HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Duration: 4 hours
Official exam questions: 150 multiple-choice questions
Passing score: Varies by exam form
Exam voucher: $650 for the listed remotely proctored voucher; other options may vary.

Course Questions

10 Questions

A company suspects that an employee copied confidential files before leaving. What should the investigator do FIRST?

A. Search the employee's personal accounts B. Preserve relevant evidence and document authorization and scope C. Delete the employee's workstation D. Interview every employee before securing evidence

Which mechanism best helps demonstrate that a forensic image has not changed since acquisition?

A. A screenshot of the desktop B. A cryptographic hash calculated at acquisition and verified later C. A filename containing the date D. A verbal statement from the analyst

Why must each transfer of a seized device be recorded?

A. To make the device boot faster B. To document who controlled the evidence and when C. To avoid calculating hashes D. To replace acquisition notes

An investigator needs to examine a suspect drive without altering its contents. Which practice is best?

A. Browse the original drive directly B. Use a validated write blocker and create a forensic image C. Run cleanup utilities first D. Defragment the drive

A powered-on computer may contain encryption keys and active network sessions. What should the investigator consider?

A. Immediately remove power in every case B. Collect volatile data using an approved procedure before shutdown when justified C. Wipe RAM before imaging D. Ignore system state

A file is deleted from a file system, but its content may remain in unallocated space. What should the analyst examine?

A. Only the desktop wallpaper B. Unallocated space and file-system metadata C. The monitor refresh rate D. The printer queue only

Which Windows artifact can help reconstruct recently accessed files and user activity?

A. ShellBags and relevant registry/user activity artifacts B. Only the screen saver image C. The monitor serial number D. A router's Wi-Fi password

An analyst is building a timeline across multiple hosts. What is most important for correlating timestamps?

A. Synchronize clocks and account for time zones and clock drift B. Convert every timestamp to an arbitrary local time C. Discard log metadata D. Use file names as the only time source

A packet capture is needed to determine which host transferred a large amount of data externally. What should be examined?

A. Source/destination addresses, ports, timing, protocols, and transfer volume B. Only the capture file name C. Keyboard layout D. Monitor brightness

An email may be spoofed. Which evidence is especially useful to inspect?

A. Full headers, authentication results, routing fields, and message content B. The sender's display name alone C. The font size only D. The recipient's wallpaper

₹2999.00 ₹999.00

Enroll Now

Computer Hacking Forensic Investigator (CHFI)