Online Access Free EC0-349 Practice Test

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

• A.BIOS
• B.Case files
• C.MSDOS.sys
• D.Recycle Bin

Billy, a computer forensics expert, has recovered a large number of DBX files during forensic investigation of a laptop. Which of the following email clients he can use to analyze the DBX files?

• A.Microsoft Outlook Express
• B.Eudora
• C.Microsoft Outlook
• D.Mozilla Thunderoird

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

• A.one who uses hard disk writes on IRQ 13 and 21
• B.one who uses dynamic swap file capability
• C.one who has lots of allocation units per block or cluster
• D.one who has NTFS 4 or 5 partitions

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

• A.Digital attack
• B.Physical attack
• C.Denial of service
• D.ARP redirect

If you discover a criminal act while investigating a corporate policy abuse, it becomes a public- sector investigation and should be referred to law enforcement?

• A.False
• B.True