NEW QUESTION 76
The investigator wants to examine changes made to the system’s registry by the suspect program. Which of the following tool can help the investigator?

NEW QUESTION 77
Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?

NEW QUESTION 78
Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses’ testimony during federal legal proceedings?

NEW QUESTION 79
Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time.
Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network?

NEW QUESTION 80
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

NEW QUESTION 81
What does the 56.58.152.114(445) denote in a Cisco router log?
Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084) -> 56.58.152.114(445), 1 packet

NEW QUESTION 82
Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?

NEW QUESTION 83
You are assisting in the investigation of a possible Web Server Hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a porno graphic web site. The company checked the web server and nothing appears wrong.
When you type in the IP address of the web site in your browser everything appears normal. What is the name of the attack that affects the DNS cache of the name resolution servers, resulting in those servers directing users to the wrong web site?

NEW QUESTION 84
When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?

NEW QUESTION 85
You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company’s network. How would you answer?

NEW QUESTION 86
When obtaining a warrant, it is important to:

NEW QUESTION 87
In Linux, what is the smallest possible shellcode?

NEW QUESTION 88
An executive has leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?

NEW QUESTION 89
What is one method of bypassing a system BIOS password?

NEW QUESTION 90
From the following spam mail header, identify the host IP that sent this spam?
From [email protected] [email protected] Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk
(8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT)
Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >[email protected]
From: “china hotel web”
To: “Shlam”
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0
X-Priority: 3 X-MSMail-
Priority: Normal
Reply-To: “china hotel web”

NEW QUESTION 91
What layer of the OSI model do TCP and UDP utilize?

NEW QUESTION 92
What system details can an investigator obtain from the NetBIOS name table cache?

NEW QUESTION 93
Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?

NEW QUESTION 94
The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

NEW QUESTION 95
While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface.
Which of the following operating systems is present on the hard disk?

NEW QUESTION 96
Which U.S. law sets the rules for sending emails for commercial purposes, establishes the minimum requirements for commercial messaging, gives the recipients of emails the right to ask the senders to stop emailing them, and spells out the penalties in case the above said rules are violated?

NEW QUESTION 97
Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?

NEW QUESTION 98
Which of the following Wi-Fi chalking methods refers to drawing symbols in public places to advertise open Wi-Fi networks?

NEW QUESTION 99
What type of equipment would a forensics investigator store in a StrongHold bag?

NEW QUESTION 100
What are the security risks of running a “repair” installation for Windows XP?