EC-CouncilCertified Security Specialist
Domain 6Objective 1
Windows Forensics ECSS Practice Questions (Page 1)
Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.
39questions here
8free pages
10concepts
Questions 1–5
- 1
In forensic imaging, what is the purpose of calculating a hash value (e.g., MD5 or SHA-256) of the original drive and the forensic image?
Select an answer first - 2
Which artifact is created when a user opens a document from the Windows desktop or Start Menu, and is often used to recover the path of the original file?
Select an answer first - 3
Which Windows forensic artifact is a binary file that stores configuration settings and user preferences, and is organized into hives such as SYSTEM, SOFTWARE, and NTUSER.DAT?
Select an answer first - 4
An analyst is investigating a Windows system and needs to find evidence of USB device usage. Which registry hive and key should be examined?
Select an answer first - 5
In Windows Registry analysis, which hive contains information about the hardware, device drivers, and boot configuration of the system?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.