During a forensic examination of a Linux system, an analyst finds that a file was deleted, but the disk has not been heavily used since. Which method is most likely to recover the file's contents?

Run 'extundelete' on the live filesystem to recover the file.

Check the system's trash folder for the deleted file.

Use a file carving tool to scan the raw disk image for file signatures.

Look in the /tmp directory for a copy of the file.

A forensic analyst is investigating a case involving a Linux server that was compromised. The analyst has a forensic image of the server's hard drive. The analyst needs to recover deleted files and analyze the file system. Which tool is BEST suited for this task?

Use The Sleuth Kit (TSK) and Autopsy to analyze the image and recover deleted files.

Mount the image as a loopback device and use standard Linux commands to find deleted files.

Use a hex editor to manually inspect the image for deleted files.

Use a Windows-based forensic tool like EnCase to analyze the Linux image.

A forensic analyst needs to examine a suspect's smartphone as part of an investigation. The analyst wants to extract data without altering the device. Which tool or technique is most appropriate?

Perform a factory reset to remove any passcode, then extract data.

Unlock the phone and manually browse through apps to find relevant data.

Use a cloud backup to restore the phone to a different device and analyze that device.

Use a hardware write-blocker and connect the phone via USB to a forensic workstation.

What is the first phase of the incident response process?

Containment, Eradication, and Recovery

A forensic analyst is examining a disk image from a suspect's computer. The analyst finds a file that appears to be a JPEG image, but the file extension has been changed to .txt. The file's metadata shows it was created at a specific time. The analyst needs to prove that the file is actually an image and determine its original file type. Which approach is most reliable?

Use the file's creation timestamp to infer its original type.

Examine the file's magic bytes (file signature) and compare them to known JPEG signatures.

Rename the file to .jpg and open it in an image viewer.

Search the internet for the file's hash to identify its type.

EC-CouncilAssociate C|CISO

Domain 4Objective 8

Computer Forensics and Incident Response ACCISO Practice Questions (Page 4)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

11concepts

11 Concepts in This Objective

Computer Forensics Fundamentals
Forensic Process and Procedures
Evidence Collection and Preservation
Forensic Imaging and Duplication
Data Recovery and Analysis
Incident Response Fundamentals
Incident Detection and Triage
Containment, Eradication, and Recovery
Legal and Ethical Considerations
Forensic Tools and Technologies
Reporting and Documentation

Questions 16–20

16application · medium
During a forensic examination of a Linux system, an analyst finds that a file was deleted, but the disk has not been heavily used since. Which method is most likely to recover the file's contents?
Select an answer first
17expert · hard
A forensic analyst is investigating a case involving a Linux server that was compromised. The analyst has a forensic image of the server's hard drive. The analyst needs to recover deleted files and analyze the file system. Which tool is BEST suited for this task?
Select an answer first
18application · medium
A forensic analyst needs to examine a suspect's smartphone as part of an investigation. The analyst wants to extract data without altering the device. Which tool or technique is most appropriate?
Select an answer first
19foundation · easy
What is the first phase of the incident response process?
Select an answer first
20expert · hard
A forensic analyst is examining a disk image from a suspect's computer. The analyst finds a file that appears to be a JPEG image, but the file extension has been changed to .txt. The file's metadata shows it was created at a specific time. The analyst needs to prove that the file is actually an image and determine its original file type. Which approach is most reliable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.