ECCouncil EC1-349 Computer Hack Forensic Investigator Exam

Sample Questions

Q) What is the first step required to prepare the computer forensics?

a) Do not turn on the computer or run any program, or attempt to gain access to the data on the computer

b) Secure all relevant media

c) Hang the automated document destruction and recycling policies that can be applied to all relevant media or on the users

d) Determine the type of data that is necessary, the information you are looking for, and the urgency level examination

e) None

Q) Network Detective can be defined as sniffing, registration, collection and analysis of network traffic and event logs to investigate the incident of network security.

a) TRUE

b) FALSE

Q) Which of the following commands show the names of all open shared files on a server and the number of file locks per file?

a) Net sessions POS ~~ = Trunc

b) Net ~~ POS = TRUNC file

c) NETCONFIG

d) net share

e) None

Q) Rubbish as a metaphor to throw away the files, but it also allows the user to retrieve and restore files. When a file is moved to the Trash, the record is added to the log file, found in the trash. Which of these files contain records corresponding to each of the deleted file in the trash?

a) info2 file

b) info1 file

c) LOGINFO2 file

d) LOGINFO1 file

e) None