Eccouncil 212-89 Exam - Topic 3 Question 63 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 63
Topic #: 3

[All 212-89 Questions]

Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,

he needs to collect volatile information such as running services, their process IDs,

startmode, state, and status.

Which of the following commands will help Clark to collect such information from

running services?

AOpenfiles

Bnetstat --ab

Cwmic

Dnet file

Show Suggested Answer

Suggested Answer: C

WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a unified interface for Windows management tasks, including the collection of system information. It allows administrators and forensic investigators to query the live system for information about running services, their process IDs, start modes, states, and statuses, among other data. The use of WMIC is particularly valuable in incident response scenarios for gathering volatile information from a system without having to install additional software, which might alter the state of the system being investigated. By executing specific WMIC commands, Clark can extract detailed information about the services running on a system at the time of the investigation, making it an essential tool for collecting volatile data in a forensically sound manner.

by Jeniffer at Aug 03, 2024, 04:27 PM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nieves

3 months ago

I thought Openfiles was the one for running services?

upvoted 0 times

...

Gwenn

3 months ago

netstat --ab is useful too, but not for services specifically.

upvoted 0 times

...

Shenika

3 months ago

Wait, are we sure wmic is still supported?

upvoted 0 times

...

Camellia

4 months ago

Definitely agree, wmic is the go-to for that info!

upvoted 0 times

...

Jackie

4 months ago

I think the right command is wmic.

upvoted 0 times

...

Earlean

4 months ago

I recall a similar question where `wmic` was the answer for collecting process details. It makes sense here too.

upvoted 0 times

...

Skye

4 months ago

I feel like `openfiles` might show some file handles, but it doesn't seem right for services.

upvoted 0 times

...

Sena

4 months ago

I'm not entirely sure, but I remember `netstat` being used for network connections, not really for services.

upvoted 0 times

...

Jessenia

5 months ago

I think the `wmic` command is the one we practiced for gathering information about running services. It seems to fit what Clark needs.

upvoted 0 times

...

Veronika

5 months ago

Ah, I think I've got it! The wmic command is definitely the way to go. It's a powerful tool for querying system information, and it should give Clark all the data he needs to collect the volatile information. I'm confident this is the right answer.

upvoted 0 times

...

Buffy

5 months ago

I've got a good feeling about the netstat --ab command. That should provide the process IDs and other details that Clark needs to investigate the cybercrime case. I'm going to go with that option.

upvoted 0 times

...

Chantay

5 months ago

Okay, let's see... I'm pretty sure the wmic command is the way to go here. It should give us all the details on the running services that Clark is looking for.

upvoted 0 times

...

Mitzie

5 months ago

Hmm, this seems like a tricky one. I'll need to think carefully about the different command options and which one would be most useful for collecting the volatile information Clark needs.

upvoted 0 times

...

Kaitlyn

5 months ago

I'm a bit confused by this question. I'm not sure if openfiles or net file would be the right choice for this scenario. Maybe I should review my notes on Windows command-line tools again.

upvoted 0 times

...

Alfred

5 months ago

I'm pretty confident that the answer is A. Exploit prevention software would likely conflict with the Traps agent since they both deal with security and could interfere with each other's functionality.

upvoted 0 times

...