EC-COUNCIL CHFI (312-49) CERTIFICATION SAMPLE
QUESTIONS AND ANSWERS
01. The file content of evidence files can be viewed using the View Pane. The View pane provides several
tabs to view file content. Which of this tab provides native views of formats supported by Oracle outside
in technology?
a) Text tab
b) Hex tab
c) Doc tab
d) Picture tab - CORRECT ANSWER✅✅✅Answer:
c) Doc tab
02. During live response, you can retrieve and analyze much of the information in the Registry, and the
complete data during post-mortem investigation.
Which of this registry Hive contains configuration information relating to which application is used to
open various files on the system?
a) HKEY_USERS
b) HKEY_CURRENT_USER
c) HKEY_CLASSES_ROOT
d) HKEY_CURRENT_CONFIG - CORRECT ANSWER✅✅✅Answer:
c) HKEY_CLASSES_ROOT
03. Which one of the following is the smallest allocation unit of a hard disk, which contains a set of
tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme?
a) Sector
b) Cluster
QUESTIONS AND ANSWERS
01. The file content of evidence files can be viewed using the View Pane. The View pane provides several
tabs to view file content. Which of this tab provides native views of formats supported by Oracle outside
in technology?
a) Text tab
b) Hex tab
c) Doc tab
d) Picture tab - CORRECT ANSWER✅✅✅Answer:
c) Doc tab
02. During live response, you can retrieve and analyze much of the information in the Registry, and the
complete data during post-mortem investigation.
Which of this registry Hive contains configuration information relating to which application is used to
open various files on the system?
a) HKEY_USERS
b) HKEY_CURRENT_USER
c) HKEY_CLASSES_ROOT
d) HKEY_CURRENT_CONFIG - CORRECT ANSWER✅✅✅Answer:
c) HKEY_CLASSES_ROOT
03. Which one of the following is the smallest allocation unit of a hard disk, which contains a set of
tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme?
a) Sector
b) Cluster
