nerdexam
EC-CouncilEC-Council

312-49 · Question #392

312-49 Question #392: Real Exam Question with Answer & Explanation

Sign in or unlock 312-49 to reveal the answer and full explanation for question #392. The question stem and answer options stay visible for context.

Submitted by lars.no· Apr 18, 2026Disk Forensics

Question

An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

Options

  • AEFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
  • BThe EFS Revoked Key Agent can be used on the computer to recover the information
  • CWhen the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you
  • DWhen the encrypted file was copied to the floppy disk, the EFS private key was also copied to the

Unlock 312-49 to see the answer

You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#EFS#NTFS#File Encryption#Data Recovery
Full 312-49 PracticeBrowse All 312-49 Questions