Eccouncil Exam ECSS Topic 4 Question 64 Discussion

Actual exam question for Eccouncil's ECSS exam

Question #: 64
Topic #: 4

[All ECSS Questions]

Bob, a forensic investigator, was instructed to review a Windows machine and identify any anonymous activities performed using it. In this process. Bob used the command ''netstat -ano" to view all the active connections in the system and determined that the connections established by the Tor browser were closed. Which of the following states of the connections established by Tor indicates that the Tor browser is closed?

AESTABLISHED

BCLOSE WAIT

CTIMEWAIT

DLISTENING

Show Suggested Answer

Suggested Answer: C

by Ma at Feb 08, 2023, 07:46 AM

Limited Time Offer

25%

Off

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

King

2 months ago

Haha, Tor browser, eh? Bet those guys are having a field day with this one. I'm gonna go with C, TIMEWAIT, just to mess with 'em!

upvoted 0 times

Elouise

3 days ago

C) TIMEWAIT

upvoted 0 times

...

Marisha

5 days ago

B) CLOSE WAIT

upvoted 0 times

...

Paulina

7 days ago

A) ESTABLISHED

upvoted 0 times

...

Lanie

11 days ago

D) LISTENING

upvoted 0 times

...

Latia

28 days ago

C) TIMEWAIT

upvoted 0 times

...

Lai

1 months ago

B) CLOSE WAIT

upvoted 0 times

...

Argelia

1 months ago

A) ESTABLISHED

upvoted 0 times

...

Leatha

1 months ago

C) TIMEWAIT

upvoted 0 times

...

Benedict

1 months ago

B) CLOSE WAIT

upvoted 0 times

...

Felix

1 months ago

A) ESTABLISHED

upvoted 0 times

...

Sharee

2 months ago

Ooh, this is a good one. I'm gonna go with D, LISTENING. Wait, no, that doesn't make sense. Uh, let me think about this again... *scratches head*

upvoted 0 times

...

Lisha

2 months ago

Ah, the old 'netstat -ano' trick. Classic forensics move. I reckon the answer's C, TIMEWAIT. Gotta love those networking protocols, am I right?

upvoted 0 times

...

Hermila

2 months ago

Hmm, let's see. If the Tor connections are closed, that means they're probably in the CLOSE_WAIT state, right? I'm going with B on this one.

upvoted 0 times

...

Jacquline

2 months ago

I agree with Gussie, A) ESTABLISHED makes more sense in this context.

upvoted 0 times

...

Graciela

2 months ago

Well, this is a tricky one. Gotta be on the lookout for those sneaky Tor connections, huh? I'm thinking C, TIMEWAIT, seems like the most logical choice here.

upvoted 0 times