Your organization needs to detect anti-forensics activities such as log tampering and data wiping, but you have a limited budget and cannot deploy a full SIEM solution. Which cost-effective approach should you implement to achieve early detection?

Configure centralized logging on critical servers using an open-source log management tool, and set up alerts for specific events like log clearing or mass file deletion.

Use a network-based intrusion detection system (NIDS) to monitor for suspicious traffic patterns that might indicate data exfiltration.

Enable verbose logging on all workstations and store logs locally, relying on periodic manual review by IT staff.

Deploy a commercial endpoint detection and response (EDR) solution that includes anti-forensics detection features.

What is the primary purpose of analyzing alternate data streams (ADS) in a forensic investigation?

To identify the original file system type

To recover deleted files from the recycle bin

To detect hidden data that may be stored in NTFS file streams

To verify the integrity of the master file table

EC-CouncilDigital Forensics Essentials

Domain 3Objective 5

Anti-Forensics Countermeasures DFE Practice Questions (Page 6)

Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.

27questions here

6free pages

7concepts

Questions 26–27

26expert · hard
Your organization needs to detect anti-forensics activities such as log tampering and data wiping, but you have a limited budget and cannot deploy a full SIEM solution. Which cost-effective approach should you implement to achieve early detection?
Select an answer first
27foundation · easy
What is the primary purpose of analyzing alternate data streams (ADS) in a forensic investigation?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Anti-Forensics Countermeasures DFE Practice Questions (Page 6)

Questions 26–27

Your organization needs to detect anti-forensics activities such as log tampering and data wiping, but you have a limited budget and cannot deploy a full SIEM solution. Which cost-effective approach should you implement to achieve early detection?

What is the primary purpose of analyzing alternate data streams (ADS) in a forensic investigation?

Keep studying — Defeating Anti-Forensics Techniques