Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. EC0-349

EC-Council EC0-349 Exam Questions
EC0-349 ECCouncil Computer Hacking Forensic Investigator (Page 5 )

Updated On: 24-Feb-2026
Page 5 of 76
PDF with 374 Questions

If you plan to startup a suspect's computer, you must modify the _____________to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

  1. CMOS
  2. Boot.sys
  3. deltree command
  4. Scandisk utility

Answer(s): A



The use of warning banners helps a company avoid litigation by overcoming an employees assumed _____________when connecting to the company’s intranet, network, or virtual private network (VPN) and will allow the company’s investigators to monitor, search, and retrieve information stored within the network.

  1. right of free speech
  2. right to Internet access
  3. right of privacy
  4. right to work

Answer(s): C



When obtaining a warrant it is important to:

  1. particularly describe the place to be searched and particularly describe the items to be seized
  2. particularly describe the place to be searched and generally describe the items to be seized
  3. generally describe the place to be searched and particularly describe the items to be seized
  4. generally describe the place to be searched and generally describe the items to be seized

Answer(s): A



Printing under a windows computer normally requires which one of the following files types to be created?

  1. EME
  2. CME
  3. MEM
  4. EMF

Answer(s): D



When you carve an image, recovering the image depends on which of the following skills?

  1. recognizing the pattern of the header content
  2. recognizing the pattern of the data content
  3. recognizing the pattern of a corrupt file
  4. recovering the image from a tape backup

Answer(s): A






Post your Comments and Discuss EC-Council EC0-349 exam dumps with other Community members:

Join the EC0-349 Discussion