especially within financial institutions—CHFI v11 emphasizes the importance of tools that support full disk imaging, rapid system recovery, and granular restoration to ensure both forensic analysis and business continuity.

Macrium Reflect Server is specifically designed for server environments and supports full image-level backups, differential and incremental imaging, and selective file and folder recovery from forensic images. This allows investigators to restore entire systems to operational status quickly while simultaneously extracting specific files, logs, or configuration data needed to assess breach impact and verify data integrity. Importantly, Macrium Reflect supports both physical and virtual systems, making it suitable for complex enterprise infrastructures.

Snagit and Ezvid are multimedia screen-recording tools with no forensic or recovery capability, while VMware vSphere Hypervisor is a virtualization platform rather than a forensic imaging or recovery solution. CHFI v11 stresses that appropriate tool selection is critical to preserving evidence integrity while minimizing operational downtime. Therefore, Macrium Reflect Server is the most suitable and CHFI-aligned tool for rapid, reliable, and forensically sound system and data recovery in this scenario.

Option A is correct because CHFI v11 gives strong importance to legal and ethical handling of evidence , especially in contexts where data may contain personal or sensitive information. The blueprint explicitly includes seeking consent , best practices for handling digital evidence , legal issues, privacy issues and legal compliance , preserving evidence , and chain of custody . These requirements apply directly to mobile devices, which often contain highly private data and therefore demand careful lawful handling.

Obtaining permission from the device owner , or otherwise ensuring proper legal authority, is foundational to admissibility and professional forensic practice. Just as important, the evidence collection process must comply with applicable regulations and be documented properly. CHFI also covers the mobile forensics process and stresses that sound forensic work requires procedure, documentation, and defensible evidence handling.

Option B may sometimes be operationally useful, but failing to document the action is a major forensic weakness. Option C ignores tool suitability and legal compliance. Option D directly undermines admissibility because undocumented collection damages evidentiary credibility. Therefore, the most CHFI-aligned and legally defensible response is to obtain permission and ensure the process complies with relevant legal requirements.

Option B. RAID 3 is the correct answer because the question describes a RAID level that uses byte-level striping with a dedicated parity disk and requires at least three disks . That combination matches RAID 3. CHFI v11 explicitly includes RAID Storage System , RAID and Virtualization , and the broader understanding of storage structures under digital evidence fundamentals, so candidates are expected to recognize RAID types and how they affect evidence acquisition and recovery.

The key clues are the dedicated parity drive and the fact that the system can continue functioning after a single disk failure . RAID 3 is designed to provide fault tolerance for one failed drive by reconstructing data from the remaining striped disks and the parity information. This makes it different from RAID 0 , which has no redundancy, RAID 1 , which mirrors data rather than using dedicated parity, and RAID 10 , which combines striping and mirroring in a different way.

Because the scenario precisely describes byte-level striping plus one parity disk with single-disk fault tolerance, RAID 3 is the only answer that fully fits the described configuration.

According to the CHFI v11 Cloud Computing Threats and Attacks module, a Wrapping Attack (also known as a SOAP wrapping attack ) is a well-documented vulnerability that targets SOAP-based web services commonly used in cloud environments. This attack exploits weaknesses in how XML signatures are validated within SOAP messages.

In a wrapping attack, the adversary intercepts a legitimate SOAP message , duplicates or modifies the message body , and then reinserts it into the SOAP envelope while preserving the original digital signature. Because some SOAP implementations validate only the signature and not the exact structure or position of the message body, the server mistakenly processes the attacker-controlled payload as if it originated from an authenticated user. This allows the attacker to execute unauthorized actions or malicious code within the cloud service.

CHFI v11 explicitly identifies wrapping attacks as a serious threat to cloud-based web services , especially those relying on SOAP and XML security mechanisms. The attack directly aligns with the scenario described: interception, duplication of the SOAP message body, impersonation of a legitimate user, and unauthorized access.

The other options are unrelated: Domain sniffing involves intercepting DNS traffic, cybersquatting targets domain name registration abuse, and domain hijacking involves taking control of a domain. None involve SOAP message manipulation.

Therefore, the cloud-based attack performed in this scenario—fully aligned with CHFI v11 documentation—is a Wrapping attack , making Option D the correct answer.

According to the CHFI v11 Procedures and Methodology domain, evidence preservation is a critical step in the forensic investigation process and is closely tied to maintaining a proper chain of custody . Preservation ensures that digital evidence remains unaltered, authentic, and legally admissible from the moment it is collected until it is presented in court or a disciplinary proceeding.

In the given scenario, the investigator is documenting every action , assigning unique identifiers , and maintaining a chain of custody log that records who handled the evidence, when it was handled, and for what purpose. CHFI v11 explicitly defines these actions as part of the evidence preservation phase , which occurs immediately after evidence identification and collection. This phase is designed to prevent evidence tampering, loss, contamination, or misidentification.

The other options do not align with the described activities. Scoping focuses on defining investigation boundaries, data analysis involves examining evidence for findings, and search and seizure refers to the legal act of collecting evidence—none of which emphasize documentation and custody tracking.

CHFI v11 stresses that failure to properly preserve evidence and document its handling can result in evidence being challenged or ruled inadmissible . Therefore, the investigator’s actions clearly correspond to preserving the evidence , making Option A the correct and CHFI v11–verified answer.

According to the CHFI v11 Computer Forensics Fundamentals and Evidence Handling and Sanitization guidelines, media sanitization is a critical process used to ensure that deleted or sensitive data cannot be recovered using forensic techniques. Different international standards define specific overwrite patterns and the number of passes required to securely sanitize storage media.

The procedure described— six overwrite passes alternating between 0x00 and 0xFF, followed by a final overwrite with 0xAA —exactly matches the VSITR (Verschlusssache IT Richtlinien) standard. VSITR is a German government–approved data sanitization method that mandates 7 overwrite passes :

Passes 1–6: Alternating 0x00 and 0xFF

Pass 7: Final overwrite with the pattern 0xAA

CHFI v11 explicitly references VSITR as a high-assurance sanitization standard , suitable for environments handling classified or highly sensitive information. This method is more rigorous than commonly used standards such as DoD 5220.22-M , which typically uses 3 passes (or a legacy 7-pass variant with different patterns). NAVSO P-5239-26 (MFM) uses different overwrite schemes, and GOST P50739-95 generally involves fewer passes.

From a forensic and legal standpoint, following a recognized sanitization standard like VSITR demonstrates due diligence, compliance, and defensibility , especially when preventing data leakage after incidents.

Therefore, based on the overwrite pattern and number of passes described, the media sanitization standard followed by Sarah is VSITR , making Option C the correct and CHFI v11–verified answer.

The correct answer is D because Keychain is the macOS secure storage mechanism used to hold sensitive credentials and other protected secrets. Apple states that Keychain stores website usernames and passwords, and related secure information such as credit card details, while Keychain Access on Mac allows viewing keys, certificates, and other stored items. That matches the scenario exactly. CHFI v11 includes macOS forensic data, log files, and directories, so candidates are expected to know where valuable user authentication material and confidential account data are stored. Apple Mail contains email artifacts, Time Machine contains backup history, and plist files store many configuration details, but none of those is the primary encrypted credential container described in the question. From a forensic perspective, Keychain can be highly significant in data-theft, access-abuse, and credential-misuse investigations because it may reveal stored account relationships and secrets relevant to attacker activity or user actions. When the exam asks for the macOS source that securely holds account names, passwords, and other confidential values, the answer is Keychain.

Option A is the most advisable answer because CHFI v11 explicitly includes “Investigating Brute Force Attack and Cookie Poisoning Attack” and also covers tools to examine the cache, cookie, and history recorded in web browsers and private browsing and browser artifact recovery . These objectives reflect the forensic importance of cookies and the risks associated with manipulated or abused session data.

If Alice is concerned that stored session cookies may be unsafe or tampered with, the safest immediate user action is to clear the cookies, log out, and re-authenticate carefully . That reduces the risk of relying on an existing persistent session that may have been compromised or altered. It is a direct action tied to the actual risk described.

MFA is a good security practice overall, but it is not the most immediate next step once the concern is already about an active remembered session. Creating a new account does not address the underlying issue. Using a VPN or privacy extension does not neutralize a potentially unsafe session cookie. Therefore, the most sensible action is to clear cookies and log out before proceeding .

According to the CHFI v11 Mobile and IoT Forensics domain, the primary mechanism used by telecommunications service providers to verify user identity during call setup is the use of IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) . These identifiers are fundamental to cellular network authentication and subscriber management.

The IMSI uniquely identifies the subscriber and is stored on the SIM card, while the IMEI uniquely identifies the mobile device itself. During call setup, the cellular network authenticates the subscriber by validating the IMSI against the provider’s Home Location Register (HLR) or Home Subscriber Server (HSS). Simultaneously, the IMEI is checked to ensure the device is legitimate and not blacklisted. CHFI v11 highlights these identifiers as critical forensic artifacts for subscriber attribution, call detail record (CDR) analysis, and location tracking .

The other options are incorrect because call duration and call content are not used for identity verification. Monitoring call content is also restricted due to privacy and legal constraints. Tracking location alone does not establish identity; it only provides positional data once authentication has already occurred.

CHFI v11 emphasizes that IMSI and IMEI correlation is essential for mobile forensics investigations, enabling investigators to link calls, devices, locations, and subscribers accurately. Therefore, the correct and CHFI v11–verified mechanism for ensuring user identity during call setup is utilizing IMSI and IMEI information , making Option D the correct answer.