We're so confident of our products that we provide no hassle product exchange.
EC-Council CHFI Exam Certification Details:
| Exam Code | 312-49 |
| Exam Name | EC-Council Computer Hacking Forensic Investigator (CHFI) |
| Books / Training | Courseware |
| Number of Questions | 150 |
| Schedule Exam | Pearson VUE |
| Sample Questions | EC-Council CHFI Sample Questions |
| Duration | 240 mins |
| Exam Price | $600 (USD) |
| Passing Score | 70% |
Reference: https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/
EC-Council 312-49 Exam Details
The EC-Council 312-49 test has 150 questions and runs for 4 hours. It can be taken at ECC exam centers around the world and it is only meant for candidates who are 18 years & above and have also satisfied other qualification requirements. Like most of the EC-Council exams, the passing score can be anything from 60% to 78% depending on the difficulty level of the test questions. Also, the vendor has the authority to annul your certificate if you fail to comply with the stipulated guidelines. For that reason, it makes more sense to check out the official certification page before you register for the actual evaluation.
EC-COUNCIL 312-49 Exam Overview:
| Certification Vendor: | EC-Council |
|---|---|
| Exam Name: | EC-Council Computer Hacking Forensic Investigator (CHFI) Exam |
| Exam Number: | 312-49 |
| Exam Duration: | 240 minutes |
| Available Languages: | English |
| Exam Price: | Approx. USD 500 (varies by region) |
| Real Exam Qty: | 150 (may vary by version) |
| Exam Format: | Scenario-based Questions, Multiple Choice |
| Passing Score: | 70% |
| Related Certifications: | Certified Ethical Hacker (CEH) |
| Certificate Validity Period: | 3 years |
| Recommended Training: | CHFI Official Training |
| Exam Registration: | EC-Council Certification Registration |
| Sample Questions: | EC-COUNCIL 312-49 Sample Questions |
| Exam Way: | Online proctored exam or authorized testing center |
| Pre Condition: | Recommended knowledge of information security fundamentals or CEH certification is suggested |
| Official Syllabus URL: | https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/ |
Official Training Course: Computer Hacking Forensic Investigator
The official training class for the Computer Hacking Forensic Investigator is available at EC-Council’s iClass learning platform. Particularly, it is an all-inclusive learning program that covers different forensic investigation situations to help reinforce the knowledge of exam topic areas. Here, you will work with standard forensic investigation tools and equipment to ensure you have the skills to manage or complete a successful investigation. In a nutshell, this class gives you a methodological approach to the field of forensic investigation, covering the popular concepts of acquisition, chain of custody, searching along with seizing, reporting digital evidence, and preservation. With a wide range of course demo videos and exhaustive coverage of the knowledge areas, this is one of the best training options that candidates can enroll in to pass the actual exam effortlessly.
EC-COUNCIL 312-49 Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: File System and Operating System Forensics | - Windows Forensics - Linux and Mac Forensics |
| Topic 2: Computer Forensics Fundamentals | - Legal and Ethical Issues in Forensics - Introduction to Digital Forensics |
| Topic 3: Advanced Forensic Techniques | - Cloud and Mobile Forensics - Malware and Dark Web Investigations - Anti-Forensics and Data Hiding Techniques |
| Topic 4: Network and Internet Forensics | - Web and Email Investigations - Network Traffic Analysis |
| Topic 5: Computer Evidence Collection | - Storage Media Analysis - Data Acquisition and Duplication Techniques |
| Topic 6: Forensic Investigation Process | - Incident Response and Evidence Handling - Forensic Documentation and Reporting |
EC-COUNCIL Computer Hacking Forensic Investigator Sample Questions:
Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?
- A. DFS Encryption
- B. SDW Encryption
- C. IPS Encryption
- D. EFS Encryption
Correct Answer: D 🗳️
What method of copying should always be performed first before carrying out an investigation?
- A. System level copy
- B. Parity-bit copy
- C. Bit-stream copy
- D. MS-DOS disc copy
Correct Answer: C 🗳️
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that?
- A. RestrictAnonymous must be set to " 2 " for complete security
- B. RestrictAnonymous must be set to " 3 " for complete security
- C. RestrictAnonymous must be set to " 10 " for complete security
- D. There is no way to always prevent an anonymous null session from establishing
Correct Answer: A 🗳️
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?
- A. International mobile subscriber identity (IMSI)
- B. Equipment Identity Register (EIR)
- C. Integrated circuit card identifier (ICCID)
- D. International Mobile Equipment Identifier (IMEI)
Correct Answer: D 🗳️
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.
He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?
- A. Those connections are in timed out/waiting mode
- B. Those connections are in closed/waiting mode
- C. Those connections are established
- D. Those connections are in listening mode
Correct Answer: D 🗳️
Viewing page 1 out of 107 pages.
Viewing questions 1-5 out of 534 questions.
By Ronald
