EC-Council Digital Forensics Essentials DFE 112-57 Exam Questions

Page: 1 / 14
Total 75 questions
Question 1

Michael, a forensic expert, was assigned to investigate an incident that involved unauthorized intrusion attempts. In this process, Michael identified all the open ports on a system and disabled them because these open ports can allow attackers to install malicious services and compromise the security of the system or network.

Which of the following commands assisted Michael in identifying open ports in the above scenario?



Answer : C

To identify open ports, investigators need a method that actively checks which TCP/UDP ports on a host are accepting connections. The command nmap -sT localhost performs a TCP Connect scan against the local system. In a connect scan, Nmap uses the operating system's normal networking API to attempt a full TCP three-way handshake to each targeted port. If the handshake completes, the port is reported as open; if it is refused, it is closed; and if filtered by firewall rules, it may appear filtered. This directly supports Michael's objective of enumerating open ports so they can be reviewed and disabled to reduce the attack surface and prevent malicious services from being installed.

The other options do not enumerate open ports in the same way. netstat -i shows interface-level statistics (packets, errors) rather than listing listening services. netstat -rn displays the routing table (routes and gateways), which helps understand network paths but not which ports are open. ifconfig <interface> -promisc relates to enabling/disabling promiscuous mode on an interface for packet capture, not port discovery. Therefore, the command that assisted in identifying open ports is nmap -sT localhost (C).


Question 2

Jack, a forensic investigator, was appointed by an organization to perform a security audit on a Linux system. In this process, Jack collected information about the present status of the system and listed all the applications running on various ports to detect malicious programs.

Which of the following commands can help Jack determine any programs/processes associated with open ports?



Answer : D

On Linux, a key step in a forensic triage or security audit is mapping open/listening ports to the owning process so investigators can identify suspicious services (backdoors, unauthorized daemons, rogue remote-access tools) and correlate them with binaries, users, startup mechanisms, and timestamps. The command netstat -tulpn is designed for exactly this purpose. In this switch set: -t limits output to TCP sockets, -u includes UDP sockets, -l shows only listening sockets (open ports awaiting connections), -p displays the owning process name and PID, and -n prevents name resolution by showing numeric IP addresses and ports (faster and avoids altering evidence via DNS queries). This combination yields a concise list of active listening ports and the processes bound to them, which is highly valuable for detecting unexpected services and attributing network exposure to a specific executable.

The other options do not provide process-to-port attribution: netstat -i shows interface statistics, ip r shows the routing table, and netstat -rn displays the routing table in numeric form. Therefore, the correct command is netstat -tulpn (D).


Question 3

Which of the following tools can be used by an investigator to analyze the metadata of files in a Windows-based system?



Answer : A

Bulk Extractor is a digital forensics utility specifically designed to scan storage media (or forensic disk images) and automatically extract structured artifacts and metadata-like features without relying strictly on file system parsing. In Windows investigations, it is commonly used to identify and pull out items such as email addresses, URLs, domain names, credit card patterns, timestamps, GPS coordinates, and other feature records that can be treated as metadata indicators during triage and deep analysis. Because it works by scanning raw data blocks and producing feature reports, it can recover useful information even when files are deleted, partially corrupted, or when file system structures are damaged---conditions frequently encountered in forensic cases. Investigators use its outputs to correlate user activity, locate sensitive data exposure, and identify evidence-rich regions for further examination with file-level tools.

The other options do not match the requirement of analyzing file metadata broadly. Tor browser is an anonymity-focused web browser, not a forensic metadata analyzer. IECachesView is a niche utility for viewing Internet Explorer cache/history artifacts rather than general file metadata analysis. Paraben P2 Commander targets peer-to-peer investigations and related artifacts, not general metadata extraction across files. Therefore, the correct tool for analyzing metadata-like artifacts on a Windows-based system is Bulk Extractor (A).


Question 4

Bob, a forensic investigator, is investigating a live Windows system found at a crime scene. In this process, Bob extracted subkeys containing information such as SAM, Security, and software using an automated tool called FTK Imager.

Which of the following Windows Registry hives' subkeys provide the above information to Bob?



Answer : B

In Windows forensics, the Registry is organized into logical root keys (''hives'') that aggregate configuration and security data. The items named in the question---SAM, SECURITY, and SOFTWARE---are system-wide registry hives stored on disk (typically under the system's configuration directory) and loaded at runtime under HKEY_LOCAL_MACHINE (HKLM). Investigators rely on these hives because they contain high-value evidence: the SAM hive stores local account database information (including user and group identifiers and credential-related material), the SECURITY hive holds system security policy and LSA-related settings, and the SOFTWARE hive contains installed software, application configuration, and many operating system settings relevant for program execution and persistence analysis.

Tools like FTK Imager can extract these hives (or their live-memory representations) during triage to preserve volatile context and enable offline parsing while maintaining evidentiary integrity. The other root keys do not match these specific hives: HKEY_CURRENT_USER is per-user profile data, HKEY_CURRENT_CONFIG reflects current hardware profile, and HKEY_CLASSES_ROOT is primarily file association/COM class mapping (largely derived from HKLM\Software\Classes and HKCU\Software\Classes). Therefore, the correct hive root that provides SAM, SECURITY, and SOFTWARE subkeys is HKEY_LOCAL_MACHINE (B).


Question 5

An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose, Steven, a security analyst, was instructed to deploy a device to bait attackers. Steven selected a solution that appears to contain very useful information to lure attackers and find their locations and techniques.

Identify the type of device deployed by Steven in the above scenario.



Answer : C

A honeypot is a deliberately deployed decoy system or service designed to attract attackers by appearing valuable or vulnerable, thereby enabling defenders to observe malicious behavior in a controlled manner. Digital forensics and incident response references describe honeypots as tools for threat intelligence and evidence collection, because they can record interaction details such as connection sources, exploited services, commands executed, malware dropped, and attempted privilege escalation. This directly matches the scenario: Steven deployed something that ''appears to contain very useful information'' to lure attackers and help identify their locations and techniques. Honeypots are typically instrumented with extensive logging and monitoring, making them especially useful for building timelines, extracting indicators of compromise, and understanding adversary tactics, techniques, and procedures.

The other options do not align with the ''bait attackers'' goal. An IDS primarily detects and alerts on suspicious activity but is not intended to impersonate a valuable target. A firewall enforces access control rules to block/allow traffic, not entice attackers. A router forwards packets and provides network connectivity; it is not a deception platform. Therefore, the device type described is a Honeypot (C).


Question 6

Sam is working as a loan agent for a financial institution. He frequently receives a number of emails from clients providing their personal details for loan approval. As these emails contain sensitive data, Sam had set up a feature that directly downloads the emails on his device without storing a copy on the mail server. Which of the following protocols provides the above-discussed email features?



Answer : C

The scenario describes an email-retrieval configuration in which messages are downloaded to a client device and not retained on the server. This behavior aligns with POP3 (Post Office Protocol v3), a legacy but widely referenced mail access protocol that retrieves email from a server mailbox to a local client. In standard POP3 operation, the client authenticates to the mail server, issues retrieval commands (e.g., to list and download messages), and may then issue a delete command so that downloaded messages are removed from the server mailbox. Digital forensics references commonly contrast POP3 with IMAP: IMAP is designed for server-side mailbox synchronization and typically leaves mail stored on the server, whereas POP3 is oriented toward client-side storage and supports workflows where server copies are not preserved after download. The other options are unrelated to email retrieval: SHA-1 is a cryptographic hash function used for integrity checks, ICMP supports network diagnostics and control messaging, and SNMP is used for network device management and monitoring. From an investigative standpoint, POP3 usage can reduce server-resident evidence and shift evidentiary value to local artifacts (mail client databases, cache, OS traces, backups), which is consistent with the intent described in the question.


Question 7

Clark, a digital forensic expert, was assigned to investigate a malicious activity performed on an organization's network. The organization provided Clark with all the information related to the incident. In this process, he assessed the impact of the incident on the organization, reasons for and source of the incident, steps required to tackle the incident, investigation team required to handle the case, investigative procedures, and possible outcome of the forensic process.

Identify the type of analysis performed by Clark in the above scenario.



Answer : B

The activities described align with case analysis, which is the structured, high-level evaluation performed at the beginning (and throughout) a digital forensic investigation to define scope, strategy, resources, and expected deliverables. Case analysis focuses on understanding the overall incident context: how the organization is affected (business/operational impact), what is believed to have happened (incident reasons and likely source), and what must be done to control and investigate it (containment steps and investigative approach). It also includes planning elements such as identifying the investigation team composition (roles, skills, authority), defining procedures to be followed (evidence handling, chain of custody, acquisition priorities, legal/HR requirements), and anticipating the possible outcomes (reports, remediation actions, disciplinary/legal actions, or prosecution support).

By contrast, traffic analysis is narrowly focused on examining network packets/flows to infer communications and attacker behavior; log analysis centers on parsing and correlating event records (firewall, server, endpoint logs); and data analysis typically refers to examining acquired artifacts (files, memory images, timelines) for evidentiary content. Because Clark is assessing impact, cause/source, response steps, staffing, procedures, and outcomes---an overall investigative planning and evaluation function---the correct choice is Case analysis (B).


Page:    1 / 14   
Total 75 questions