Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. EC0-349

EC-Council EC0-349 Exam Questions
EC0-349 ECCouncil Computer Hacking Forensic Investigator (Page 16 )

Updated On: 24-Feb-2026
Page 15 of 76
PDF with 374 Questions

This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

  1. Disk Operating System (DOS)
  2. Master File Table (MFT)
  3. Master Boot Record (MBR)
  4. File Allocation Table (FAT)

Answer(s): D



Which of the following is NOT a graphics file?

  1. Picture1.tga
  2. Picture3.nfo
  3. Picture4.psd
  4. Picture2.bmp

Answer(s): B



_____________ is simply the application of computer investigation and analysis techniques in the interests of determining potential legal evidence.

  1. Event reaction
  2. Network forensics
  3. Incident response
  4. Computer forensics

Answer(s): D



If you discover a criminal act while investigating a corporate policy abuse, it becomes a public sector investigation and should be referred to law enforcement?

  1. True
  2. False

Answer(s): A



Volatile memory is one of the leading problems for forensics. Worms such as Code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?

  1. Use intrusion forensic techniques to study memory resident infections
  2. Create a separate partition of several hundred megabytes and place the swap file there
  3. Use VMware to be able to capture the data in memory and examine it
  4. Give the operating system a minimal amount of memory, forcing it to use a swap file

Answer(s): B






Post your Comments and Discuss EC-Council EC0-349 exam dumps with other Community members:

Join the EC0-349 Discussion