A network forensic analyst is investigating a breach where the attacker used encrypted HTTPS traffic to exfiltrate data. The analyst has full packet captures from the network perimeter. Which approach is most likely to reveal the exfiltrated data?

Perform SSL/TLS interception by installing a proxy certificate on the client.

Analyze the DNS queries to identify the exfiltration domain.

Use the server's private key to decrypt the captured TLS sessions.

Look for patterns in the packet sizes and timing to infer data transfer.

Which of the following best describes the role of a forensic investigator?

To act as a law enforcement officer who arrests suspects

To ensure that digital evidence is collected, preserved, and analyzed without altering it

To repair damaged computer systems after an incident

To provide legal advice to the prosecution

A junior investigator is tasked with handling a new case. The investigator has identified potential evidence on a suspect's computer. What is the next step in the forensic investigation process?

Prepare the final forensic report and present findings.

Collect and preserve the evidence using proper procedures and document the chain of custody.

Create a forensic image of the evidence and then analyze it.

Immediately begin analyzing the evidence to find relevant information.

A security analyst responds to an ongoing ransomware incident on a critical server. The server is still running and the attacker may be actively using memory. The organization needs to preserve evidence while keeping the server available. Which acquisition method is most appropriate?

Wait until the incident is contained, then acquire memory and disk.

Power off the server and perform a static acquisition of the hard drive.

Perform a live acquisition of memory and a logical acquisition of active files.

Create a full forensic image of the hard drive while the server is running.

A forensic examiner is preparing to testify in court about the findings of a digital investigation. What is the most important factor for the examiner to ensure before testifying?

The findings are based on reliable methods and the evidence integrity is documented.

The examiner has a strong opinion about the suspect's guilt.

The examiner has memorized all the details of the case.

The forensic report is written in technical jargon to demonstrate expertise.

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 3)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 11–15

11expert · hard
A network forensic analyst is investigating a breach where the attacker used encrypted HTTPS traffic to exfiltrate data. The analyst has full packet captures from the network perimeter. Which approach is most likely to reveal the exfiltrated data?
Select an answer first
12foundation · easy
Which of the following best describes the role of a forensic investigator?
Select an answer first
13application · medium
A junior investigator is tasked with handling a new case. The investigator has identified potential evidence on a suspect's computer. What is the next step in the forensic investigation process?
Select an answer first
14application · medium
A security analyst responds to an ongoing ransomware incident on a critical server. The server is still running and the attacker may be actively using memory. The organization needs to preserve evidence while keeping the server available. Which acquisition method is most appropriate?
Select an answer first
15application · medium
A forensic examiner is preparing to testify in court about the findings of a digital investigation. What is the most important factor for the examiner to ensure before testifying?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.