A company uses BitLocker for full-disk encryption on all employee laptops. The IT department needs to ensure that forensic investigators can access data if an employee leaves. Which practice best supports forensic access?

Disable BitLocker on all laptops to avoid encryption issues.

Keep a copy of each user's password in a plaintext file.

Store recovery keys in Active Directory or a secure key management system.

Use a single shared password for all laptops to simplify access.

An organization is considering using file-level encryption for sensitive documents stored on a shared network drive. They want to ensure that forensic investigators can access the documents if needed. What should they implement?

Use a single shared key for all documents and distribute it to all employees.

Use a different encryption key for each document and store the keys with the documents.

Use encryption only on documents that are marked as 'confidential'.

Use a centralized key management system with escrowed recovery keys.

A forensic examiner is trying to recover a password from a seized document. The examiner knows the password is a common word followed by two digits. Which password cracking technique would be most efficient?

Use a pure brute-force attack trying all possible characters and lengths.

Use a dictionary attack with a rule that appends two digits to each word.

Use a keylogger to capture the password from the user's typing.

Use a rainbow table to look up the hash without any wordlist.

A forensic examiner is analyzing a password-protected spreadsheet. The examiner suspects the password is weak because the user is known to use simple passwords. Which approach is the most efficient first step?

Run a dictionary attack using a wordlist of common passwords.

Use a rainbow table to crack the password hash.

Contact the user and ask for the password.

Run a brute-force attack that tries every possible character combination.

EC-CouncilDigital Forensics Essentials

Domain 3Objective 2

Password Protection and Encryption Techniques DFE Practice Questions (Page 6)

Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.

49questions here

10free pages

8concepts

Questions 26–30

26application · medium
A company uses BitLocker for full-disk encryption on all employee laptops. The IT department needs to ensure that forensic investigators can access data if an employee leaves. Which practice best supports forensic access?
Select an answer first
27application · medium
An organization is considering using file-level encryption for sensitive documents stored on a shared network drive. They want to ensure that forensic investigators can access the documents if needed. What should they implement?
Select an answer first
28foundation · easy
Which encryption algorithm is a symmetric block cipher that is often used for encrypting data at rest, such as files and databases?
Select an answer first
29application · medium
A forensic examiner is trying to recover a password from a seized document. The examiner knows the password is a common word followed by two digits. Which password cracking technique would be most efficient?
Select an answer first
30application · medium
A forensic examiner is analyzing a password-protected spreadsheet. The examiner suspects the password is weak because the user is known to use simple passwords. Which approach is the most efficient first step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.