Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. EC0-349

EC-Council EC0-349 Exam Questions
EC0-349 ECCouncil Computer Hacking Forensic Investigator (Page 14 )

Updated On: 24-Feb-2026
Page 14 of 76
PDF with 374 Questions

In the context of file deletion process, which of the following statement holds true?

  1. When files are deleted, the data is overwritten and the cluster marked as available
  2. Secure delete programs work by completely overwriting the file in one go
  3. The longer a disk is inuse, the less likely it is that deleted files will be overwritten
  4. While booting, the machine may create temporary files that can delete evidence

Answer(s): D



If you discover a criminal act while investigating a corporate policy abuse, it becomes a public sector investigation and should be referred to law enforcement?

  1. True
  2. False

Answer(s): A



What does the acronym POST mean as it relates to a PC?

  1. PowerOn Self Test
  2. Primary Operations Short Test
  3. Pre Operational Situation Test
  4. Primary Operating System Test

Answer(s): A



Which of the following file system is used by Mac OS X?

  1. EXT2
  2. HFS+
  3. EFS
  4. NFS

Answer(s): B



A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.

  1. Approach the websites for evidence
  2. Check the Windows registry for connection data (You may or may not recover)
  3. Seek the help of co-workers who are eye-witnesses
  4. Image the disk and try to recover deleted files

Answer(s): D






Post your Comments and Discuss EC-Council EC0-349 exam dumps with other Community members:

Join the EC0-349 Discussion