EC0-349 Exam Questions and Answers | Exam-Dumps (Page: 6)

QUESTION: 26

From the following spam mail header, identify the host IP that sent this spam?

From jie02@netvigator.com jie02@netvigator.com Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)
Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)

with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >200111270926.fAR9QXwZ018431@viruswall.ie.cuhk.edu.hk From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0
X-Priority: 3 X-MSMail- Priority: Normal
Reply-To: "china hotel web"

203.218.39.50
203.218.39.20
137.189.96.52
8.12.1.0

Answer(s): B

Reveal Solution Next Question

QUESTION: 27

You have used a newly released forensic investigation tool, which doesnt meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?

Only the local law enforcement should use the tool
You are not certified for using the tool
The tool has not been tested by the International Standards Organization (ISO)
The tool has not been reviewed and accepted by your peers

Answer(s): D

Reveal Solution Next Question

QUESTION: 28

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

a disk editor
a write-blocker
a protocol analyzer
a firewall

Answer(s): B

Reveal Solution Next Question

QUESTION: 29

If you plan to startup a suspect's computer, you must modify the _____________to ensure that you do not contaminate or alter data on the suspect's hard drive by booting to the hard drive.

Scandisk utility
deltree command
CMOS
Boot.sys

Answer(s): C

Reveal Solution Next Question

QUESTION: 30

Jones had been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones. What is a virtual environment?

An environment set up after the user logs in
A system using Trojaned commands
A honeypot that traps hackers
An environment set up before a user logs in

Answer(s): C

Reveal Solution Next Question

EC-Council EC0-349 Exam (page: 6) EC-Council EC0-349 ECCouncil Computer Hacking Forensic Investigator Updated on: 15-Feb-2026

QUESTION: 26

QUESTION: 27

QUESTION: 28

QUESTION: 29

QUESTION: 30

EC-Council EC0-349 Exam (page: 6)
EC-Council EC0-349 ECCouncil Computer Hacking Forensic Investigator
Updated on: 15-Feb-2026