A system administrator notices that the Windows Event Log on a critical server is missing entries for a 3-hour period during the night. The server was not rebooted and no maintenance was scheduled. Which action should the administrator take to investigate potential log tampering?

Search the server's memory for the missing log entries

Rebuild the event log from scratch to ensure it is clean

Disable the event log service to prevent further tampering

Check the event log file's metadata, such as the last write time and file size, for anomalies

Which sign might indicate that a file is encrypted and could hinder forensic acquisition?

File is stored in the Recycle Bin

File content appears as random, high-entropy data

During a forensic examination of a Windows system, the investigator finds a hidden partition that is not visible in the operating system. The investigator needs to acquire the hidden partition without altering it. Which method is most appropriate?

Use the Windows Disk Management tool to assign a drive letter to the hidden partition and then copy files

Boot the system normally and use a file recovery tool to access the hidden partition

Use a hex editor to manually copy the partition's data

Use a write-blocker and a forensic imaging tool to acquire the entire physical disk, including the hidden partition

What is a common indicator that a system may be using full disk encryption?

The system has a guest account enabled

The system has a firewall enabled

The system has a screensaver password

A pre-boot authentication prompt appears before the operating system loads

A security analyst is investigating a data breach and suspects that the attacker used anti-forensic techniques to slow down the investigation. The analyst notices that the system has multiple encrypted containers and that the event logs have been partially cleared. Which anti-forensic goal is the attacker most likely trying to achieve?

Increasing analysis time by creating decoy files

Ensuring the attacker's identity remains unknown

Avoiding detection by hiding the attack entirely

Disrupting collection by making evidence inaccessible

EC-CouncilCertified Security Specialist

Domain 5Objective 5

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 3)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 11–15

11application · medium
A system administrator notices that the Windows Event Log on a critical server is missing entries for a 3-hour period during the night. The server was not rebooted and no maintenance was scheduled. Which action should the administrator take to investigate potential log tampering?
Select an answer first
12foundation · easy
Which sign might indicate that a file is encrypted and could hinder forensic acquisition?
Select an answer first
13expert · hard
During a forensic examination of a Windows system, the investigator finds a hidden partition that is not visible in the operating system. The investigator needs to acquire the hidden partition without altering it. Which method is most appropriate?
Select an answer first
14foundation · easy
What is a common indicator that a system may be using full disk encryption?
Select an answer first
15application · medium
A security analyst is investigating a data breach and suspects that the attacker used anti-forensic techniques to slow down the investigation. The analyst notices that the system has multiple encrypted containers and that the event logs have been partially cleared. Which anti-forensic goal is the attacker most likely trying to achieve?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.