- (Exam Topic 1)
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts in the first letter position of the filename in the FAT database.

1. A. A Capital X
2. B. A Blank Space
3. C. The Underscore Symbol
4. D. The lowercase Greek Letter Sigma (s)

Correct Answer: D

- (Exam Topic 4)
A clothing company has recently deployed a website on Its latest product line to Increase Its conversion rate and base of customers. Andrew, the network administrator recently appointed by the company, has been assigned with the task of protecting the website from Intrusion and vulnerabilities. Which of the following tool should Andrew consider deploying in this scenario?

1. A. ModSecurity
2. B. CryptaPix
3. C. Recuva
4. D. Kon-Boot

Correct Answer: A

- (Exam Topic 1)
With Regard to using an Antivirus scanner during a computer forensics investigation, You should:

1. A. Scan the suspect hard drive before beginning an investigation
2. B. Never run a scan on your forensics workstation because it could change your systems configuration
3. C. Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
4. D. Scan your Forensics workstation before beginning an investigation

Correct Answer: D

- (Exam Topic 3)
An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the
last-accessed timestamps of the machine. What would he do to achieve this?

1. A. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 0
2. B. Run the command fsutil behavior set disablelastaccess 0
3. C. Set the registry value of HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate to 1
4. D. Run the command fsutil behavior set enablelastaccess 0

Correct Answer: C

- (Exam Topic 1)
After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

1. A. Stateful firewalls do not work with packet filtering firewalls
2. B. NAT does not work with stateful firewalls
3. C. IPSEC does not work with packet filtering firewalls
4. D. NAT does not work with IPSEC

Correct Answer: D