ECSS Sample Questions & Answers

This statement is false. The 'Weaponization' phase involves coupling an exploit with a payload (e.g., a remote access trojan) to create a deliverable malicious tool. The act of scanning the target's network to find vulnerabilities occurs during the 'Reconnaissance' and 'Scanning' phases, which precede weaponization.

Windows automatically creates LNK (shortcut) files and Jump Lists to track recently opened files and applications for user convenience. These artifacts persist even after files are deleted and history is cleared, providing a valuable timeline of user activity. The Security event log tracks security-related events like logons, the SAM hive stores user password hashes, and the System32 directory contains core system files, not user activity logs.

Transport Layer Security (TLS), the protocol that underpins HTTPS, is designed specifically for this purpose. It encrypts data in transit (confidentiality), uses message authentication codes to prevent tampering (integrity), and uses digital certificates to authenticate the server to the client. SSH is for secure remote administration, FTP is insecure for file transfers, and IPsec operates at the network layer, typically for VPNs.

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

To decrypt a TLS session captured in a PCAP file (assuming a cipher suite like RSA was used for key exchange), the investigator needs the server's private key. The private key is used to decrypt the pre-master secret exchanged during the TLS handshake, which then allows the investigator's tool (like Wireshark) to derive the symmetric session keys and decrypt the application data. The public key is publicly available and cannot be used for decryption. The session key itself is what needs to be derived.

Mobile Application Management (MAM) with containerization is the ideal solution for BYOD scenarios. It creates a secure, encrypted container on the device that isolates corporate apps and data. This allows the company to enforce policies (like copy-paste restrictions) and perform a selective wipe of only the container without affecting the user's personal data. Full MDM gives control over the entire device, which is often too intrusive for BYOD. Geofencing restricts functionality by location, and a VPN only secures the connection.

Hashcat is a world-renowned password recovery tool that is highly optimized for GPU-based cracking, making it significantly faster than CPU-based tools for this task. While John the Ripper can crack passwords (and has some GPU support), Hashcat is generally considered the superior tool for leveraging GPU power. Nmap is a network scanner, and Metasploit is an exploitation framework.

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. Hiding documents inside image files is a classic example of steganography. Encryption scrambles data but doesn't hide its existence. Data wiping securely erases data, and trail obfuscation involves altering logs to hide activities.

The Online Certificate Status Protocol (OCSP) is designed to provide real-time revocation status for a single certificate without requiring the client to download a potentially large list. The browser sends a query to an OCSP responder and gets a direct, signed response of 'good', 'revoked', or 'unknown'. A CRL is a list of all revoked certificates that must be downloaded and parsed, which can be slow and is not real-time (it's only as current as its last publication). OCSP Stapling is an optimization of OCSP but OCSP is the underlying protocol. Key escrow relates to key recovery, not revocation status.

This technique is known as password spraying. It is a 'low-and-slow' method where an attacker tries one or a few common passwords against many different accounts. This helps to avoid account lockouts that would typically occur if many incorrect passwords were tried against a single account (a standard brute-force or dictionary attack).