Online Access Free EC0-349 Practice Test

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

• A.He should search in C:\Windows\System32\RECYCLED folder
• B.Only FAT system contains RECYCLED folder and not NTFS
• C.The Recycle Bin does not exist on the hard drive
• D.The files are hidden and he must use switch to view themThe files are hidden and he must use ?
  switch to view them

Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers?hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

• A.Place PDA, including all devices, in an antistatic bag
• B.Unplug all connected devices
• C.Power off all devices if currently on
• D.Photograph and document the peripheral devices

Networks are vulnerable to an attack which occurs due to overextension of bandwidth, bottlenecks, network data interception, etc.
Which of the following network attacks refers to a process in which an attacker changes his or her IP address so that he or she appears to be someone else?

• A.IP address spoofing
• B.Man-in-the-middle attack
• C.Denial of Service attack
• D.Session sniffing

Which part of the Windows Registry contains the user's password file?

• A.HKEY_CURRENT_CONFIGURATION
• B.HKEY_CURRENT_USER
• C.HKEY_LOCAL_MACHINE
• D.HKEY_USER

Deposition enables opposing counsel to preview an expert witness's testimony at trial. Which of the following deposition is not a standard practice?

• A.Opposing counsel asks questions
• B.Both attorneys are present
• C.Only one attorneys is present
• D.No jury or judge