Eccouncil Exam ECSS Topic 4 Question 64 Discussion

Actual exam question for Eccouncil's ECSS exam

Question #: 64
Topic #: 4

[All ECSS Questions]

Bob, a forensic investigator, was instructed to review a Windows machine and identify any anonymous activities performed using it. In this process. Bob used the command ''netstat -ano" to view all the active connections in the system and determined that the connections established by the Tor browser were closed. Which of the following states of the connections established by Tor indicates that the Tor browser is closed?

AESTABLISHED

BCLOSE WAIT

CTIMEWAIT

DLISTENING

Show Suggested Answer

Suggested Answer: C

by Ma at Feb 08, 2023, 07:46 AM

Limited Time Offer

25%

Off

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

King

2 days ago

Haha, Tor browser, eh? Bet those guys are having a field day with this one. I'm gonna go with C, TIMEWAIT, just to mess with 'em!

upvoted 0 times

...

Sharee

5 days ago

Ooh, this is a good one. I'm gonna go with D, LISTENING. Wait, no, that doesn't make sense. Uh, let me think about this again... *scratches head*

upvoted 0 times

...

Lisha

6 days ago

Ah, the old 'netstat -ano' trick. Classic forensics move. I reckon the answer's C, TIMEWAIT. Gotta love those networking protocols, am I right?

upvoted 0 times

...

Hermila

8 days ago

Hmm, let's see. If the Tor connections are closed, that means they're probably in the CLOSE_WAIT state, right? I'm going with B on this one.

upvoted 0 times

...

Jacquline

11 days ago

I agree with Gussie, A) ESTABLISHED makes more sense in this context.

upvoted 0 times

...

Graciela

17 days ago

Well, this is a tricky one. Gotta be on the lookout for those sneaky Tor connections, huh? I'm thinking C, TIMEWAIT, seems like the most logical choice here.

upvoted 0 times

Nettie

4 days ago

A) ESTABLISHED

upvoted 0 times

...

Gussie

19 days ago

I disagree, I believe the correct answer is A) ESTABLISHED because that indicates the connection is active.

upvoted 0 times

...

Isreal

26 days ago

I think the answer is B) CLOSE WAIT because the connections were closed.

upvoted 0 times

...