EC-CouncilCertified Security Specialist
Domain 6Objective 1
Windows Forensics ECSS Practice Questions (Page 4)
Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.
39questions here
8free pages
10concepts
Questions 16–20
- 16
When a file is permanently deleted from a Windows system (e.g., by emptying the Recycle Bin), what happens to the file's data on the hard drive?
Select an answer first - 17
An incident responder needs to capture the contents of RAM from a live Windows system without altering the system state. Which tool is specifically designed for this task?
Select an answer first - 18
A Windows server experienced a suspected brute-force attack on the RDP service. Which event log and event ID should the investigator examine first to identify successful and failed logon attempts?
Select an answer first - 19
A forensic analyst is examining a USB drive that was used to transfer files between Windows and macOS systems. The drive is formatted with a file system that supports large files (over 4 GB) and is compatible with both operating systems. Which file system is most likely in use?
Select an answer first - 20
Which of the following is a type of data that can be extracted from a Windows memory dump?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.