[Jan 04, 2025] 100% Pass Guarantee for EC0-349 Dumps with Actual Exam Questions
Today Updated EC0-349 Exam Dumps Actual Questions
EC0-349 Exam topics
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our EC0-349 exam dumps will include the following topics:
- Digital Forensics 25%
- Forensic Science 15%
- Tools/Systems/ Programs 10%
NEW QUESTION # 161
Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?
- A. Authentication
- B. Certification
- C. Justification
- D. Reiteration
Answer: A
NEW QUESTION # 162
Which of the following is not correct when documenting an electronic crime scene?
- A. Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer
- B. Document the physical scene, such as the position of the mouse and the location of components near the system
- C. Write down the color of shirt and pant the suspect was wearing
- D. Document related electronic components that are difficult to find
Answer: C
NEW QUESTION # 163
The following excerpt is taken from a honeypot log. The log captures activities across three days.
There are several intrusion attempts; however, a few are successful.
(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.) Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from
194.222.156.169
Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 ->
172.16.1.107:482
Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 ->
172.16.1.107:53
Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval:
194.222.156.169:1425 -> 172.16.1.107:21
Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from
24.9.255.53
Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 ->
172.16.1.107:53
Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 ->
172.16.1.101:53
Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 ->
172.16.1.107:111
Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard:
198.173.35.164:4221 -> 172.16.1.107:80
Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 ->
172.16.1.101:53
Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 ->
172.16.1.107:53
Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for
user simple by (uid=0)
Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user
simon by simple(uid=506)
Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 ->
172.16.1.107:1080
Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23
-> 213.28.22.189:4558
From the options given below choose the one which best interprets the following entry:
Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 ->
172.16.1.107:53
- A. A DNS zone transfer
- B. Data being retrieved from 63.226.81.13
- C. An IDS evasion technique
- D. A buffer overflow attempt
Answer: C
NEW QUESTION # 164
John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents?
- A. Cris-cross shredder
- B. Strip-cut shredder
- C. Cross-hatch shredder
- D. Cross-cut shredder
Answer: D
NEW QUESTION # 165
What stage of the incident handling process involves reporting events?
- A. Identification
- B. Containment
- C. Recovery
- D. Follow-up
Answer: A
NEW QUESTION # 166
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?
- A. Unvalidated input
- B. Parameter/form tampering
- C. Security misconfiguration
- D. Directory traversal
Answer: D
NEW QUESTION # 167
The police believe that Melvin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies. What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?
- A. The USA patriot Act
- B. The Fourth Amendment
- C. The Federal Rules of Evidence
- D. The Good Samaritan Laws
Answer: B
NEW QUESTION # 168
You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are required MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered?
- A. Competitive exploit
- B. Information vulnerability
- C. Trade secret
- D. Social engineering exploit
Answer: B
NEW QUESTION # 169
Before you are called to testify as an expert, what must an attorney do first?
- A. prove that the tools you used to conduct your examination are perfect
- B. engage in damage control
- C. qualify you as an expert witness
- D. read your curriculum vitae to the jury
Answer: C
NEW QUESTION # 170
In a FAT32 system, a 123 KB file will use how many sectors?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
Answer: C
Explanation:
If you assume that we are using 512 bytes sectors, then 123x1024/512 = 246 sectors would be needed.
NEW QUESTION # 171
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?
- A. Keep the device powered on
- B. Turn off the device immediately
- C. Remove the battery immediately
- D. Remove any memory cards immediately
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 172
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures, such as AP MAC filters and Wi-Fi port access controls.
Which of the following wireless access control attacks allows the attacker to set up a rogue access point outside the corporate perimeter, and then lure the employees of the organization to connect to it?
- A. War driving
- B. Client mis-association
- C. MAC spoofing
- D. Rogue access points
Answer: B
NEW QUESTION # 173
In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves?
- A. STOP packets to all other routers warning of where the attack originated
- B. The change in the routing fabric to bypass the affected router
- C. RESTART packets to the affected router to get it to power back up
- D. More RESET packets to the affected router to get it to power back up
Answer: B
NEW QUESTION # 174
Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?
- A. 18 U.S.C. 2511
- B. 18 U.S.C. 2703
- C. 18 U.S.C. 1029
- D. 18 U.S.C. 1362
Answer: C
NEW QUESTION # 175
What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?
- A. mcopy
- B. MD5
- C. dd
- D. image
Answer: C
Explanation:
Explanation
NEW QUESTION # 176
When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel?
- A. Multiple access points can be set up on the same channel without any issues
- B. So that the access points will work on different requencies
- C. Avoid over-saturation of wireless signals
- D. Avoid cross talk
Answer: D
NEW QUESTION # 177
What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?
- A. Internet service provider information
- B. Firewall log
- C. E-mail header
- D. Username and password
Answer: C
NEW QUESTION # 178
During the course of a corporate investigation, you find that an Employee is committing a crime.
Can the Employer file a criminal complaint with Police?
- A. No, because the investigation was conducted without following standard police procedures
- B. No, because the investigation was conducted without warrant
- C. Yes, and all evidence can be turned over to the police
- D. Yes, but only if you turn the evidence over to a federal law enforcement agency
Answer: C
NEW QUESTION # 179
You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?
- A. The Host Domain Name
- B. The X509 Address
- C. The E-mail Header
- D. The SMTP reply Address
Answer: C
NEW QUESTION # 180
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows
2000 sever the course of its lifetime?
- A. comparison of MD5 checksums
- B. review of SIDs in the Registry
- C. analysis of volatile data
- D. forensic duplication of hard drive
Answer: A
NEW QUESTION # 181
What does mactime, an essential part of the coroner's toolkit do?
- A. It traverses the file system and produces a listing of all files based on the modification, access and change timestamps
- B. It is too specific to the MAC OS and forms a core component of the toolkit
- C. It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them
- D. The tools scans for i-node information, which is used by other tools in the tool kit
Answer: A
NEW QUESTION # 182
You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company.
The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:
- A. Make you an agent of law enforcement
- B. Write information to the subject's hard drive
- C. Cause network congestion
- D. Violate your contract
Answer: A
NEW QUESTION # 183
Which of the following would you consider an aspect of organizational security, especially focusing on IT security?
- A. Information copyright security
- B. Security from frauds
- C. Application security
- D. Biometric information security
Answer: C
NEW QUESTION # 184
......
Books for Becoming Exam-Ready
To tame the EC-Council EC0-349 exam, it is suggested that the test-taker access only quality and verified study materials. Admittedly, Amazon is the powerhouse of such resources and never disappoints any applicants. Thus, we have hand-picked the following materials for you:
- Learn Computer Forensics
To know every bit of computer forensics, we recommend this book. William Oettinger is the author of this wonderful revision guide and lets a computer forensic beginner become a skilled specialist in no time. In addition, it is known to stratify the needed information for readers by all means and almost a 5-star rating is the biggest proof of this. Significantly, the core techniques of computer forensics are covered perfectly in this book. Plus, features like focus on key topics and review questions at the end make it stand out from the crowd.
- Computer Forensics: Investigating Wireless Networks and Devices
You can’t miss this guide as it is offered by EC-Council itself. No wonder why it has scored 5 stars on Amazon. It is not a single book but a series of manuals that includes 5 books. All these five books cover a broad spectrum of knowledge for the CHFI test in a precise manner. In all, it exposes the test-taker with every essential expertise in such areas as attacks, legal evidence, computer investigation & analysis, etc.
- Official CHFI Study Guide
This book is our first choice as it features the learning in a structured & logical sequence and throws light on every bit of the exam domains. It is because many minds worked together to create this work-of-art. Its authors are Dave Kleiman, Craig Wright, Jesse "James" Varsalone, Timothy Clinton, and Michael Gregg. In particular, candidates love the way the writers have presented the exam objectives incorporated in the chapter’s beginning, which really saves crucial time for them. More so, crucial learning points, notes, and alerts are highlighted here so that one doesn’t have to make added efforts. In addition, there are review questions to test the learner’s understanding in real time. In a nutshell, this is definitely a good investment that one can make towards an impressive career beginning so passing EC0-349 with such awesome material will be a walk in the park.
- CHFI Computer Hacking Forensic Investigator Certification All-in-One Exam Guide
Once you have this book, nothing else is required. It is packed with all the crucial knowledge that any EC0-349 aspirant has to acquire to weave success. What’s more, with the help of 300 practice questions, this book prepares the test-taker for the final exam in the best possible way. Such a dependable manual comes from the house of Charles Brooks and has already helped tons of specialists in a smooth career beginning. We highly recommend this one if clearing EC0-349 in the first attempt is your aim.
EC0-349 exam dumps with real EC-COUNCIL questions and answers: https://www.actual4test.com/EC0-349_examcollection.html
EC0-349 Exam in First Attempt Guaranteed: https://drive.google.com/open?id=1cf2rbXN76sa3wCRzJgJ9XIDndtK8RXGu