ECCouncil 312-49v10 Practice Test - Questions Answers, Page 66

A forensic analyst has been tasked with investigating unusual network activity Inside a retail company's network. Employees complain of not being able to access services, frequent rebooting, and anomalies In log files. The Investigator requested log files from the IT administrator and after carefully reviewing them, he finds the following log entry:

What type of attack was performed on the companies' web application?

On NTFS file system, which of the following tools can a forensic Investigator use In order to identify timestomping of evidence files?

Rule 1002 of Federal Rules of Evidence (US) talks about_____

Which of the following Ii considered as the starting point of a database and stores user data and database objects in an MS SQL server?

Which of the following statements is true with respect to SSDs (solid-state drives)?

To understand the impact of a malicious program after the booting process and to collect recent information from the disk partition, an Investigator should evaluate the content of the:

During a forensic investigation, a large number of files were collected. The investigator needs to evaluate ownership and accountability of those files. Therefore, he begins to Identify attributes such as "author name," "organization name." "network name," or any additional supporting data that is meant for the owner's Identification purpose. Which term describes these attributes?

The working of the Tor browser is based on which of the following concepts?

An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected Instance to perform further analysis and collected other data of evidentiary value. What should be their next step?