Eccouncil ECSS Exam - Topic 4 Question 64 Discussion

Actual exam question for Eccouncil's ECSS exam

Question #: 64
Topic #: 4

Bob, a forensic investigator, was instructed to review a Windows machine and identify any anonymous activities performed using it. In this process. Bob used the command ''netstat -ano" to view all the active connections in the system and determined that the connections established by the Tor browser were closed. Which of the following states of the connections established by Tor indicates that the Tor browser is closed?

AESTABLISHED

BCLOSE WAIT

CTIMEWAIT

DLISTENING

Show Suggested Answer

Suggested Answer: C

by Ma at Feb 08, 2023, 07:46 AM

Limited Time Offer

25%

Off

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosalyn

7 months ago

ESTABLISHED means it's still active, so that's a no-go.

upvoted 0 times

...

Dorothy

7 months ago

Wait, are you sure TIMEWAIT is the correct state? Sounds off.

upvoted 0 times

...

Lawrence

7 months ago

LISTENING doesn't make sense here, right?

upvoted 0 times

...

Myong

7 months ago

I thought CLOSE WAIT was the right one, but I guess not!

upvoted 0 times

...

Gerald

7 months ago

Definitely TIMEWAIT means the Tor browser is closed.

upvoted 0 times

...

Cristy

8 months ago

"LISTENING" is definitely not the right state for a closed browser, but I can't remember what the others mean exactly.

upvoted 0 times

...

Marilynn

8 months ago

"TIMEWAIT" sounds familiar, but I can't recall if it means the browser is completely closed or just waiting for a timeout.

upvoted 0 times

...

Cruz

8 months ago

I think "CLOSE WAIT" might indicate that the connection is in the process of closing, but I'm not entirely sure.

upvoted 0 times

...

Lauran

8 months ago

I remember that "ESTABLISHED" means the connection is active, so it can't be that one.

upvoted 0 times

...

Yuette

8 months ago

Okay, let me think this through step-by-step. I need to identify the key elements of an RPA capability vision.

upvoted 0 times

...

Brett

8 months ago

Okay, I've got this. Periods, accounts, and entities are the three application elements we can import metadata changes for.

upvoted 0 times

...

Domonique

8 months ago

This question seems straightforward, but I want to make sure I understand the concept of "rights of accumulation" before answering.

upvoted 0 times

...

Sharika

8 months ago

I'm leaning towards B as well. Performing with minimal supervision seems to indicate a level of understanding beyond just basic knowledge, so Application makes the most sense to me.

upvoted 0 times

...

King

1 year ago

Haha, Tor browser, eh? Bet those guys are having a field day with this one. I'm gonna go with C, TIMEWAIT, just to mess with 'em!

upvoted 0 times

Karl

12 months ago

D) LISTENING

upvoted 0 times

...

Elouise

12 months ago

C) TIMEWAIT

upvoted 0 times

...

Marisha

12 months ago

B) CLOSE WAIT

upvoted 0 times

...

Paulina

12 months ago

A) ESTABLISHED

upvoted 0 times

...

Lanie

12 months ago

D) LISTENING

upvoted 0 times

...

Latia

1 year ago

C) TIMEWAIT

upvoted 0 times

...

Lai

1 year ago

B) CLOSE WAIT

upvoted 0 times

...

Argelia

1 year ago

A) ESTABLISHED

upvoted 0 times

...

Leatha

1 year ago

C) TIMEWAIT

upvoted 0 times

...

Benedict

1 year ago

B) CLOSE WAIT

upvoted 0 times

...

Felix

1 year ago

A) ESTABLISHED

upvoted 0 times

...

Sharee

1 year ago

Ooh, this is a good one. I'm gonna go with D, LISTENING. Wait, no, that doesn't make sense. Uh, let me think about this again... *scratches head*

upvoted 0 times

...

Lisha

1 year ago

Ah, the old 'netstat -ano' trick. Classic forensics move. I reckon the answer's C, TIMEWAIT. Gotta love those networking protocols, am I right?

upvoted 0 times

...

Hermila

1 year ago

Hmm, let's see. If the Tor connections are closed, that means they're probably in the CLOSE_WAIT state, right? I'm going with B on this one.

upvoted 0 times

...

Jacquline

1 year ago

I agree with Gussie, A) ESTABLISHED makes more sense in this context.

upvoted 0 times

...

Graciela

1 year ago

Well, this is a tricky one. Gotta be on the lookout for those sneaky Tor connections, huh? I'm thinking C, TIMEWAIT, seems like the most logical choice here.

upvoted 0 times