Eccouncil 112-57 Exam Dumps

The scenario describes a victim being redirected from a legitimate banking URL to a fraudulent website without intending to visit it, after malware is installed on the system. This behavior is characteristic of pharming, an attack in which an adversary causes redirection to a malicious destination even when the user types the correct address or clicks a legitimate bookmark. In digital forensics references, pharming is commonly achieved by manipulating name resolution or routing mechanisms, such as altering the local hosts file, changing DNS server settings, poisoning DNS responses, modifying browser proxy settings, or installing malware that intercepts and rewrites web requests. The key forensic indicator is that the victim's request for the real domain is transparently diverted to attacker-controlled infrastructure, where credentials are harvested through a convincing spoofed login page.

The other options do not match the redirection-and-fake-site mechanism. Tailgating is physical access abuse (following someone into a secure area). Dumpster diving involves retrieving sensitive information from discarded materials. Shoulder surfing is observing credentials by watching the victim type. Because the essential action here is malicious redirection to a fake site to steal credentials, the correct answer is Pharming (A).

The Subject field is the primary email header element used to communicate the purpose and urgency of a message at a glance. Digital forensics training emphasizes that email messages consist of headers (routing and descriptive metadata) and a body (content). Among user-visible header fields, the Subject line is specifically intended to summarize what the email is about, helping recipients prioritize and correctly interpret the message without opening it. In the scenario, John routinely receives casual emails from Alice (often with pictures). When Alice sent a project-related email ''without specifying the actual purpose,'' John treated it like routine mail and overlooked its significance. A clear, descriptive subject such as ''Final Year Project Seminar -- Attendance Required'' would have flagged the message as time-sensitive and different from her usual emails, reducing the chance it would be missed.

The other options do not serve this purpose. Date is automatically assigned and mainly supports ordering and timeline reconstruction rather than highlighting importance. Cc and Bcc control who receives copies and can affect visibility or secrecy, but they do not summarize intent for the recipient. Therefore, the field best suited to highlight importance is Subject (A).

In forensic readiness planning, the goal is to ensure that when an incident occurs, the organization can collect, preserve, and present digital evidence in a manner that remains reliable, repeatable, and legally defensible. A key requirement for courtroom acceptance is clear documentation---often referred to as proper documentation and chain-of-custody support---showing what actions were taken, by whom, when, using which tools, and under what conditions. Creating a defined process for documenting procedures ensures investigators consistently record acquisition steps, handling methods, hashing/verification results, storage locations, access history, and any changes in evidence possession. This documentation becomes a ''backup'' in the sense that it preserves institutional memory of the investigation steps, allowing future reviewers (auditors, opposing experts, courts) to reconstruct and validate what occurred even long after the incident.

While identifying potential evidence (B) and determining evidence sources (C) are important readiness tasks, they do not themselves create the structured record needed to defend evidence integrity. Keeping an incident response team ready (D) supports operational response, but does not directly ensure admissibility. Therefore, the step that provides future reference and supports court presentation is Creating a process for documenting the procedure (A).

In the TCP/IP model, the Transport layer is responsible for end-to-end communication between peer entities on the source and destination systems. ''Peer entities'' here refers to the corresponding transport components (and the applications that use them) on two different hosts communicating across a network. This layer forms the practical ''backbone'' of host-to-host data flow because it provides the mechanisms that allow data to be delivered from one endpoint process to another endpoint process reliably or efficiently, depending on the protocol used.

The Transport layer includes protocols such as TCP and UDP. TCP supports connection-oriented communication with sequencing, acknowledgments, retransmissions, and flow control---features that are fundamental when reconstructing sessions during network forensic investigations (e.g., rebuilding a file transfer or a web session). UDP provides connectionless delivery used by many services where speed is preferred over guaranteed delivery, which is also significant in investigations of DNS, streaming, or certain malware communications.

By contrast, the Internet layer focuses on logical addressing and routing (IP), the Network access layer handles local delivery on the physical/link network, and the Application layer provides user-facing protocols. Therefore, the layer enabling peer communication between endpoints is the Transport layer (C).

On macOS, the Basic Security Module (BSM) provides the system's audit framework, which records security-relevant activity such as file access, process execution, authentication events, privilege changes, and other system calls. A key forensic characteristic of BSM auditing is that events are written as binary audit records composed of ''tokens.'' Each token represents a structured piece of the event (for example: subject/user identity, process ID, command arguments, path, return value, timestamps), and tokens are assembled into complete audit records. Because these audit logs are binary and tokenized, they are compact, consistent, and designed for reliable parsing and evidentiary reconstruction---important when building timelines of file-related actions and attributing them to specific users and processes.

The other options do not match the ''binary token'' description. Command-line inputs may be stored in shell history files but are plain text and not tokenized binary audit records. User account artifacts (e.g., directory services, plist files) describe identities and settings, not tokenized event logs. Kexts (kernel extensions) are drivers/modules; while they can affect system behavior, they are not the macOS component that stores file/event records in a binary token format. Therefore, the correct answer is Basic Security Module (C).