Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

ECCouncil Computer Hacking Forensic Investigator

Last Update 16 hours ago Total Questions : 150

The ECCouncil Computer Hacking Forensic Investigator content is now fully updated, with all current exam questions added 16 hours ago. Deciding to include EC0-349 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our EC0-349 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these EC0-349 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any ECCouncil Computer Hacking Forensic Investigator practice test comfortably within the allotted time.

Question # 4

Why should you never power on a computer that you need to acquire digital evidence from?

A.

When the computer boots up, files are written to the computer rendering the data nclean?When the computer boots up, files are written to the computer rendering the data ?nclean

B.

When the computer boots up, the system cache is cleared which could destroy evidence

C.

When the computer boots up, data in the memory buffer is cleared which could destroy evidenceWhen the computer boots up, data in the memory? buffer is cleared which could destroy evidence

D.

Powering on a computer has no affect when needing to acquire digital evidence from it

Question # 5

Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob? testimony in this case?

A.

Justification

B.

Authentication

C.

Reiteration

D.

Certification

Question # 6

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

A.

On the individual computer ARP cacheOn the individual computer? ARP cache

B.

In the Web Server log files

C.

In the DHCP Server log files

D.

There is no way to determine the specific IP address

Question # 7

What advantage does the tool Evidor have over the built-in Windows search?

A.

It can find deleted files even after they have been physically removed

B.

It can find bad sectors on the hard drive

C.

It can search slack space

D.

It can find files hidden within ADS

Question # 8

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

A.

The file is erased and cannot be recovered

B.

The file is erased but can be recovered partially

C.

A copy of the file is stored and the original file is erased

D.

Only the reference to the file is removed from the FAT and can be recovered

Question # 9

What hashing method is used to password protect Blackberry devices?

A.

AES

B.

RC5

C.

MD5

D.

SHA-1

Question # 10

What is the CIDR from the following screenshot?

A.

/24A./24A./24

B.

/32 B./32 B./32

C.

/16 C./16 C./16

D.

/8D./8D./8

Go to page: