EC-Council 312-49 Practice Test

312-49 practice test: what's covered

• Forensic process
• Chain of custody
• Disks & file systems
• Acquisition
• Anti-forensics
• Windows/Linux/Mac
• Network
• Malware
• Web/email/cloud
• Mobile/IoT
• Dark web
• Reporting

Free 312-49 sample questions

1. A corporate investigator is asked to define the goal of a forensic examination so the legal team understands its purpose. Which statement BEST describes the primary objective of computer forensics?

   • A. To identify, preserve, recover, analyze and present digital evidence in a manner that is legally admissible
   • B. To patch the vulnerability that allowed the breach as quickly as possible
   • C. To restore the affected systems to production with minimal downtime
   • D. To attribute the attack to a nation-state for media disclosure
   Show answer

   Correct: A. Computer forensics centers on the lawful identification, preservation, recovery, analysis and presentation of digital evidence so it holds up in court. Patching and system restoration are incident-response/IT goals, not the forensic objective, and attribution for media is not the purpose.

2. An investigator must explain why following a defined methodology matters when handling evidence destined for litigation. Which principle states that any contact with a crime scene leaves a trace and the investigator may also alter it?

   • A. Locard's Exchange Principle
   • B. The Daubert Standard
   • C. The Best Evidence Rule
   • D. The Chain of Custody
   Show answer

   Correct: A. Locard's Exchange Principle holds that any contact transfers traces, so investigators must minimize and document changes. Daubert governs expert-testimony admissibility, Best Evidence concerns producing originals, and chain of custody tracks handling — none describe the exchange of trace evidence.

3. A forensic readiness program is being designed for an enterprise. What is the MAIN benefit of building forensic readiness BEFORE an incident occurs?

   • A. It maximizes the ability to collect admissible evidence while minimizing investigation cost and business disruption
   • B. It guarantees that no breach can ever happen again
   • C. It removes the need to maintain chain of custody during a case
   • D. It eliminates the requirement for trained forensic analysts
   Show answer

   Correct: A. Forensic readiness pre-positions logging, retention and procedures so evidence can be gathered admissibly at low cost and disruption. It does not prevent breaches, does not remove chain-of-custody duties, and does not replace skilled analysts.

4. First responders arrive at a scene where a desktop is powered ON and displaying an open encrypted volume. Per forensic best practice for a live, running machine that may hold volatile or encrypted data, what should they do FIRST?

   • A. Capture the volatile data and a memory image of the running system before considering shutdown
   • B. Immediately pull the power cord to freeze the disk state
   • C. Run chkdsk to verify the file system is healthy
   • D. Reboot the machine into a forensic live CD to image the disk
   Show answer

   Correct: A. A running machine with an open encrypted volume risks losing keys and RAM artifacts if powered off, so volatile/memory capture comes first (order of volatility). Pulling power loses the mounted-key state, chkdsk writes to the disk, and rebooting destroys volatile evidence.

5. An analyst documents every person who handled a seized drive, with dates, times and purpose, from seizure through court. This unbroken record exists primarily to establish which property of the evidence?

   • A. That the evidence is authentic and was not altered or tampered with
   • B. That the evidence was acquired with the fastest possible tool
   • C. That the suspect confessed to the activity
   • D. That the drive was wiped before imaging
   Show answer

   Correct: A. Chain of custody proves integrity and authenticity — that the evidence presented is the same as seized and was not tampered with. It says nothing about tool speed, confessions, or wiping; in fact a wiped source drive would destroy the evidence.

Last updated: 2026-10-19

312-49 practice test FAQ

Related practice tests

• CEH 312-50 practice test
• EC-Council CND-312-38 practice test
• EC-Council CSA-312-39 practice test