EC-CouncilEC-Council
312-49 · Question #161
312-49 Question #161: Real Exam Question with Answer & Explanation
Sign in or unlock 312-49 to reveal the answer and full explanation for question #161. The question stem and answer options stay visible for context.
Submitted by thandi_sa· Apr 18, 2026Computer Forensics Investigation Process
Question
Which of the following statement is not correct when dealing with a powered-on computer at the crime scene?
Options
- AIf a computer is switched on and the screen is viewable, record the programs running on screen
- BIf a computer is on and the monitor shows some picture or screen saver, move the mouse slowly
- CIf a monitor is powered on and the display is blank, move the mouse slowly without depressing
- DIf the computer is switched off. power on the computer to take screenshot of the desktop
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Crime scene procedures#Digital evidence collection#Volatile data#Forensic best practices