EC-Council Certified Security Analyst(ECSA)

____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.

You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network.

How would you answer?

Windows identifies which application to open a file with by examining which of the following?

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive.

How will these forms be stored to help preserve the chain of custody of the case?

What is the following command trying to accomplish?

You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company's clients. You have rummaged through their trash and found very little information. You do not want to set off any alarms on their network, so you plan on performing passive footprinting against their Web servers.

What tool should you use?

If a suspect computer is located in an area that may have toxic chemicals, you must:

What is the advantage in encrypting the communication between the agent and the monitor in an Intrusion Detection System?

What does ICMP Type 3/Code 13 mean?

Software firewalls work at which layer of the OSI model?