A network administrator suspects that an internal host is communicating with a known command-and-control server. Which network forensic technique would most directly confirm this communication?

Checking DNS logs for queries to the C2 domain.

Reviewing firewall logs for connections to the C2 IP address.

Running a vulnerability scanner against the internal host.

Capturing and analyzing full packet captures from the network segment.

A company suspects an employee of leaking confidential data. The IT manager wants to investigate the employee's work computer. What is the primary goal of the forensic investigation in this scenario?

To prevent further data leaks by securing the computer.

To recover the leaked data and return it to the company.

To collect and preserve evidence in a legally admissible manner.

To determine the employee's guilt and recommend termination.

What is a common countermeasure to detect steganography?

Using steganalysis tools that analyze file anomalies

Encrypting all files on the system

Disabling the network connection

During a forensic examination of a suspect's drive, the analyst finds a set of image files that appear to be ordinary photos. However, the analyst suspects steganography is hiding sensitive documents. Which technique is MOST effective for detecting hidden data?

Run a keyword search for 'confidential' inside the image file.

Compare the file's hash to known clean versions of the same image.

Check the file's extension and size.

View the image in a standard image viewer.

What type of data is typically found in volatile memory (RAM) that is useful for forensic analysis?

Running processes and open network connections

The contents of the recycle bin

Deleted files from the hard drive

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 9)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 41–45

41application · medium
A network administrator suspects that an internal host is communicating with a known command-and-control server. Which network forensic technique would most directly confirm this communication?
Select an answer first
42application · medium
A company suspects an employee of leaking confidential data. The IT manager wants to investigate the employee's work computer. What is the primary goal of the forensic investigation in this scenario?
Select an answer first
43foundation · easy
What is a common countermeasure to detect steganography?
Select an answer first
44application · medium
During a forensic examination of a suspect's drive, the analyst finds a set of image files that appear to be ordinary photos. However, the analyst suspects steganography is hiding sensitive documents. Which technique is MOST effective for detecting hidden data?
Select an answer first
45foundation · easy
What type of data is typically found in volatile memory (RAM) that is useful for forensic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.