Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. EC0-349

EC-Council EC0-349 Exam Questions
EC0-349 ECCouncil Computer Hacking Forensic Investigator (Page 3 )

Updated On: 24-Feb-2026
Page 3 of 76
PDF with 374 Questions

The use of warning banners helps a company avoid litigation by overcoming an employees assumed _____________when connecting to the company’s intranet, network, or virtual private network (VPN) and will allow the company’s investigators to monitor, search, and retrieve information stored within the network.

  1. right of privacy
  2. right to Internet access
  3. right to work
  4. right of free speech

Answer(s): A



When examining a hard disk without a write-blocker, you should not start Windows because Windows will write data to the:

  1. Case files
  2. Recycle Bin
  3. BIOS
  4. MSDOS.SYS

Answer(s): B



How many sectors will a 125 KB file use in a FAT32 file system?

  1. 16
  2. 25
  3. 256
  4. 32

Answer(s): C



Which part of the Windows Registry contains the user's password file?

  1. HKEY_CURRENT_CONFIGURATION
  2. HKEY_USER
  3. HKEY_CURRENT_USER
  4. HKEY_LOCAL_MACHINE

Answer(s): B



You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a simple backup copy will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

  1. incremental backup copy
  2. full backup copy
  3. robust copy
  4. bit-stream copy

Answer(s): D






Post your Comments and Discuss EC-Council EC0-349 exam dumps with other Community members:

Join the EC0-349 Discussion