[Q46-Q62] Best Quality 112-57 Exam Questions EC-COUNCIL Test To Gain Brilliante Result!

QUESTION 46
Jennifer, a forensics investigation team member, was inspecting a compromised system. After gathering all the evidence related to the compromised system, she disconnected the system from the network to stop the spread of the incident to other systems.
Identify the role played by Jennifer in the forensics investigation.

QUESTION 47
In which of the following malware distribution techniques does the attacker use tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to improve the search-engine ranking of their malware pages?

QUESTION 48
Jack, a forensic investigator, was appointed to investigate a Windows-based security incident. In this process, he employed an Autopsy tool to recover the deleted files from unallocated space, which helps in gathering potential evidence.
Which of the following functions of Autopsy helped Jack recover the deleted files?

QUESTION 49
Which of the following Windows system files is created in the system drive after OS installation to support the internal functions and system service dispatch stubs to executive functions?

QUESTION 50
A forensic investigator is collecting volatile data such as system information and network information present in the registries, cache, DLLs, and RAM of digital devices through its normal interface.
Identify the data acquisition method the investigator is performing.

QUESTION 51
Which of the following MAC forensic data components saves file information and related events using a token with a binary structure?

QUESTION 52
Below are the elements included in the order of volatility for a typical computing system as per the RFC 3227 guidelines for evidence collection and archiving.
Archival media
Remote logging and monitoring data related to the target system
Routing table, process table, kernel statistics, and memory
Registers and processor cache
Physical configuration and network topology
Disk or other storage media
Temporary system files
Identify the correct sequence of order of volatility from the most to least volatile for a typical system.

QUESTION 53
Which of the following techniques is used to compute the hash value for a given binary code to uniquely identify malware or periodically verify changes made to the binary code during analysis?

QUESTION 54
Which of the following data acquisition formats supports the Lempel-Ziv-Markov chain (LZMA) algorithm for compression?

QUESTION 55
Which of the following file systems of Windows replaces the first letter of a deleted file name with the hex byte code “e5h”?

QUESTION 56
Steve, a professional hacker, attempted to hack Alice’s banking account. To accomplish his goal, Steve used an automated tool to guess Alice’s login credentials. The tool uses a trial-and-error method by attempting all possible combinations of usernames and passwords to determine the valid credentials.
Identify the type of attack initiated by Steve in the above scenario.

QUESTION 57
Which of the following NTFS system files contains a record of every file present in the system?

QUESTION 58
Which of the following titles of The Electronic Communications Privacy Act protects the privacy of the contents of files stored by service providers and records held about the subscriber by service providers, such as subscriber name, billing records, and IP addresses?

QUESTION 59
James, a forensic specialist, was appointed to investigate an incident in an organization. As part of the investigation, James is attempting to identify whether any external storage devices are connected to the internal systems. For this purpose, he employed a utility to capture the list of all devices connected to the local machine and removed suspicious devices.
Identify the tool employed by James in the above scenario.

QUESTION 60
Below is an extracted Apache error log entry.
“[Wed Aug 28 13:35:38.878945 2020] [core:error] [pid 12356:tid 8689896234] [client 10.0.0.8] File not found: /images/folder/pic.jpg” Identify the element in the Apache error log entry above that represents the IP address from which the request was made.

QUESTION 61
Which of the following layers of the TCP/IP model serves as the backbone for data flow between two devices in a network and enables peer entities on the source and destination devices to communicate with each other?

QUESTION 62
Clark, a digital forensic expert, was assigned to investigate a malicious activity performed on an organization’ s network. The organization provided Clark with all the information related to the incident. In this process, he assessed the impact of the incident on the organization, reasons for and source of the incident, steps required to tackle the incident, investigation team required to handle the case, investigative procedures, and possible outcome of the forensic process.
Identify the type of analysis performed by Clark in the above scenario.