Which of the following measures is defined as the time to move read or write disc heads from one point to another on the disk?
Answer(s): C
Seek time is the specific performance measure that describes how long a hard disk drive’s actuator takes to move the read/write heads across the platters from the current track (cylinder) to the target track where the requested data resides. In traditional magnetic HDDs, the heads must be physically repositioned before any sector can be read or written, making seek time a core component of mechanical latency.Digital forensics materials emphasize understanding this distinction because HDD mechanical behavior affects acquisition duration, the feasibility of repeated scans, and why imaging or carving operations can take longer on fragmented media. It also helps explain why solid-state drives (SSDs), which have no moving heads, do not have seek time in the same sense and therefore behave differently during large-scale reads.The other choices are broader or unrelated: access time typically refers to the total time to retrieve data, commonly combining seek time + rotational latency + transfer time. Delay time is not the standard term for head movement in disk performance definitions. Mean time is incomplete as written and is usually part of reliability metrics like mean time between failures, not head positioning. Therefore, the correct measure for head movement time is Seek time (C).
Bob, a professional hacker, targeted an organization to launch attacks. Bob gathered information such as network topology and a list of live hosts. Based on the collected information, he launched further attacks over the organization’s network.Identify the type of network attack Bob initiated on the target organization in the above scenario.
Answer(s): B
The activity described—collecting network topology details and compiling a list of live hosts— matches the reconnaissance phase commonly referred to as enumeration. In digital forensics and incident response documentation, enumeration is the systematic process of discovering and extracting information about a target environment to support later exploitation. It typically follows (or overlaps with) scanning and includes identifying active IP addresses, reachable systems, open ports/services, device roles, OS fingerprints, domain information, shared resources, user/group details, and routing or segmentation clues that reveal how the network is structured.This information is then used to plan “further attacks,” such as targeting exposed services, choosing exploit paths, locating high-value systems, and selecting lateral movement routes. From a forensic standpoint, enumeration attempts often leave traces in firewall logs, IDS alerts, and endpoint artifacts (e.g., bursts of connection attempts across many hosts/ports, ICMP echo sweeps, ARP discovery on local segments, and repeated DNS queries).The other options do not fit: data modification involves altering data integrity; session hijacking targets active sessions/tokens; and buffer overflow is an exploitation technique against vulnerable software, not the information-gathering step described. Therefore, the correct answer is Enumeration (B)
Which of the following hives in the Windows Registry hierarchical database is volatile in nature and contains file-extension association information and programmatic identifier (ProgID), Class ID (CLSID), and Interface ID (IID) data?
Answer(s): D
HKEY_CLASSES_ROOT (HKCR) is the Windows Registry location that stores file-association and COM registration data, including mappings for file extensions (e.g., .docx) to ProgIDs, and COM object identifiers such as CLSID and interface-related identifiers like IID. In forensic examinations, HKCR is frequently consulted to determine which application is registered to open a specific file type, to identify COM objects that may enable persistence or abuse (e.g., through COM hijacking), and to correlate suspicious registry-based execution mechanisms with installed software.HKCR is often described as volatile in nature because it is not a single standalone hive file stored independently in the same way as SAM or SYSTEM; instead, it is a merged, runtime view created by the OS primarily from HKLM\Software\Classes (machine-wide registrations) and HKCU\Software\Classes (per-user overrides). This means what you see under HKCR can vary depending on the current user context and system state, and the effective associations/registrations may change when software is installed, updated, or when per-user settings override machine defaults.The other options represent different scopes: HKLM is system configuration, HKCU is user profile configuration, and HKCC reflects the current hardware profile—not the primary COM/file association repository.
Identify the malware analysis technique in which the investigators must take a snapshot of the baseline state of the forensic workstation before malware execution.
The technique described—taking a snapshot of the baseline state of the forensic workstation before executing malware—aligns with Monitoring host integrity. In malware forensics, investigators often perform controlled execution (dynamic analysis) and need a reliable way to identify what changed on the system as a direct result of the malware run. Host integrity monitoring is a structured approach where the examiner first captures a known-good baseline of critical system elements such as file system state (key directories, system binaries), registry/configuration state, running services, installed drivers, scheduled tasks, and sometimes hash inventories of important files. After malware execution, the investigator captures a second snapshot and performs differential comparison to determine newly created/modified files, persistence mechanisms, configuration changes, dropped payloads, and tampering attempts.This baseline-before/after comparison is fundamental for attributing changes to the sample, supporting repeatability, and documenting evidence in a defensible manner. The other options do not require a workstation baseline snapshot in this sense: online malware scanning checks a file against signatures/reputation services; string search extracts readable strings from binaries; and file fingerprinting typically refers to hashing to uniquely identify a file, not system-wide state comparison. Therefore, the correct answer is Monitoring host integrity (B).
An investigator wants to extract information about the status of the network interface cards (NICs) in an organization’s Windows-based systems. Identify the command-line utility that can help the investigator detect the network status.
Answer(s): A
On Windows systems, ipconfig is the standard command-line utility used to display and troubleshoot TCP/IP configuration and the operational status of network interfaces. From a forensic and incident-response perspective, it helps investigators quickly identify whether a NIC is enabled and configured, and it reveals key network parameters tied to “network status,” such as the assigned IPv4/IPv6 addresses, subnet mask, default gateway, and DNS servers. Using variants like ipconfig /all, responders can also capture adapter-specific metadata including MAC address (physical address), DHCP enablement, DHCP server, lease timestamps, and interface descriptions—useful for correlating an endpoint to switch-port logs, DHCP logs, and network monitoring data. This is often part of live triage because it documents the system’s current connectivity and routing context at the time of seizure or investigation.The other options are not appropriate for NIC status: PsLoggedOn reports logged-on users, and PsList enumerates running processes—both are Sysinternals tools focused on user/process state rather than network interface configuration. ifconfig is a UNIX/Linux command (and not the primary Windows utility), so it would not be the correct choice for Windows-based systems. Therefore, ipconfig (A) is correct.
Which of the following Tor relay nodes in the Tor circuit is designed to transfer data in an encrypted format?
In a standard Tor circuit, a client typically builds a three-hop path: Entry/Guard →Middle →Exit. Tor uses onion routing, where the client wraps the payload in multiple encryption layers—one for each hop. Each relay removes (decrypts) only its own layer to learn the next hop, but not the complete route or the original payload in the clear. The middle relay is specifically positioned to forward traffic between the entry/guard and the exit while it remains onion-encrypted end-to-end within the Tor network. Because it neither connects to the user’s local network (like the entry/guard) nor to the public destination (like the exit), its primary role is encrypted transit/forwarding, helping break the linkage between source and destination. By contrast, the exit relay is where traffic leaves Tor; unless the application layer uses TLS/HTTPS, the exit may deliver data to the destination in unencrypted form on the open Internet. The entry/guard protects against certain traffic-correlation risks by being stable, but it is not uniquely “the” encrypted-transfer node. Therefore, the best single answer is Middle relay (D).
A system that a cybercriminal was suspected to have used for performing an anti-social activity through the Tor browser. James reviewed the active network connections established using specific ports via Tor.Which of the following port numbers does Tor use for establishing a connection via Tor nodes?
In Tor Browser deployments, Tor typically runs a local client (“tor” process) that exposes a SOCKS proxy for applications (the browser) to send traffic into the Tor network and, optionally, a control interface for managing circuits and obtaining runtime status. In many forensic lab guides and Tor Browser bundle configurations, the default local SOCKS listening port is 9150, and the associated Tor control port is commonly 9151. This pairing is frequently referenced in investigations because endpoint triage (e.g., netstat outputs, firewall logs, EDR socket telemetry) may show local loopback connections from the browser to 127.0.0.1:9150 (SOCKS) and management communications involving 9151 (control).From a network-forensics viewpoint, these ports help distinguish Tor Browser activity from other proxy tools: the browser does not directly connect to Tor relays; instead, it hands traffic to the local SOCKS proxy, which then establishes encrypted circuits to Tor nodes. While Tor can be configured to use different ports, the question asks about the specific ports used for establishing Tor connections in typical Tor Browser setups, which aligns with 9150/9151. Therefore, the correct option is D.
While investigating a web attack on a Windows-based server, Jessy executed the following command on her system:C:> net view <\10.10.10.11>What was Jessy’s objective in running the above command?
The Windows net view \\<computer> command is used to enumerate shared resources (SMB shares) that a remote Windows system is publishing. When Jessy runs net view \\10.10.10.11, her goal is to retrieve a list of the target host’s visible shares—such as administrative shares (e.g., C$, ADMIN$) and any custom shares created for departments, applications, or users. In forensic and incident-response practice, this is important because attackers commonly use SMB shares for lateral movement, staging tools, dropping payloads, and exfiltrating data. By reviewing the shares exposed by a suspected server, the investigator can quickly identify unexpected or overly permissive shares, locate potential repositories of web content or logs, and determine whether a compromised web server is also exposing file resources that expand the attacker’s options.The other options map to different commands and artifacts: disk space usage is checked with storage utilities (not net view), open sessions are examined with commands like net session, and identifying users accessing files typically involves net file or server auditing logs. Therefore, Jessy’s objective was to review file shares on the remote host.
Post your Comments and Discuss EC-Council 112-57 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 112-57 content, but please register or login to continue.