EC-Council Digital Forensics Essentials (DFE) (112-57)

Below is an extracted Apache error log entry.

"[Wed Aug 28 13:35:38.878945 2020] [core:error] [pid 12356:tid 8689896234] [client 10.0.0.8] File not found: /images/folder/pic.jpg"

Identify the element in the Apache error log entry above that represents the IP address from which the request was made.

Jennifer, a forensics investigation team member, was inspecting a compromised system. After gathering all the evidence related to the compromised system, she disconnected the system from the network to stop the spread of the incident to other systems.

Identify the role played by Jennifer in the forensics investigation.

An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose, Steven, a security analyst, was instructed to deploy a device to bait attackers. Steven selected a solution that appears to contain very useful information to lure attackers and find their locations and techniques.

Identify the type of device deployed by Steven in the above scenario.

Which of the following acts was passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?

Below is the syntax of a command-line utility that displays active TCP connections and ports on which the computer is listening. netstat [-a] [-e] [-n] [-o] [-p Protocol] [-r] [-s] [Interval]

Identify the netstat parameter that displays active TCP connections and includes the process ID (PID) for each connection.

Which of the following network protocols creates secure tunneling through which content obfuscation can be achieved?

Sandra, a hacker, targeted Johana, a software professional, to steal her banking details. She started sending frequent, random pop-up messages with malicious links to her social media page. Johana accidentally clicked on a link, causing a malicious program to get installed in her system. Subsequently, when Johana attempted to access her banking website, the URL directed her to a malicious website controlled by Sandra. Johana entered her banking credentials on the fake website, which Sandra than captured.

Identify the type of attack performed by Sandra on Johana.

Clark, a security professional, identified that one of the systems in the organization is infected with malware and was used for creating a backdoor. Clark employed an automated tool to analyze the system's memory and detect malicious activities performed on the system.

In the above scenario, which of the following tools did Clark employ to detect malicious activities performed on the system?

Which of the following tools helps forensic experts analyze user activity in the Microsoft Edge browser?

Which of the following layers of the TCP/IP model serves as the backbone for data flow between two devices in a network and enables peer entities on the source and destination devices to communicate with each other?

In which of the following malware distribution techniques does the attacker use tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to improve the search-engine ranking of their malware pages?

Which of the following techniques is defined as the art of hiding data "behind" other data without the target's knowledge, thereby hiding the existence of the message itself?

Which of the following Tor relay nodes in the Tor circuit is designed to transfer data in an encrypted format?

James, a forensic specialist, was appointed to investigate an incident in an organization. As part of the investigation, James is attempting to identify whether any external storage devices are connected to the internal systems. For this purpose, he employed a utility to capture the list of all devices connected to the local machine and removed suspicious devices.

Identify the tool employed by James in the above scenario.

Kelly, a professional hacker, used her laptop to perform illegal cyber activities for monetary gain on many victims. She securely locked her laptop using BitLocker software. Using this tool, she locked an entire volume using a secret key to deny access to the system.

Identify the anti-forensic technique used by Don in the above scenario.