2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

EC-Council 312-49v11 CHFI v11 Exam Practice Questions, practice question pack
EC-COUNCIL · 312-49v11 CHFI v11

EC-Council 312-49v11 CHFI v11 Exam Practice Questions

99% pass rateUpdated 1 Nov 2026452 questions2 PDFs, instant download
5.02 reviews
(2 customer reviews)

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
I passed CHFI v11 312-49v11 exam with 95%.
Roderick312-49v11 CHFI v11
Category:
TRY BEFORE YOU BUY

Three of the 452 questions in this pack

Question 1

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded.

What can the investigator do to prove the violation?

  1. Image the disk and try to recover deleted files
  2. Seek the help of co-workers who are eye-witnesses
  3. Check the Windows registry for connection data (you may or may not recover)
  4. Approach the website's administrator for evidence
Show answer and explanation

Correct answer: A. Image the disk and try to recover deleted files

Clearing browser history, emptying the cookie store and deleting images removes the file system references, but the underlying data usually stays on the disk until it is overwritten. By creating a forensic image of the drive and examining it with recovery and carving tools, the investigator can retrieve the deleted images, cached web content and history records from unallocated space and file slack. Working on the image rather than the original preserves the evidence, and the recovered files show directly what the suspect downloaded, which is the proof the policy case needs.

Why the other options are wrong

  • B. Co-workers can only describe what they think they saw and cannot show which sites were visited or which images were downloaded.
  • C. Registry entries such as typed URLs hold at most traces of browsing and cannot restore the deleted images themselves.
  • D. A website administrator outside the organization has no obligation to cooperate, and server-side logs say nothing about files stored on the suspect's machine.

Question 2

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved.

What should you examine next in this case?

  1. The registry
  2. The swap file
  3. The recycle bin
  4. The metadata
Show answer and explanation

Correct answer: B. The swap file

A document that is created and printed but never saved exists only in RAM while the user works on it. When physical memory runs short, Windows pages parts of RAM out to the swap file (pagefile.sys), so fragments of open documents, print jobs and application data can land on disk even though no file was ever written. Because the swap file is outside the normal user data files, a search of saved documents misses it, and it is the logical next place to look for traces of the unauthorized cheques.

Why the other options are wrong

  • A. The registry stores configuration and usage settings, not the contents of documents that were created and printed.
  • C. The Recycle Bin only holds files that were saved and then deleted, so a file that was never saved cannot appear there.
  • D. Metadata describes existing files, and a document that was never saved has no file on disk to carry metadata.

Question 3

Which of the following are small pieces of data sent from a website and stored on the user’s computer by the user’s web browser to track, validate, and maintain specific user information?

  1. Temporary Files
  2. Open files
  3. Cookies
  4. Web Browser Cache
Show answer and explanation

Correct answer: C. Cookies

Cookies are small pieces of data that a website sends to the browser, which stores them on the user's computer and returns them on later requests to the same site. They hold session identifiers, login state, preferences and tracking identifiers, which lets a site recognize, validate and follow a user across visits. For an investigator, cookies reveal which sites a user visited, when cookies were created or last accessed, and sometimes account details, making them a valuable browser artifact alongside history and cache.

Why the other options are wrong

  • A. Temporary files are working files created by applications and the operating system, not data a website sets to identify a user.
  • B. Open files are files currently in use by running programs, a live system state rather than data stored by the browser for a website.
  • D. The browser cache stores copies of pages, images and scripts to speed up loading, not values the site uses to track and validate the user.

See all 113 free questions Get the full pack, US$39

REVIEWS

2 reviews for EC-Council 312-49v11 CHFI v11 Exam Practice Questions

  1. Roderick –

    I passed CHFI v11 312-49v11 exam with 95%.

  2. Norma Ray –

    I struggled with some complex topics but the explanations in these 312-49v11 dumps made everything so much simpler. Thank you soo much Cert Stash.

Only logged in customers who have purchased this product may leave a review.

How much of the EC-Council 312-49v11 CHFI v11 bank is free?

452 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 11325% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 15133% of the bankHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 452100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the EC-Council 312-49v11 CHFI v11 pack

  • 452 questions mapped to the CHFI v11 exam blueprint
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A 312-49 attempt costs US$650. This pack is US$39, paid once.

What makes the CHFI hard

CHFI v11 is the current version and it is a long exam: 150 questions over four hours, with a passing score set per exam form somewhere between 60% and 85%. The v11 update brought in dark web investigations, IoT and OT forensics, fileless malware and AI-assisted forensics, so a v9 or v10 bank leaves gaps exactly where the newest questions sit.

Digital Forensics is the biggest domain at 29%: Windows, Linux and macOS artefacts, file systems including NTFS MFT records, slack space and carving, memory forensics, network forensics, malware forensics, and cloud, mobile, IoT, OT and dark web evidence.

Digital Evidence at 18% covers acquisition, imaging, hashing, chain of custody and anti-forensics, and Procedures and Methodology at 17% is the investigation process end to end. Forensic Science, Tools, Systems and Programs, and Regulations, Policies and Ethics make up the rest. The questions are scenario heavy, so knowing which artefact answers which question matters more than memorising tool menus.

About the exam

312-49 v11 (Computer Hacking Forensic Investigator) earns the EC-Council CHFI certification. It covers forensic science, regulations and ethics, digital evidence, investigation procedures and methodology, digital forensics across operating systems, networks, malware, cloud, mobile, IoT and OT, and forensic tools. There are no prerequisites with official training; self-study candidates need two years of information security experience and an eligibility application.

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products