Eccouncil 112-57 Exam Questions

Promiscuous mode is a network interface configuration in which the NIC passes all observed frames to the operating system, not only frames addressed to that host's MAC address. In investigations, this matters because promiscuous mode is commonly enabled by packet sniffers, certain intrusion tools, or misconfigured monitoring software, and it can indicate covert traffic capture on a host.

On UNIX/Linux systems, the traditional command used to view interface flags and status is ifconfig <interface name>. When an interface is set to promiscuous mode, ifconfig displays a PROMISC flag in the interface's status line, allowing an investigator to confirm whether the NIC is accepting all frames. This directly matches Kane's goal of checking if the interface is running in promiscuous mode.

The other commands do not provide this specific interface flag. nmap -sT localhost scans for open TCP ports, not interface modes. ipconfig is a Windows command (and does not take an interface name in that form to show PROMISC status), and it primarily reports IP configuration. netstat -i shows network interface statistics (packets, errors, drops) but typically does not explicitly indicate promiscuous mode. Therefore, the correct command is ifconfig <interface name> (C).

The command path /bin/rm is a hallmark of UNIX/POSIX-style operating systems, where core userland utilities are commonly stored under directories such as /bin, /sbin, and /usr/bin. The utility rm (remove) is the standard UNIX command used to delete directory entries that reference a file's data blocks on disk. This layout and command structure do not match Windows, which uses different filesystem conventions (drive letters, backslashes, and Windows-native executables) and does not provide /bin/rm as a native path. Android, while Linux-kernel-based, typically exposes shell utilities through environments like /system/bin (and newer systems may use toybox/busybox variants), not the classic /bin hierarchy expected on general-purpose UNIX systems. Between the remaining options, both Linux and macOS are UNIX-like and can include an rm command; however, in digital forensics training and examination contexts, the explicit reference to /bin/rm is most commonly used to indicate a Linux/UNIX command-line environment on a compromised host. Therefore, the best single-choice answer from the provided options is Linux (D).

Spimming is defined in digital forensics and cybercrime references as spam over instant messaging (IM). It is a social-engineering variant where attackers use instant messaging platforms (and sometimes chat apps) to deliver unsolicited bulk messages containing malicious links, fraudulent offers, credential-harvesting lures, or malware downloads. Because IM messages are often delivered in real time and can appear to come from known contacts (via compromised accounts), spimming can achieve higher click-through rates than traditional email spam. For investigators, spimming incidents commonly leave artifacts such as chat logs, message timestamps, sender identifiers, embedded URLs, and sometimes downloaded payload traces on the endpoint. These artifacts help establish attacker infrastructure (domains, IPs), victim interaction (click events, file creation), and timeline correlation with network logs.

The other options do not match the ''IM as a tool to spread spam'' description. Whaling targets high-profile individuals via highly tailored phishing, typically email-based. Pharming redirects users to fraudulent websites (often via DNS or host-file manipulation) without relying on bulk IM spam. Spear phishing is targeted phishing toward specific individuals or groups, not necessarily IM spam. Therefore, the phishing/spam attack that exploits instant messaging platforms is Spimming (C).

In static malware analysis, one of the quickest ways to infer capability is to extract and review strings embedded in a binary. Strings frequently reveal command-and-control domains/IPs, mutex names, file paths, registry keys, user-agent values, suspicious commands (PowerShell/cmd), API names, error messages, encryption markers, and configuration fragments. Investigators often use automated utilities to extract these readable artifacts and export them to a text file for later triage, keyword searching, and correlation with other evidence (network logs, endpoint telemetry, and threat intel).

Among the provided options, ResourcesExtract best matches this workflow. It is designed to extract embedded content from executable files---particularly Windows PE resources---and can export extracted textual items (including resource strings/strings tables and related embedded text) into external files for analysis. This aligns with ''performed a string search and saved all the identified strings in a text file.''

The other choices do not fit: R-Drive Image is a disk imaging/backup tool; Ezvid is for screen recording; and Snagit is for screenshots/screen capture. They do not perform automated extraction of strings from malware binaries as a static-analysis step. Therefore, the correct answer is ResourcesExtract (B).

Jennifer's actions match the responsibilities of an incident responder, whose job spans immediate containment, preservation, and stabilization activities during an active or recently active security incident. In standard digital forensics and incident response (DFIR) procedures, responders first take steps to preserve evidence (e.g., documenting the scene, capturing volatile data when appropriate, and collecting relevant system artifacts) and then execute containment measures to prevent further harm. Disconnecting a compromised host from the network is a classic containment control used to stop malware propagation, block command-and-control communications, and prevent lateral movement to other systems.

An incident analyzer typically focuses on deeper technical analysis---timeline reconstruction, root cause determination, and correlating artifacts across hosts and logs---rather than performing immediate containment. An evidence manager is primarily responsible for maintaining evidence integrity, chain of custody, storage, labeling, and access control, not operational containment. An expert witness provides formal testimony and interpretation in legal or disciplinary proceedings and is not usually involved in live containment actions. Since Jennifer both gathered evidence and then isolated the system to stop spread, the role most consistent with documented DFIR responsibilities is Incident responder (A).