Free 312-49v10: Computer Hacking Forensic Investigator Exam Questions and Answers
Computer Hacking Forensic Investigator is exam 312-49v10, part of EC-Council certification. EC-Council codes run three digits, a hyphen and two more, where the prefix marks the family — 212 for technician level, 312 for the main practitioner range including CEH, 712 for the executive CCISO — and the version is appended to the code rather than changing it. Formats differ sharply: some are four-hour multiple-choice papers, while CPENT is a 24-hour hands-on exam with a written report due within seven days.
Candidates comparing 312-49v10 exam dumps, ExamTopics and other 312-49v10 practice tests use this page for the answers and explanations behind each question. Download the free 312-49v10 PDF, then sit the timed 312-49v10 exam simulation before booking with ECCouncil.
Last updated: September 30, 2026
- Exam code
- 312-49v10
- Provider
- ECCouncil
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Official page
- Official Exam website
- Our test mode duration & pass mark
- 130 mins · 70%
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #8
The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. (Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 From the options given below choose the one which best interprets the following entry: Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53
Correct answer: B
Explanation
The nops-x86 signature flags a long run of no-operation instructions, the classic sled used to land a buffer overflow exploit. It is not an evasion technique, a DNS zone transfer, or a file retrieval.
Continue with 312-49v10: Computer Hacking Forensic Investigator
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in 312-49v10: Computer Hacking Forensic Investigator, the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Discussion
Explain your reasoning, not just the letterMore 312-49v10 questions
- Question 1Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its…
- Question 2What will the following URL produce in an unpatched IIS Web Server? http://www.thetargetsite.com/scripts/..%…
- Question 3Law enforcement officers are conducting a legal search for which a valid warrant was obtained. While conducting the…
- Question 4You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the…
- Question 5The objective of this act was to protect consumers’ personal financial information held by financial institutions and…
All 312-49v10: Computer Hacking Forensic Investigator practice questions →
Other ECCouncil certifications
- 312-50v11: Certified Ethical Hacker v11 Exam (opens in a new tab)
- 312-50v12: Certified Ethical Hacker v12 Exam (opens in a new tab)
- 712-50: EC-Council Certified CISO (opens in a new tab)
- 312-50: CEH Certified Ethical Hacker (312-50v9) (opens in a new tab)
- 312-50v13: Certified Ethical Hacker v13 (opens in a new tab)
- 212-89: EC-Council Certified Incident Handler (opens in a new tab)
Reviews
Write a review★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit SharmaVerified buyer
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar NyströmVerified buyer
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah SmithVerified buyer
FAQ
Learn More: https://cert.eccouncil.org/
- Q1: Is CHFI v10 still the current version of the exam?
- A: As of October 2026 EC-Council sells CHFI v11 courseware and describes v11 as the latest CHFI syllabus, so v11 is the current programme version. The exam code is still 312-49 and the format has not changed: 150 questions in four hours.
- Q2: How many questions are on the CHFI exam and how long do I get?
- A: The real exam has 150 multiple-choice questions and a four-hour time limit. It is delivered through EC-Council's own ECC Exam Portal.
- Q3: What is the passing score for the CHFI 312-49 exam?
- A: EC-Council does not use a single fixed pass mark. Each exam form has its own cut score set by subject-matter experts, and depending on which form you receive the pass mark ranges from 60% to 85%.
- Q4: How much does the CHFI exam cost?
- A: The CHFI exam voucher costs 650 USD from EC-Council and is valid for one year from the date it is issued. Self-study candidates who skip official training also pay a non-refundable 100 USD application fee, and an official retake voucher is 399 USD.
- Q5: What are the eligibility requirements for the CHFI exam?
- A: You qualify either by completing official EC-Council CHFI training through an accredited training centre, iClass or an approved academic institution, or by applying with proof of at least two years of work experience in information security and paying the 100 USD application fee.
- Q6: How is the CHFI exam delivered and can I take it from home?
- A: The exam is taken online through EC-Council's exam portal with a remote proctor; EC-Council says all of its exams can be proctored virtually. Unlike the CEH exam, the CHFI exam is not offered at Pearson VUE test centres.
- Q7: What happens if I fail the CHFI exam? What is the retake policy?
- A: There is no waiting period before your second attempt. You must wait 14 days before the third, fourth and fifth attempts, you cannot take the exam more than five times in 12 months, and a 12-month wait applies before a sixth attempt.
- Q8: How long is the CHFI certification valid and how do I renew it?
- A: CHFI falls under EC-Council's continuing education policy, which requires 120 credits per certification within a three-year period, earned and recorded each calendar year. Certified members also pay an annual membership fee of 80 USD.
- Q9: What is the 312-49v10: Computer Hacking Forensic Investigator exam?
- A: 312-49v10: Computer Hacking Forensic Investigator is a ECCouncil certification exam. Judging by the questions in our bank, it concentrates on evidence, forensics, computer, investigation and portscan.
- Q10: What topics does the 312-49v10: Computer Hacking Forensic Investigator exam cover?
- A: Questions in our 312-49v10: Computer Hacking Forensic Investigator bank cluster around evidence, forensics, computer, investigation, portscan, dns-version-query, investigator and crime. Working through the full set is the quickest way to find which of these you are weakest on.
- Q11: How should I prepare for 312-49v10: Computer Hacking Forensic Investigator?
- A: Work through the 312-49v10: Computer Hacking Forensic Investigator practice questions here, checking your answer on each one, then sit the practice test to rehearse the exam under timed conditions before the real thing.
- Q12: Are these real 312-49v10: Computer Hacking Forensic Investigator exam questions?
- A: They are drawn from officially released past questions and from community members who have sat 312-49v10: Computer Hacking Forensic Investigator. Answers are verified and updated weekly.
- Q13: Where do I register for the 312-49v10: Computer Hacking Forensic Investigator exam?
- A: Register through ECCouncil directly at https://cert.eccouncil.org/. Exampractice is not affiliated with ECCouncil and does not administer the exam.
- Q14: Is there a free 312-49v10: Computer Hacking Forensic Investigator sample?
- A: Yes. Every 312-49v10: Computer Hacking Forensic Investigator page shows a free sample of real questions. Upgrading opens the full bank and the practice test.
- Q15: What are EC-Council Certification Exams?
- A: EC-Council Certification Exams validate your expertise in various aspects of cybersecurity, including ethical hacking, network security, and forensic investigation. These certifications demonstrate your proficiency in identifying, preventing, and mitigating cyber threats.
- Q16: Why should I pursue EC-Council Certification?
- A: EC-Council Certification enhances your professional credibility, showcasing your skills and knowledge in cybersecurity. This can lead to better job opportunities, higher salaries, and career advancement in the IT and cybersecurity industries.
- Q17: What are the benefits of EC-Council Certification?
- A: Benefits include recognition as a certified cybersecurity professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest cybersecurity trends and best practices.
- Q18: Who should take EC-Council Certification Exams?
- A: IT professionals, security analysts, ethical hackers, network administrators, and anyone involved in protecting and securing information systems should consider these certifications to validate their expertise and advance their careers.
- Q19: What types of EC-Council Certification Exams are available?
- A: EC-Council offers various certification paths, including:
- Q20: How do I prepare for EC-Council Certification Exams?
- A: Preparation can include official EC-Council training courses, study guides, practice exams, online tutorials, and hands-on experience in cybersecurity practices.
- Q21: Where can I take EC-Council Certification Exams?
- A: EC-Council Certification Exams can be taken at authorized Pearson VUE testing centers worldwide or online, providing flexibility to fit your schedule and location.
- Q22: How do EC-Council Certifications impact my career?
- A: EC-Council Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in cybersecurity and IT.
- Q23: Are there any prerequisites for EC-Council Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior certifications. Check the specific requirements for each certification path on the EC-Council website.
- Q24: How often do I need to recertify for EC-Council Certifications?
- A: EC-Council Certifications typically require recertification every three years to ensure that certified professionals stay updated with the latest cybersecurity technologies and industry practices.