VCE EC1-349 Eccouncil Computer Hacking Forensic Investigator Certification Real Exam Question And Answers

Eccouncil Certified Ethical Hacker certification as a profession has an incredible evolution over the last few years. Eccouncil EC1-349 Computer Hacking Forensic Investigator Certification exam is forerunner in validating credentials against. Here are updated Eccouncil EC1-349 exam questions, which will help you to test the quality features of DumpsSchool exam preparation material completely free. You can purchase the full product once you are satisfied with the product.

Question: 1

If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?

A. Keep the device powered on
B. Turn off the device immediately
C. Remove the battery immediately
D. Remove any memory cards immediately

Answer: A

Question: 2

What hashing method is used to password protect Blackberry devices?

B. RC5
C. MD5
D. SHA-1

Answer: D

Question: 3

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

A. The registry
B. The swapfile
C. The recycle bin
D. The metadata

Answer: B

Question: 4

With regard to using an antivirus scanner during a computer forensics investigation, you should:

A. Scan the suspect hard drive before beginning an investigation
B. Never run a scan on your forensics workstation because it could change your system configuration Never run a scan on your forensics workstation because it could change your system? configuration
C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
D. Scan your forensics workstation before beginning an investigation

Answer: D

Question: 5

What layer of the OSI model do TCP and UDP utilize?

A. Data Link
B. Network
C. Transport
D. Session

Answer: C

Question: 6

When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

A. One
B. Two
C. Three
D. Four

Answer: B

Question: 7

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

A. On the individual computer ARP cache On the individual computer? ARP cache
B. In the Web Server log files
C. In the DHCP Server log files
D. There is no way to determine the specific IP address

Answer: C

Question: 8

What type of equipment would a forensics investigator store in a StrongHold bag?

B. Backup tapes
C. Hard drives
D. Wireless cards

Answer: D

Question: 9

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

A. Write-blocker
B. Protocol analyzer
C. Firewall
D. Disk editor

Answer: A

Question: 10

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

A. Lossful compression
B. Lossy compression
C. Lossless compression
D. Time-loss compression

Answer: B

Question: 11

When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?

A. The year the evidence was taken
B. The sequence number for the parts of the same exhibit
C. The initials of the forensics analyst
D. The sequential number of the exhibits seized

Answer: D

Question: 12

You are working in the Security Department of a law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server?

A. 10
B. 25
C. 110
D. 135

Answer: B

Click Below Link to Get All Eccouncil EC1-349 Exam Questions: