EC-CouncilDigital Forensics Essentials
Domain 4Objective 1
Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 8)
Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.
39questions here
8free pages
8concepts
Questions 36–39
- 36
During a live response on a Windows server, an investigator needs to document which files are currently open by remote users to understand ongoing malicious activity. Which built-in Windows command should be used?
Select an answer first - 37
During a live response, an investigator needs to capture the list of running processes to identify malicious software. Which command-line tool from the Sysinternals suite is designed for this purpose?
Select an answer first - 38
Which tool is commonly used to create a forensic image of a Windows disk for non-volatile data collection?
Select an answer first - 39
A forensic investigator is performing a live response on a Windows system and needs to collect network connection information, running processes, and open files. The investigator has limited time and must use built-in Windows tools. Which combination of commands would collect all three types of data?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to DFE
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.