The Best EC0-349 Exam Study Material Premium Files and Preparation Tool (Jun-2025)

Get Instant Access to EC0-349 Practice Exam Questions

NEW QUESTION # 237
Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ?

• A. Typography
• B. Steganography
• C. Steganalysis
• D. Picture encoding

Answer: B

NEW QUESTION # 238
What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?

• A. TCP header field
• B. UDP header field
• C. IP header field
• D. ICMP header field

Answer: D

Explanation:
The Ping of Death occurs when the ICMP Header field contains a packet size lager than 65507 bytes.

NEW QUESTION # 239
When investigating a Windows System, it is important to view the contents of the page or swap file because:

• A. Windows stores all of the systems configuration information in this file
• B. This is file that windows use to communicate directly with Registry
• C. This is the file that windows use to store the history of the last 100 commands that were run from the command line
• D. A Large volume of data can exist within the swap file of which the computer user has no knowledge

Answer: D

NEW QUESTION # 240
Wireless network discovery tools use two different methodologies to detect, monitor and log a WLAN device (i.e. active scanning and passive scanning). Active scanning methodology involves
____________and waiting for responses from available wireless networks.

• A. Scanning the network
• B. Sniffing the packets from the airwave
• C. Inspecting WLAN and surrounding networks
• D. Broadcasting a probe request frame

Answer: D

NEW QUESTION # 241
You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would:

• A. Cause network congestion
• B. Violate your contract
• C. Write information to the subject hard driveWrite information to the subject? hard drive
• D. Make you an agent of law enforcement

Answer: D

NEW QUESTION # 242
From the following spam mail header, identify the host IP that sent this spam?
From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT) Message-Id: >[email protected] From: "china hotel web" To: "Shlam" Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail- Priority: Normal Reply-To: "china hotel web"

• A. 8.12.1.0
• B. 137.189.96.52
• C. 203.218.39.50
• D. 203.218.39.20

Answer: D

NEW QUESTION # 243
Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?

• A. SDW Encryption
• B. DFS Encryption
• C. IPS Encryption
• D. EFS Encryption

Answer: D

NEW QUESTION # 244
What should you do when approached by a reporter about a case that you are working on or have worked on?

• A. Answer all the reporter's questions as completely as possible
• B. Refer the reporter to the attorney that retained you
• C. Say, "no comment"
• D. Answer only the questions that help your case

Answer: B

NEW QUESTION # 245
An "idle" system is also referred to as what?

• A. Zombie
• B. Bot
• C. PC not being used
• D. PC not connected to the Internet

Answer: A

NEW QUESTION # 246
The use of warning banners helps a company avoid litigation by overcoming an employees assumed _________ when connecting to the company intranet, network, or virtual private network (VPN) and will allow the company investigators to monitor, search, and retrievecompany? intranet, network, or virtual private network (VPN) and will allow the company? investigators to monitor, search, and retrieve information stored within the network.

• A. Right of privacy
• B. Right of free speech
• C. Right to work
• D. Right to Internet access

Answer: A

NEW QUESTION # 247
An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

• A. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
• B. The EFS Revoked Key Agent can be used on the Computer to recover the information
• C. When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.
• D. EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information

Answer: A

NEW QUESTION # 248
Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

• A. Globally unique ID
• B. Microsoft Virtual Machine Identifier
• C. Individual ASCII string
• D. Personal Application Protocol

Answer: A

NEW QUESTION # 249
Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable?

• A. Intruding into a honeypot is not illegal
• B. Entrapment
• C. Intruding into a DMZ is not illegal
• D. Enticement

Answer: B

NEW QUESTION # 250
FAT32 is a 32-bit version of FAT file system using smaller clusters and results in efficient storage capacity. What is the maximum drive size supported?

• A. 1 terabytes
• B. 3 terabytes
• C. 2 terabytes
• D. 4 terabytes

Answer: C

NEW QUESTION # 251
How do you define Technical Steganography?

• A. Steganography that utilizes visual symbols or signs to hide secret messages
• B. Steganography that utilizes written JAVA language to hide the message in the carrier in some non-obvious ways
• C. Steganography that utilizes written natural language to hide the message in the carrier in some non-obvious ways
• D. Steganography that uses physical or chemical means to hide the existence of a message

Answer: D

NEW QUESTION # 252
In the following directory listing,

which file should be used to restore archived email messages for someone using Microsoft Outlook?

• A. Outlook pst
• B. Outlook NK2
• C. Outlook ost
• D. Outlook bak

Answer: A

NEW QUESTION # 253
......

Validate your Skills with Updated EC0-349 Exam Questions & Answers and Test Engine: https://passguide.braindumpsit.com/EC0-349-latest-dumps.html