In Windows Event Log analysis, what is the primary purpose of the System log?

To record installation events for Windows updates

To record events generated by the Windows operating system and its components

To record security-related events such as logon attempts

To record application-specific errors and warnings

During a live incident response, an analyst must decide whether to capture memory first or image the disk first. The system is a domain controller with active user sessions. Which approach is most defensible?

Capture memory first, then image the disk, because memory contains active sessions and credentials that are lost on shutdown

Image the disk only, because memory analysis is not admissible in court

Image the disk first, then capture memory, because disk evidence is more stable and less likely to be lost

Capture memory only, because disk imaging would disrupt the domain controller's operations

A Windows workstation is suspected of being used to access malicious websites. Which Windows artifact would provide the most direct evidence of the user's browsing activity?

The browser's history database (e.g., History file in Chrome or Firefox)

An investigator is examining a Windows 10 workstation to determine which applications a user launched during a specific time window. The system has been powered off and a forensic image was taken. Which artifact would be most useful?

The user's browser history files

The Windows event log for application errors

Prefetch files in C:\Windows\Prefetch

EC-CouncilCertified Security Specialist

Domain 6Objective 1

Windows Forensics ECSS Practice Questions (Page 3)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

39questions here

8free pages

10concepts

Questions 11–15

11foundation · easy
Which forensic tool is commonly used to create a forensic image of a Windows drive and supports the Expert Witness Format (EWF)?
Select an answer first
12foundation · easy
In Windows Event Log analysis, what is the primary purpose of the System log?
Select an answer first
13expert · hard
During a live incident response, an analyst must decide whether to capture memory first or image the disk first. The system is a domain controller with active user sessions. Which approach is most defensible?
Select an answer first
14application · medium
A Windows workstation is suspected of being used to access malicious websites. Which Windows artifact would provide the most direct evidence of the user's browsing activity?
Select an answer first
15application · medium
An investigator is examining a Windows 10 workstation to determine which applications a user launched during a specific time window. The system has been powered off and a forensic image was taken. Which artifact would be most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.