Online Access Free EC-COUNCIL.312-49v11.v2025-07-29.q428 Practice Test (Page 60)

312-49v11 Exam Question 291

An investigator is analyzing EXIF metadata in a case involving cybercrime. She finds that the timestamp data has been modified, potentially misleading the investigation. What is the best next step she should take in her forensic examination?

A.Discard the EXIF metadata as it has been tampered with and is no longer useful

B.Change the focus of the investigation, as tampered EXIF metadata indicates a false lead

C.Accept the tampered EXIF metadata as it's the only information available

D.Validate the EXIF metadata with other sources of information to corroborate its accuracy

312-49v11 Exam Question 292

"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?

A.Principle 3

B.Principle 1

C.Principle 4

D.Principle 2

312-49v11 Exam Question 293

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

A.A Capital X

B.A Blank Space

C.The Underscore Symbol

D.The lowercase Greek Letter Sigma (s)

312-49v11 Exam Question 294

Which of the following is not a part of disk imaging tool requirements?

A.The tool should log I/O errors in an accessible and readable form, including the type and location of the error

B.The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source

C.The tool should not change the original content

D.The tool must have the ability to be held up to scientific and peer review

312-49v11 Exam Question 295

In Windows, prefetching is done to improve system performance. There are two types of prefetching:
boot prefetching and application prefetching.
During boot prefetching, what does the Cache Manager do?

A.Determines the data associated with value EnablePrefetcher

B.Checks hard page faults and soft page faults

C.Monitors the first 10 seconds after the process is started

D.Checks whether the data is processed

Other Version: 240EC-COUNCIL.312-49v11.v2026-05-11.q71

Latest Upload: 122Microsoft.AB-731.v2026-06-19.q23; 232IIA.IIA-CIA-Part2.v2026-06-19.q308; 154DAMA.MD-1220.v2026-06-19.q66; 126ISTQB.CT-AI.v2026-06-18.q68; 242IIA.IIA-CIA-Part3.v2026-06-17.q220; 166WGU.Introduction-to-IT.v2026-06-17.q67; 206CompTIA.220-1202.v2026-06-16.q110; 139TheInstitutes.CPCU-500.v2026-06-16.q25; 219ACAMS.CAMS7-CN.v2026-06-16.q170; 272CBIC.CIC.v2026-06-15.q123

312-49v11 Exam Question 291

312-49v11 Exam Question 292

312-49v11 Exam Question 293

312-49v11 Exam Question 294

312-49v11 Exam Question 295

Download PDF File