Free ECSS sample questions

Correct answer: Tunnel command and control traffic through the existing, legitimate database connection port.

Tunneling C2 traffic through an already allowed and expected connection (like a database port) is a classic pivoting technique. It is highly effective and stealthy because the traffic appears legitimate to firewalls and basic monitoring systems. A full Nmap scan is extremely noisy and would likely be detected. Sniffing might work, but it's passive and depends on cleartext protocols. A brute-force attack is also noisy and inefficient.

Correct answer: Generating and verifying cryptographic hashes (e.g., SHA-256) of both the source drive and the resulting image file.

Generating and verifying cryptographic hashes is the standard and most critical method to prove that a forensic image is an exact bit-for-bit copy of the original source. A hash is calculated for the source drive before imaging and for the destination image file after imaging. If the hashes match, it provides mathematical proof of integrity. While using a write-blocker is essential to prevent modification and documentation is part of the chain of custody, only hash verification proves the copy is identical.

Correct answers: WPA3-Enterprise; 802.1X authentication with a RADIUS server

WPA3 is the latest and most secure wireless protocol, offering significant improvements over WPA2, including protection against offline dictionary attacks. 802.1X (often used with WPA3-Enterprise) provides robust, individual user authentication via a RADIUS server, which is far more secure than a shared password (PSK).

WPA3 is the latest and most secure wireless protocol, offering significant improvements over WPA2, including protection against offline dictionary attacks. 802.1X (often used with WPA3-Enterprise) provides robust, individual user authentication via a RADIUS server, which is far more secure than a shared password (PSK).

Correct answer: False

This statement is false. The 'Weaponization' phase involves coupling an exploit with a payload (e.g., a remote access trojan) to create a deliverable malicious tool. The act of scanning the target's network to find vulnerabilities occurs during the 'Reconnaissance' and 'Scanning' phases, which precede weaponization.

Correct answer: LNK files and Jump Lists

Windows automatically creates LNK (shortcut) files and Jump Lists to track recently opened files and applications for user convenience. These artifacts persist even after files are deleted and history is cleared, providing a valuable timeline of user activity. The Security event log tracks security-related events like logons, the SAM hive stores user password hashes, and the System32 directory contains core system files, not user activity logs.

Correct answer: TLS (Transport Layer Security)

Transport Layer Security (TLS), the protocol that underpins HTTPS, is designed specifically for this purpose. It encrypts data in transit (confidentiality), uses message authentication codes to prevent tampering (integrity), and uses digital certificates to authenticate the server to the client. SSH is for secure remote administration, FTP is insecure for file transfers, and IPsec operates at the network layer, typically for VPNs.

Correct answers: Urgency; Authority

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

Correct answer: The server's private key.

To decrypt a TLS session captured in a PCAP file (assuming a cipher suite like RSA was used for key exchange), the investigator needs the server's private key. The private key is used to decrypt the pre-master secret exchanged during the TLS handshake, which then allows the investigator's tool (like Wireshark) to derive the symmetric session keys and decrypt the application data. The public key is publicly available and cannot be used for decryption. The session key itself is what needs to be derived.

Correct answer: Mobile Application Management (MAM) with containerization

Mobile Application Management (MAM) with containerization is the ideal solution for BYOD scenarios. It creates a secure, encrypted container on the device that isolates corporate apps and data. This allows the company to enforce policies (like copy-paste restrictions) and perform a selective wipe of only the container without affecting the user's personal data. Full MDM gives control over the entire device, which is often too intrusive for BYOD. Geofencing restricts functionality by location, and a VPN only secures the connection.

Correct answer: Hashcat

Hashcat is a world-renowned password recovery tool that is highly optimized for GPU-based cracking, making it significantly faster than CPU-based tools for this task. While John the Ripper can crack passwords (and has some GPU support), Hashcat is generally considered the superior tool for leveraging GPU power. Nmap is a network scanner, and Metasploit is an exploitation framework.