312-49 — EC-Council Computer Hacking Forensic Investigator (CHFI v11)
EC-Council

EC-Council Computer Hacking Forensic Investigator (CHFI v11) (312-49) Practice Questions

★★★★★★ 4.7 50 verified reviews
177 questions
✓ Online quiz simulator
▶ Start Free Practice Exam

Sample Questions (18 of 177 shown)

Q1
When performing a forensic examination on hard drives to extract digital evidence, which type of user is most likely to have the highest amount of file slack to analyze?
  1. A user with NTFS partitions of version 4 or 5
  2. A user who makes use of dynamic swap file functionality
  3. A user who writes to the hard disk on IRQ 13 and 21
  4. A user with a large number of allocation units per block or cluster
✓ Correct Answer: D
File slack is the unused space remaining in the last cluster allocated to a file. The larger the cluster (allocation unit), the more unused space is left when a file does not fill its final cluster, so a user with large allocation units per cluster produces the most slack that may contain residual data from previously stored files.
Q2
How do evidence-handling procedures differ between criminal and civil cases?
  1. Evidence-handling procedures are identical for both types of cases
  2. The importance of evidence procedures only applies to law enforcement professionals
  3. Evidence in criminal cases requires stricter security compared to civil cases
  4. Evidence in civil cases needs to be secured more strictly than in criminal cases
✓ Correct Answer: C
Criminal cases can result in loss of liberty (imprisonment), so the law imposes stricter chain-of-custody and security controls on evidence than in civil cases, where remedies are usually monetary. A break in custody is more likely to be fatal to a criminal prosecution.
Q3
While working in a forensic lab on a significant criminal investigation, your superior is worried that the defense might challenge whether the evidence has been tampered with while in your lab. What action can you take to demonstrate that the evidence is unchanged since its arrival?
  1. Compute the MD5 hash of the evidence and compare it with the hash taken when the evidence was initially entered
  2. Compute the MD5 hash of the evidence and match it against a standard hash database provided by NIST
  3. Ignore the concern since state labs are certified
  4. Sign a declaration confirming that the evidence has not been altered during its time in the lab
✓ Correct Answer: A
Hash values (MD5/SHA) are computed at intake and again before/after analysis; if the values match, the integrity of the evidence is mathematically demonstrated. A declaration alone does not provide objective proof, and comparing against NIST databases is for known-good file verification, not custody integrity.
Q4
Given the following log entries, which firewall rule would be best to prevent these types of attacks? Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53
  1. Block incoming UDP port 53 from external sources to the DNS server
  2. Allow UDP port 53 from the DNS server to external destinations
  3. Block TCP port 53 from secondary or ISP DNS servers to the local DNS server
  4. Deny all UDP traffic
✓ Correct Answer: A
The third log line shows a DNS version query (port 53/UDP) arriving from an external host to the local DNS server—a classic reconnaissance technique. Blocking inbound UDP 53 from external sources prevents external clients from querying or fingerprinting the internal DNS server, mitigating the observed activity.
Q5
To monitor and correlate security incidents across multiple computers, it is crucial that all systems have synchronized clocks. Why is this so important?
  1. To track system performance across multiple devices
  2. To accurately reconstruct the sequence of events during an attack
  3. To ensure accurate data backups
  4. To maintain consistent time zones across the network
✓ Correct Answer: B
When logs from many devices are correlated, consistent timestamps let the investigator place events in the correct chronological order and reconstruct the attack timeline. Without time synchronization, the sequence of events cannot be reliably established.
Q6
What is the name of the protocol used to synchronize the clocks of computers on a network to ensure that their time is consistent?
  1. Global Time Protocol
  2. Network Time Protocol (NTP)
  3. Time Synchronization Service
  4. Internet Time Protocol
✓ Correct Answer: B
Network Time Protocol (NTP) is the standard Internet protocol used to synchronize computer clocks over a network, typically against hierarchical stratum time sources, which is essential for consistent forensic log correlation.
Q7
When investigating an email-related crime, which of the following is the first course of action?
  1. Trace the IP address of the sender
  2. Draft a detailed report
  3. Confirm whether a criminal act has occurred
  4. Recover the digital evidence
✓ Correct Answer: C
Before committing resources to technical acquisition, the investigator must first establish that a crime actually occurred (and its nature), because this determines jurisdiction, legal authority, and the scope of the evidence to be collected.
Q8
In digital forensics, which of the following is crucial to ensuring the integrity of the evidence collected from a crime scene?
  1. Regularly updating the software used in the investigation
  2. Maintaining a clear and documented chain of custody
  3. Immediately notifying the media about the evidence
  4. Using encryption to protect the evidence
✓ Correct Answer: B
Chain of custody is the documented, unbroken record of who collected, handled, transferred, and analyzed the evidence. A break in the chain can render evidence inadmissible, so it is the cornerstone of evidentiary integrity.
Q9
Which of the following best describes the role of a forensic investigator in the context of digital crime?
  1. To oversee the trial process
  2. To provide expert testimony regarding the digital evidence
  3. To interrogate suspects in the case
  4. To destroy compromised digital evidence once analyzed
✓ Correct Answer: B
The forensic investigator's role is to examine evidence and then explain—as a qualified expert witness—the methods used and the conclusions reached, in language the court can understand. They do not run the trial, interrogate suspects, or destroy evidence.
Q10
When conducting a forensic investigation on a compromised server, what is the most important step to take immediately after securing the scene?
  1. Power off the server to prevent further damage
  2. Create a bit-for-bit copy of the server's hard drive for analysis
  3. Restore the server's previous backup
  4. Inform the public about the breach to prevent panic
✓ Correct Answer: B
The first technical step after securing the scene is to make a verified forensic (bit-for-bit) image of the storage media so that all subsequent analysis is performed on a copy, preserving the original and allowing integrity verification with hashes.
Q11
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
  1. Data from a CD copied using Windows
  2. Data from a CD copied using a Mac-based system
  3. Data from a DVD copied using a Windows system
  4. Data from a CD copied using a Linux system
✓ Correct Answer: A
CDFS (CD-ROM File System / ISO 9660) is the standard file system written when a CD is copied/imaged using Windows. It identifies the evidence as a CD image created under Windows.
Q12
Which of the following Event Correlation Approaches is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying statistics and probability and uses only two variables?
  1. Bayesian Correlation
  2. Vulnerability-Based Approach
  3. Rule-Based Approach
  4. Route Correlation
✓ Correct Answer: A
Bayesian correlation is a probabilistic/statistical approach (based on Bayes' theorem) that uses observed variables to predict the likelihood of an attacker's next action. It is the "advanced" correlation method described in CHFI that reasons under uncertainty using two variables.
Q13
You have been asked to investigate possible computer fraud in the finance department; a staff member is suspected of printing unauthorized cheques. You have exhaustively searched all data files on a bitmap image of the target computer but found no evidence. You suspect the files may not have been saved to disk. What should you examine next?
  1. The registry
  2. The swap file
  3. The recycle bin
  4. The metadata
✓ Correct Answer: B
Data that was created or viewed but never saved to disk can still reside in the swap file (page file), where memory pages—including unsaved document content—are written. Examining the swap file can recover evidence of the unauthorized cheques.
Q14
Which MySQL log file contains information on server start and stop?
  1. Slow query log file
  2. General query log file
  3. Binary log
  4. Error log file
✓ Correct Answer: D
The MySQL error log records diagnostic messages, including information about server startup and shutdown, as well as critical errors. The other logs track queries or replication, not start/stop events.
Q15
What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024
  1. Copy the master boot record to a file
  2. Copy the contents of the system folder to a file
  3. Copy the running memory to a file
  4. Copy the memory dump file to an image file
✓ Correct Answer: C
/dev/mem is a device file representing the physical memory of the system. Using dd to read from /dev/mem writes a copy of the system's running RAM (a memory dump) to mem.bin, a common live-acquisition technique.
Q16
When an investigator contacts by telephone the domain administrator or controller listed by a Whois lookup to request that all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?
  1. Title 18, Section 1030
  2. Title 18, Section 2703(d)
  3. Title 18, Section Chapter 90
  4. Title 18, Section 2703(f)
✓ Correct Answer: D
18 U.S.C. § 2703(f) is the "preservation request" provision that requires a provider to preserve records in its possession that it believes are or will be relevant to a grand-jury, trial, or investigation, pending issuance of a court order.
Q17
How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?
  1. 128
  2. 64
  3. 32
  4. 16
✓ Correct Answer: C
MD5 produces a 128-bit (16-byte) digest, which is conventionally rendered as a 32-character hexadecimal string. The "32 characters" refers to the hex representation forensic tools display and compare.
Q18
Before you are called to testify as an expert, what must an attorney do first?
  1. Engage in damage control
  2. Prove that the tools you used to conduct your examination are perfect
  3. Read your curriculum vitae to the jury
  4. Qualify you as an expert witness
✓ Correct Answer: D
The court must first determine that the witness is qualified by knowledge, skill, experience, training, or education before permitting expert testimony. This "qualification" step precedes any substantive testimony.

You've viewed 3 of 177 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The EC-Council 312-49 exam, officially titled Computer Hacking Forensic Investigator (CHFI v11), validates a practitioner's ability to detect intrusions and methodically extract, preserve, and report digital evidence that holds up in court. Delivered through the ECC Exam Center or Pearson VUE, the test is a 150-question, four-hour multiple-choice assessment whose passing threshold is set per exam form between 60% and 85%.

CHFI targets digital forensic analysts, incident responders, malware analysts, IT auditors, and law-enforcement or legal professionals who handle electronic evidence. Candidates who complete official EC-Council training are automatically eligible, while self-study applicants must document at least two years of information-security experience and clear an eligibility application. A working grasp of Windows, Linux, and macOS internals plus basic networking and incident response is the practical starting line.

The v11 blueprint strings together forensic science, regulations and ethics, digital evidence handling, and end-to-end investigation procedures before drilling into the hands-on core: disk, file-system, and memory forensics; network, web-application, and email-crime analysis; malware, cloud, mobile, and IoT investigations; and the dark web. Defensible imaging, write-blocking, hashing, timeline reconstruction, and anti-forensics countermeasures recur across every module.

To rehearse those exact scenarios, our 312-49 practice set spans every CHFI module in proportion — from chain-of-custody and evidence acquisition through Windows, Linux, and memory forensics to network, malware, cloud, and mobile analysis. Each online practice question ships with a detailed answer explanation that traces the reasoning and flags the distractors, while the downloadable PDF packages the same bank for offline review during commutes or anywhere without stable internet.

Official Exam Domains & Weighting

To successfully pass the 312-49 (CHFI v11) exam, candidates must master the following core modules. EC-Council does not publish separate official percentages; the weights below reflect the commonly cited v11 blueprint distribution:
  • Forensic Science (15%)
Covers cybercrime categories, investigator roles and responsibilities, and the foundational principles of computer forensics and digital evidence.
  • Regulations, Policies, and Ethics (10%)
Focuses on legal frameworks, evidence admissibility, privacy law such as GLBA, and expert-witness conduct during investigations.
  • Digital Evidence (18%)
Deals with evidence types, volatility ordering (RFC 3227), acquisition and imaging, hashing and integrity verification, chain of custody, and anti-forensics countermeasures.
  • Procedures and Methodology (17%)
Walks the end-to-end investigation process: first response, search and seizure, evidence preservation, analysis, and reporting.
  • Digital Forensics (29%)
The largest module — disk, file-system (NTFS MFT records, slack space, carving), and memory forensics; network, web-application, and email-crime analysis; plus malware, cloud, mobile, IoT, and dark-web investigations.
  • Tools, Systems, and Programs (11%)
Practical use of FTK, EnCase, Autopsy, Volatility, and other forensic utilities across the investigation workflow.

What Our Customers Say 50 verified reviews

4.7 ★★★★★★ Based on 50 reviews
★★★★★★
The 312-49 practice exam was crucial to my success. The domains map perfectly to the official exam blueprint.
— Jennifer F.
★★★★★★
I let my coworker borrow my 312-49 account to study — he passed too. These questions are legit.
— Grayson P.
★★★★★★
Used this 312-49 prep extensively for three weeks. The progress tracking feature kept me accountable.
— Violet W.
★★★★★
Ended up buying three different 312-49 prep resources and this was by far the most helpful one. Don’t waste money on others.
— Penelope W.
★★★★★★
Had to renew my 312-49 certification and used this to refresh. Way more efficient than re-reading the official study guide.
— Leo D.
★★★★★★
I have tried many EC-Council practice tests and this 312-49 bank is by far the most accurate and well-organized.
— Kevin N.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

No. There is no mandatory prerequisite. Candidates who complete the official EC-Council CHFI training are automatically eligible to book the exam. Self-study candidates instead must show at least two years of information-security experience and submit an approved eligibility application (with a non-refundable fee). Our practice questions assume you already understand Windows/Linux/macOS basics and core networking, and they reinforce the forensic reasoning the exam tests rather than re-teaching those fundamentals.

It mirrors the full CHFI v11 blueprint: forensic science, regulations and ethics, digital evidence, investigation procedures and methodology, and the hands-on digital-forensics core (disk, file-system, and memory forensics; network, web, and email analysis; malware, cloud, mobile, IoT, and dark-web investigations). Scenario-style items also exercise chain-of-custody decisions, hashing and write-blocking, timeline reconstruction, and anti-forensics detection so you meet the exam across every module.

Chain of custody, evidence integrity, and legal admissibility sit at the heart of the Digital Evidence module (about 18% of the blueprint) and thread through the Regulations and Ethics module as well. The practice bank includes the corresponding scenario questions — labeling exhibits, maintaining hashes, handling volatile vs. static data, and explaining why a broken chain weakens a case — with explanations that cite the underlying principle for each correct choice.

The live exam is multiple-choice only; EC-Council does not include performance-based labs or a simulator in the 312-49 form. Our practice product follows that same format — timed multiple-choice questions with detailed answer explanations — so you train on the exact item type you will face, without any misleading "simulator" framing.

The mock exam uses the same scenario-heavy, artefact-driven style as the live test: you are asked which artifact answers a question (NTFS MFT, registry keys, memory captures, packet traces, email headers) rather than to memorize tool menus. Difficulty and topic weighting track the v11 blueprint, so a timed run surfaces your weak modules — Windows and data acquisition draw the heaviest weight — before exam day.

Yes. Every question ships with a detailed answer explanation that walks through the correct option and explains why the distractors are wrong, and the full bank is available as a downloadable PDF for offline review on a commute, flight, or anywhere without stable internet. The PDF and the online practice engine share the same questions and explanations, so progress carries over whichever format you use.

Because EC-Council sets the cut score per exam form rather than at a fixed 70%, the safest strategy is to master the high-weight modules (Digital Forensics at 29%, Digital Evidence at 18%, and Procedures at 17%) and aim well above the low end. Use the practice bank's per-module scoring to confirm strength across disk, memory, network, and malware forensics, then take timed mock runs so a tougher form's higher bar does not catch you out.