EC-Council Digital Forensics Essentials DFE 112-57 Exam Questions

Answer : A

On Windows systems, ipconfig is the standard command-line utility used to display and troubleshoot TCP/IP configuration and the operational status of network interfaces. From a forensic and incident-response perspective, it helps investigators quickly identify whether a NIC is enabled and configured, and it reveals key network parameters tied to ''network status,'' such as the assigned IPv4/IPv6 addresses, subnet mask, default gateway, and DNS servers. Using variants like ipconfig /all, responders can also capture adapter-specific metadata including MAC address (physical address), DHCP enablement, DHCP server, lease timestamps, and interface descriptions---useful for correlating an endpoint to switch-port logs, DHCP logs, and network monitoring data. This is often part of live triage because it documents the system's current connectivity and routing context at the time of seizure or investigation.

The other options are not appropriate for NIC status: PsLoggedOn reports logged-on users, and PsList enumerates running processes---both are Sysinternals tools focused on user/process state rather than network interface configuration. ifconfig is a UNIX/Linux command (and not the primary Windows utility), so it would not be the correct choice for Windows-based systems. Therefore, ipconfig (A) is correct.

Answer : C

In Microsoft IIS (W3C Extended) logging, each request line records multiple standardized fields that help investigators reconstruct what was accessed, by whom, and with what outcome. Among these fields, the most direct indicator of whether the server successfully handled the request is the HTTP status code captured in the sc-status field. A status code of 200 means ''OK'', indicating the server located the requested resource (here, /images/content/bg_body1.jpg) and returned it successfully to the client without application-level failure.

Other numbers in the entry represent different attributes: 80 is the server port used for the HTTP request, 192 values appear as part of IP addressing (client/server addresses), and 537 is embedded in the user-agent string (AppleWebKit build number), not a success indicator. IIS often logs additional substatus and Win32 status values (e.g., sc-substatus and sc-win32-status) to refine the outcome; in the shown line, those follow the 200 as ''200 0 0 ...'', reinforcing that no substatus error or OS-level error occurred. Therefore, 200 is the element confirming the request was fulfilled without error.

Answer : C

Seek time is the specific performance measure that describes how long a hard disk drive's actuator takes to move the read/write heads across the platters from the current track (cylinder) to the target track where the requested data resides. In traditional magnetic HDDs, the heads must be physically repositioned before any sector can be read or written, making seek time a core component of mechanical latency.

Digital forensics materials emphasize understanding this distinction because HDD mechanical behavior affects acquisition duration, the feasibility of repeated scans, and why imaging or carving operations can take longer on fragmented media. It also helps explain why solid-state drives (SSDs), which have no moving heads, do not have seek time in the same sense and therefore behave differently during large-scale reads.

The other choices are broader or unrelated: access time typically refers to the total time to retrieve data, commonly combining seek time + rotational latency + transfer time. Delay time is not the standard term for head movement in disk performance definitions. Mean time is incomplete as written and is usually part of reliability metrics like mean time between failures, not head positioning. Therefore, the correct measure for head movement time is Seek time (C).

Answer : D

The role described---being responsible for evidence gathered at the crime scene and maintaining a record that makes the evidence admissible in court---matches the duties of an Evidence manager. In digital forensics practice, admissibility depends heavily on proving integrity, authenticity, and continuity of possession. The evidence manager ensures these requirements by implementing and documenting the chain of custody, which is the formal, chronological record of who collected the evidence, when and where it was collected, how it was packaged and labeled, how it was transported, where it was stored, and every time it was accessed or transferred. This role also enforces evidence handling procedures such as tamper-evident sealing, secure storage controls, access logging, and verification steps (for example, ensuring hashes are recorded and preserved for forensic images).

An incident responder focuses on containment and immediate actions during an incident; an incident analyzer performs technical analysis and correlation of artifacts; and an evidence examiner conducts detailed forensic examinations on acquired data. While these roles interact with evidence, the specific responsibility for maintaining custody documentation and evidence records to support legal admissibility belongs to the Evidence manager, making D the correct answer.

Answer : D

HKEY_CLASSES_ROOT (HKCR) is the Windows Registry location that stores file-association and COM registration data, including mappings for file extensions (e.g., .docx) to ProgIDs, and COM object identifiers such as CLSID and interface-related identifiers like IID. In forensic examinations, HKCR is frequently consulted to determine which application is registered to open a specific file type, to identify COM objects that may enable persistence or abuse (e.g., through COM hijacking), and to correlate suspicious registry-based execution mechanisms with installed software.

HKCR is often described as volatile in nature because it is not a single standalone hive file stored independently in the same way as SAM or SYSTEM; instead, it is a merged, runtime view created by the OS primarily from HKLM\Software\Classes (machine-wide registrations) and HKCU\Software\Classes (per-user overrides). This means what you see under HKCR can vary depending on the current user context and system state, and the effective associations/registrations may change when software is installed, updated, or when per-user settings override machine defaults.

The other options represent different scopes: HKLM is system configuration, HKCU is user profile configuration, and HKCC reflects the current hardware profile---not the primary COM/file association repository.

Answer : B

The Windows net view \\<computer> command is used to enumerate shared resources (SMB shares) that a remote Windows system is publishing. When Jessy runs net view \\10.10.10.11, her goal is to retrieve a list of the target host's visible shares---such as administrative shares (e.g., C$, ADMIN$) and any custom shares created for departments, applications, or users. In forensic and incident-response practice, this is important because attackers commonly use SMB shares for lateral movement, staging tools, dropping payloads, and exfiltrating data. By reviewing the shares exposed by a suspected server, the investigator can quickly identify unexpected or overly permissive shares, locate potential repositories of web content or logs, and determine whether a compromised web server is also exposing file resources that expand the attacker's options.

The other options map to different commands and artifacts: disk space usage is checked with storage utilities (not net view), open sessions are examined with commands like net session, and identifying users accessing files typically involves net file or server auditing logs. Therefore, Jessy's objective was to review file shares on the remote host.

Answer : B

The activity described---collecting network topology details and compiling a list of live hosts---matches the reconnaissance phase commonly referred to as enumeration. In digital forensics and incident response documentation, enumeration is the systematic process of discovering and extracting information about a target environment to support later exploitation. It typically follows (or overlaps with) scanning and includes identifying active IP addresses, reachable systems, open ports/services, device roles, OS fingerprints, domain information, shared resources, user/group details, and routing or segmentation clues that reveal how the network is structured.

This information is then used to plan ''further attacks,'' such as targeting exposed services, choosing exploit paths, locating high-value systems, and selecting lateral movement routes. From a forensic standpoint, enumeration attempts often leave traces in firewall logs, IDS alerts, and endpoint artifacts (e.g., bursts of connection attempts across many hosts/ports, ICMP echo sweeps, ARP discovery on local segments, and repeated DNS queries).

The other options do not fit: data modification involves altering data integrity; session hijacking targets active sessions/tokens; and buffer overflow is an exploitation technique against vulnerable software, not the information-gathering step described. Therefore, the correct answer is Enumeration (B)