Free ECSS sample questions

Correct answer: Using network segmentation, host-based intrusion detection, data-at-rest encryption, and role-based access control.

Defense-in-depth is a strategy that employs multiple layers of security controls to protect assets. The correct option describes four distinct layers: network (segmentation), host (HIDS), data (encryption), and application/user (RBAC). Each of the other options represents only a single layer of security. While valuable, a single control does not constitute a defense-in-depth strategy on its own.

Correct answer: Security Incident and Event Management (SIEM)

A Security Incident and Event Management (SIEM) system is the core technology for collecting and correlating log data from diverse sources like firewalls, servers, and applications. Its primary function is to provide real-time analysis of security alerts generated by network hardware and applications. NIDS only monitors network traffic, DLP focuses on preventing data exfiltration, and a honeypot is a decoy system.

Correct answer: Tunnel command and control traffic through the existing, legitimate database connection port.

Tunneling C2 traffic through an already allowed and expected connection (like a database port) is a classic pivoting technique. It is highly effective and stealthy because the traffic appears legitimate to firewalls and basic monitoring systems. A full Nmap scan is extremely noisy and would likely be detected. Sniffing might work, but it's passive and depends on cleartext protocols. A brute-force attack is also noisy and inefficient.

Correct answer: Generating and verifying cryptographic hashes (e.g., SHA-256) of both the source drive and the resulting image file.

Generating and verifying cryptographic hashes is the standard and most critical method to prove that a forensic image is an exact bit-for-bit copy of the original source. A hash is calculated for the source drive before imaging and for the destination image file after imaging. If the hashes match, it provides mathematical proof of integrity. While using a write-blocker is essential to prevent modification and documentation is part of the chain of custody, only hash verification proves the copy is identical.

Correct answers: WPA3-Enterprise; 802.1X authentication with a RADIUS server

WPA3 is the latest and most secure wireless protocol, offering significant improvements over WPA2, including protection against offline dictionary attacks. 802.1X (often used with WPA3-Enterprise) provides robust, individual user authentication via a RADIUS server, which is far more secure than a shared password (PSK).

WPA3 is the latest and most secure wireless protocol, offering significant improvements over WPA2, including protection against offline dictionary attacks. 802.1X (often used with WPA3-Enterprise) provides robust, individual user authentication via a RADIUS server, which is far more secure than a shared password (PSK).

Correct answer: False

This statement is false. The 'Weaponization' phase involves coupling an exploit with a payload (e.g., a remote access trojan) to create a deliverable malicious tool. The act of scanning the target's network to find vulnerabilities occurs during the 'Reconnaissance' and 'Scanning' phases, which precede weaponization.

Correct answer: LNK files and Jump Lists

Windows automatically creates LNK (shortcut) files and Jump Lists to track recently opened files and applications for user convenience. These artifacts persist even after files are deleted and history is cleared, providing a valuable timeline of user activity. The Security event log tracks security-related events like logons, the SAM hive stores user password hashes, and the System32 directory contains core system files, not user activity logs.

Correct answer: TLS (Transport Layer Security)

Transport Layer Security (TLS), the protocol that underpins HTTPS, is designed specifically for this purpose. It encrypts data in transit (confidentiality), uses message authentication codes to prevent tampering (integrity), and uses digital certificates to authenticate the server to the client. SSH is for secure remote administration, FTP is insecure for file transfers, and IPsec operates at the network layer, typically for VPNs.

Correct answers: Urgency; Authority

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

Correct answer: The server's private key.

To decrypt a TLS session captured in a PCAP file (assuming a cipher suite like RSA was used for key exchange), the investigator needs the server's private key. The private key is used to decrypt the pre-master secret exchanged during the TLS handshake, which then allows the investigator's tool (like Wireshark) to derive the symmetric session keys and decrypt the application data. The public key is publicly available and cannot be used for decryption. The session key itself is what needs to be derived.