ECCouncil 412-79 Certified Security Analyst (ECSA) Exam

Sample Questions

Q) One way to identify the presence of hidden partitions on a hard drive is to suspicions:

a) Add the total size of all known partitions and compare it to the total hard disk size

b) Examine the FAT and identify hidden partitions noticing a H in the Partition Type

c) You can not have a hidden partition on a hard drive

Q) What does mactime, an essential part of the toolkit coroner do?

a) Cross the file system and produces a list of all files under the amendment, access and modify the timestamp

b) You can save space for deleted files and searching for data. However, it does not allow the investigator t preview them

c) It is the specific tool MAC OS and is a key component of the toolkit

Q) The use of warning banner helps companies avoid litigation by passing an employees hired ____________ When you connect to the intranet Companys, network or Virtual Private Network (VPN) and will allow the company's investigators to monitor, search and retrieve information stored within network.

a) Right to work

b) Right of free speech

c) Right to privacy

Q) Chris was called to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an accomplice in insider attack. After reaching the accident scene, Chris protects the physical area, record the scene using visual media. It shuts down the system by pulling the power plug so that it does not disturb the system in any way. He labels all cables and connectors before disconnecting anything. What do you think would be the next sequence of events?

a) Connect the target media; prepare the acquisition system; Attach the evidence; Copy the media

b) Prepare the acquisition system; Connect the target media; copy the media; Attach the evidence

c) Attach the evidence; prepare the acquisition system; Connect the target media; copy the media

Q) When a Windows system, it is important to view the contents of the page or swap file as:

a) Windows stores all system configuration information in this file

b) This is the file that Windows uses to communicate directly with Registry

c) This is the file that Windows uses to store the history of the last 100 commands that are executed from the command line