| Exam Code/Number: | 312-49v11Join the discussion |
| Exam Name: | Computer Hacking Forensic Investigator (CHFI-v11) |
| Certification: | EC-COUNCIL |
| Question Number: | 637 |
| Publish Date: | Nov 10, 2026 |
|
Rating
100%
|
|
As a forensic investigator specializing in cybersecurity, you've been assigned to analyze a suspicious PDF document named "infected.pdf." This document was discovered on a company server and is suspected to contain malicious scripts that could pose a threat to the organization's systems and network. As part of your investigation into the PDF document, what initial step would you take to identify potential malicious components within the file?
Thomas, a cybersecurity analyst, is investigating a potential intrusion into a web server after receiving an alert for suspicious activity. Upon reviewing the IIS logs, he notices an unusually high number of requests coming from the same IP address within a short time period. These requests are spread across various times during the day and seem to target multiple resources on the server. Thomas suspects that the requests may be part of a larger attempt to scan for vulnerabilities or exploit a specific weakness. Which of the following log fields should Thomas focus on to better understand the nature of these requests?
During a mobile fraud investigation in Atlanta, Georgia, analysts review a compromised Android handset's startup artifact. The timeline shows that, after the kernel initializes, a component preloads core libraries and then rapidly creates new application processes on demand to handle user activity. To pinpoint the element responsible for spawning those app processes during the boot sequence, which Android component should investigators focus on?
During a digital-forensic investigation at a financial company in San Jose, California, analysts discover that the first 512-byte sector of a suspect's hard disk has been overwritten by a malicious installer. After hardware checks complete, the system cannot locate the operating system or transfer control to the startup program on the active partition. Based on the structures found in this sector, which component's corruption most likely caused the failure?
A cybersecurity incident at a Boston-based healthcare provider forced the response team into action. They quickly assigned roles, prioritized critical systems for protection, notified executives, and began containing the threat. After removing the malicious code, they restored affected services and later conducted a lessons-learned review. Which structured approach best describes the complete method they are following?
EC-COUNCIL.312-49v11.v2026-05-19.q364
May 19, 2026
EC-COUNCIL.312-49v11.v2025-11-20.q250
Nov 20, 2025
