2026 New 312-49v11 Dumps – Real EC-COUNCIL Exam Questions [Q90-Q114]

QUESTION 90
During a breach investigation on a macOS workstation, analysts suspect that a threat actor leveraged previously saved application credentials to access internal services without re-entering authentication details. Investigators need to identify where macOS persistently stores protected access material used by applications, servers, and websites so they can assess potential credential reuse. Where should investigators focus their analysis?

QUESTION 91
Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling It. the dates and times when it Is being handled, and the place of storage of the evidence. What do you call this document?

QUESTION 92
Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ?

QUESTION 93
An investigator is assigned to a complex cybercrime case involving unauthorized access to sensitive and confidential data stored on a corporate server. The investigation is being conducted in a jurisdiction with strict privacy laws and digital evidence guidelines, while the suspect is located in a different jurisdiction that adheres to its own set of privacy and evidence laws. The investigator must gather and preserve evidence from the suspect’s devices using specialized digital forensic tools. However, the investigator faces significant challenges as they navigate the differing legal frameworks that govern the collection and handling of digital evidence across the two jurisdictions.
As part of the investigation, the investigator uses forensic tools to create forensic images of the suspect’s devices and to gather data from the breached systems. Due to the differences in legal requirements, the investigator is unsure of how to ensure compliance with both jurisdictions’ laws while maintaining the integrity of the evidence. Which legal challenge might the investigator face in this case when handling the evidence?

QUESTION 94
In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file var/log/dmesg?

QUESTION 95
While working for a prosecutor, What do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense ?

QUESTION 96
A considerable data breach has struck a global company, leading to the unfortunate loss of confidential data. The corporation’s Cybersecurity unit now faces the task of conducting a deep- dive investigation into this incident. Their findings suggest that advanced hacking tools were utilized in the breach, with the attack seemingly initiated from inside the organization itself. Based on this information which statement best describes the type of cybercrime and the potential challenge in this forensic investigation?

QUESTION 97
In a corporate setting, a Security Operations Center (SOC) is responsible for monitoring and protecting the organization’s digital assets. Consider a situation where an organization is experiencing a series of suspicious network activities. The SOC team needs to identify the appropriate technology to detect and mitigate these potential threats effectively. Which technology should the SOC team primarily utilize to monitor and analyze security events in real time?

QUESTION 98
This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

QUESTION 99
You are a forensic analyst working on a case of a possible cyber-attack on a bank ‘ s network. You have been provided an image of the suspected machine for examination. To ensure a thorough investigation, you decided to use Autopsy for file system analysis. However, the image is huge, and manually sifting through the data could take weeks. What Autopsy feature can be utilized to expedite the analysis process?

QUESTION 100
Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?

QUESTION 101
Olivia, a forensic investigator, is analyzing the behavior of malware that was executed on a compromised Windows system. During her investigation, she discovers that the malware made several changes to the system registry to ensure its persistence. Olivia wants to focus on the areas of the registry most likely to have been targeted by the malware to automatically execute upon system startup. Which registry keys should Olivia focus on to track malware persistence through auto-start functionality? analyzing the behavior of malware that was executed on a compromised Windows system. During her investigation, she discovers that the malware made several changes to the system registry to ensure its persistence. Olivia wants to focus on the areas of the registry most likely to have been targeted by the malware to automatically execute upon system startup. Which registry keys should Olivia focus on to track malware persistence through auto start functionality?

QUESTION 102
During a malware investigation on a Linux server in Phoenix, investigators suspect that the malicious process is making frequent system calls to access protected resources. To analyze this behavior, they decide to trace and log the system calls made by the process. Which strace command provides a summary count of time, calls, and errors for each system call?

QUESTION 103
An experienced computer forensics investigator, Vince, was tasked with examining digital evidence associated with a serious corporate cybercrime. He successfully seized and bagged the evidence but faced logistical difficulties and workforce concerns for its onsite examination. He decided to transport the evidence to the lab for further analysis. In light of his decision, which of the following precautions is the least relevant to ensure the integrity of the evidence during its transportation?

QUESTION 104
At a multi-agency digital-forensics laboratory in Denver, Colorado, investigators must extract evidence from a drone, a smart TV, and a wearable device as part of a joint investigation. The devices span heterogeneous consumer and embedded platforms, and the team requires a single forensic solution capable of performing both low-level and filesystem-level acquisition across this mixed environment without switching between specialized tools. Which tool best meets these requirements?

QUESTION 105
A large multinational corporation, specializing in financial services, recently experienced a potential data breach that affected their critical business systems. As part of the forensic investigation, the organization must quickly restore its servers, both fully and at a granular level, to determine the extent of the breach and verify the integrity of sensitive financial data. The forensic team needs a comprehensive and reliable tool that can perform full image-level backups of their servers, as well as allow for selective file and folder restores in order to investigate individual systems and recover specific documents and configuration files. The tool should be able to handle both physical and virtual environments efficiently, ensuring minimal downtime and accurate data recovery.
Given the organization’s need for rapid and reliable recovery, the forensic team must choose a tool that can restore entire systems in case of failure while also offering the flexibility to restore individual files or folders from the backup image. This capability is critical for isolating the compromised systems and recovering vital business records that may have been affected by the breach. The organization requires a solution that not only restores data but also provides the ability to maintain business continuity during the investigation, ensuring that systems are up and running as quickly as possible while maintaining forensic integrity.
Which of the following forensic tools would be best suited for this task?

QUESTION 106
What encryption technology is used on Blackberry devices Password Keeper?

QUESTION 107
As part of a digital investigation, a forensic expert needs to analyze a server suspected of hosting illicit content. The server has multiple volumes and partitions. To proceed with the analysis, the investigator needs to gather evidence from a location on the server where user files, documents, and system metadata are typically stored.
Which of the following storage locations should the investigator primarily focus on for this purpose?

QUESTION 108
Data files from original evidence should be used for forensics analysis

QUESTION 109
A packet is sent to a router that does not have the packet destination address in its route table, how will the packet get to its proper destination?

QUESTION 110
During a cybercrime investigation, investigators obtain a warrant to search a suspect’s computer system for evidence of hacking activities. As they collect data from the suspect’s electronic devices, they inadvertently access information revealing the identities of other users connected to the system.
Which step in the cybercrime investigation process raises concerns related to privacy issues?

QUESTION 111
A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evidence1.doc, sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin, what will happen to the data?

QUESTION 112
Jack is reviewing file headers to verify the file format and hopefully find more Information of the file. After a careful review of the data chunks through a hex editor; Jack finds the binary value Oxffd8ff. Based on the above Information, what type of format is the file/image saved as?

QUESTION 113
Cybercriminals sometimes use compromised computers to commit other crimes, which may involve using computers or networks to spread malware or Illegal Information. Which type of cybercrime stops users from using a device or network, or prevents a company from providing a software service to its customers?

QUESTION 114
In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims. What is the difference between pharming and phishing attacks?