A security team is investigating a potential insider threat. The team suspects that an employee has been clearing the Windows Event Logs on their workstation to hide unauthorized activity. The team has access to the workstation but must not alert the employee. What is the best approach to gather evidence without alerting the suspect?

Create a forensic image of the workstation's hard drive while the system is running, using a tool that does not modify the drive

Ask the employee to explain the log gaps

Enable additional logging on the workstation to catch future activity

Reboot the workstation to reset the logs

Which practice is essential to preserve the integrity of digital evidence during acquisition?

Running antivirus scans on the evidence

Booting the system to verify it works

What is a common anti-forensic action related to logs?

Backing up logs to a remote server

A security analyst is investigating a breach. The attacker deleted several log files and overwrote parts of the event log. The analyst needs to determine what the attacker did. Which approach is most effective?

Analyze the unallocated space and file system journal for remnants of the deleted logs

Ask the attacker to provide the logs

Check the system's current time to estimate when the logs were deleted

Reinstall the operating system to restore the logs

EC-CouncilCertified Security Specialist

Domain 5Objective 5

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 4)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 16–20

16expert · hard
A security team is investigating a potential insider threat. The team suspects that an employee has been clearing the Windows Event Logs on their workstation to hide unauthorized activity. The team has access to the workstation but must not alert the employee. What is the best approach to gather evidence without alerting the suspect?
Select an answer first
17foundation · easy
Which anti-forensic technique involves altering or deleting entries in system logs to remove traces of malicious activity?
Select an answer first
18foundation · easy
Which practice is essential to preserve the integrity of digital evidence during acquisition?
Select an answer first
19foundation · easy
What is a common anti-forensic action related to logs?
Select an answer first
20application · medium
A security analyst is investigating a breach. The attacker deleted several log files and overwrote parts of the event log. The analyst needs to determine what the attacker did. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 4)

Questions 16–20

Which anti-forensic technique involves altering or deleting entries in system logs to remove traces of malicious activity?

Which practice is essential to preserve the integrity of digital evidence during acquisition?

What is a common anti-forensic action related to logs?

A security analyst is investigating a breach. The attacker deleted several log files and overwrote parts of the event log. The analyst needs to determine what the attacker did. Which approach is most effective?

Keep studying — Digital Forensics Fundamentals and Acquisition