Discuss EC-Council 212-89 Exam Topic 3 Question 63

Clark is investigating a cybercrime at TechSoft Solutions. While investigating the case,

he needs to collect volatile information such as running services, their process IDs,

startmode, state, and status.

Which of the following commands will help Clark to collect such information from

running services?

AOpenfiles

Bnetstat --ab

Cwmic

Dnet file

Suggested Answer: C

WMIC (Windows Management Instrumentation Command-line) is a command-line tool that provides a unified interface for Windows management tasks, including the collection of system information. It allows administrators and forensic investigators to query the live system for information about running services, their process IDs, start modes, states, and statuses, among other data. The use of WMIC is particularly valuable in incident response scenarios for gathering volatile information from a system without having to install additional software, which might alter the state of the system being investigated. By executing specific WMIC commands, Clark can extract detailed information about the services running on a system at the time of the investigation, making it an essential tool for collecting volatile data in a forensically sound manner.

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Nieves 11 months ago

I thought Openfiles was the one for running services?

Gwenn 11 months ago

netstat --ab is useful too, but not for services specifically.

Shenika 11 months ago

Wait, are we sure wmic is still supported?

Camellia 12 months ago

Definitely agree, wmic is the go-to for that info!

Jackie 12 months ago

I think the right command is wmic.

Earlean 1 year ago

I recall a similar question where `wmic` was the answer for collecting process details. It makes sense here too.

Skye 1 year ago

I feel like `openfiles` might show some file handles, but it doesn't seem right for services.

Sena 1 year ago

I'm not entirely sure, but I remember `netstat` being used for network connections, not really for services.

Jessenia 1 year ago

I think the `wmic` command is the one we practiced for gathering information about running services. It seems to fit what Clark needs.

Veronika 1 year ago

Ah, I think I've got it! The wmic command is definitely the way to go. It's a powerful tool for querying system information, and it should give Clark all the data he needs to collect the volatile information. I'm confident this is the right answer.

Buffy 1 year ago

I've got a good feeling about the netstat --ab command. That should provide the process IDs and other details that Clark needs to investigate the cybercrime case. I'm going to go with that option.

Chantay 1 year ago

Okay, let's see... I'm pretty sure the wmic command is the way to go here. It should give us all the details on the running services that Clark is looking for.

Mitzie 1 year ago

Hmm, this seems like a tricky one. I'll need to think carefully about the different command options and which one would be most useful for collecting the volatile information Clark needs.

Kaitlyn 1 year ago

I'm a bit confused by this question. I'm not sure if openfiles or net file would be the right choice for this scenario. Maybe I should review my notes on Windows command-line tools again.

Alfred 1 year ago

I'm pretty confident that the answer is A. Exploit prevention software would likely conflict with the Traps agent since they both deal with security and could interfere with each other's functionality.

Bobbye 2 years ago

C) wmic is the way to go, but I hope Clark has a cup of coffee handy. That command can be a real data firehose!

Sabine 2 years ago

As a cybercrime investigator, Clark needs all the intel he can get. C) wmic is the way to go - it's like having a cheat sheet for the system.

Linn 2 years ago

C) wmic is the clear winner. It's like having a crystal ball that reveals all the secrets of the running services.

Colene 2 years ago

↳ replying to Linn

C) wmic

Nydia 2 years ago

↳ replying to Linn

B) netstat --ab

Cordelia 2 years ago

↳ replying to Linn

A) Openfiles

Dorthy 2 years ago

B) netstat --ab might also be useful, but I think C) wmic is the most comprehensive option here.

Ernie 2 years ago

↳ replying to Dorthy

I think A) Openfiles could also be helpful in this situation.

Mitsue 2 years ago

↳ replying to Dorthy

I agree, C) wmic is the best option for collecting that information.

Lashon 2 years ago

I think 'net file' could also be a potential command for collecting the required information.

Rueben 2 years ago

Definitely C) wmic. It's the Swiss Army knife of service management commands. Clark will be able to collect all that juicy data in no time.

Krissy 2 years ago

I think 'Openfiles' might also be a good option for Clark to use in this situation.

Michell 2 years ago

Looks like C) wmic is the way to go. That command can give us all the details we need on running services.

Vesta 2 years ago

↳ replying to Michell

Yes, wmic will provide us with all the necessary details about the running services.

Willie 2 years ago

↳ replying to Michell

I think wmic is the most efficient command for this task.

Lizbeth 2 years ago

↳ replying to Michell

I agree, wmic is definitely the best option for collecting information on running services.

Kimbery 2 years ago

I disagree, I believe the command 'wmic' would be more suitable for collecting that information.

Denae 2 years ago

I think the command 'netstat --ab' will help Clark collect the information he needs.

EC-Council 212-89 Exam - Topic 3 Question 63 Discussion