Eccouncil Certified Ethical Hacker certification as a profession has an incredible evolution over the last few years. Eccouncil EC1-349 Computer Hacking Forensic Investigator Certification exam is forerunner in validating credentials against. Here are updated Eccouncil EC1-349 exam questions, which will help you to test the quality features of DumpsSchool exam preparation material completely free. You can purchase the full product once you are satisfied with the product.
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
A. Keep the device powered on
B. Turn off the device immediately
C. Remove the battery immediately
D. Remove any memory cards immediately
What hashing method is used to password protect Blackberry devices?
You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?
A. The registry
B. The swapfile
C. The recycle bin
D. The metadata
With regard to using an antivirus scanner during a computer forensics investigation, you should:
A. Scan the suspect hard drive before beginning an investigation
B. Never run a scan on your forensics workstation because it could change your system configuration Never run a scan on your forensics workstation because it could change your system? configuration
C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
D. Scan your forensics workstation before beginning an investigation
What layer of the OSI model do TCP and UDP utilize?
A. Data Link
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?
When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?
A. On the individual computer ARP cache On the individual computer? ARP cache
B. In the Web Server log files
C. In the DHCP Server log files
D. There is no way to determine the specific IP address
What type of equipment would a forensics investigator store in a StrongHold bag?
B. Backup tapes
C. Hard drives
D. Wireless cards
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?
B. Protocol analyzer
D. Disk editor
If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?
A. Lossful compression
B. Lossy compression
C. Lossless compression
D. Time-loss compression
When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the ?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote?
A. The year the evidence was taken
B. The sequence number for the parts of the same exhibit
C. The initials of the forensics analyst
D. The sequential number of the exhibits seized
You are working in the Security Department of a law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server?