Sitemap- victorylearner.com
-
-
-
-
- ACPO Principles of Digital Evidence: The Association of Chief Police Officers (ACPO) Principles of Digital EvidenceThis guide is primarily written for the guidance of UK law enforcement personnel who may deal with digital evidence. This will includ
- Daubert standard in digital forensics: The Daubert Standard is a framework for judges to evaluate the relevance and reliability of expert witness testimony. The standard was established in 1993 by the Supreme Court case Daubert v. Merrell Dow Pha
- Bill of Rights (U.S. Constitution) and Later Amendments: The Bill of Rights is the first 10 Amendments to the Constitution. It spells out Americans‘ rights in relation to their government. It guarantees civil rights and liberties to the in
- HIPAA Law: The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that requires the creation of national standards to protect patient health information. The Health Insurance Portability and Accountability Act of 1996 (HIP
- Scientific Working Group on Digital Evidence (SWGDE): The Scientific Working Group on Digital Evidence (SWGDE) brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation a
- NIST: The National Institute of Standards and Technology (NIST) was founded in 1901 and is now part of the U.S. Department of Commerce. NIST is one of the nation‘s oldest physical science laboratories. The NIST Cybersecurity Framework helps
- Title 18 of the United States Code (18 USC): Title 18 of the United States Code (18 USC) is the federal government‘s primary criminal code. It covers federal crimes and criminal procedure.Here are some parts of 18 USC:Part I: Crimes, sections 1
- Hearsay rule: According to the U.S. Courts, hearsay is a statement that is offered in evidence to prove the truth of the matter, other than one made by the declarant while testifying at the trial or hearing. Rule 802 is the rule against hearsay i
- Locard‘s exchange principle: Locard‘s exchange principle is a forensic science principle that states that when two objects come into contact, they exchange microscopic material. This principle also states that the perpetrator of a crime w
- The Frye standard: The Frye standard is a judicial test used to determine the admissibility of scientific evidence in some U.S. state courts. It‘s also known as the Frye test or general acceptance test. The long-recognized rule of Frye is
- Gramm-Leach-Bliley Act (GLBA): The Gramm-Leach-Bliley Act requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-s
- Rules 1002-1008 of the US Rules of Evidence: Rule 1001: Rule 1001 defines the types of evidence (writing, recordings, and photographs) covered by the requirements, and defines what qualifies as an original or duplicate that is admissible under Rul
- Sarbanes-Oxley Act : The Sarbanes-Oxley Act of 2002 is a law the U.S. Congress passed on July 30 of that year to help protect investors from fraudulent financial reporting by corporations. 1 Also known as the SOX Act of 2002, it mandated strict refor
- Federal Information Security Modernization Act (FISMA) : The Federal Information Security Modernization Act (FISMA) is a US federal law that was signed in 2002 and updated in 2014. It defines a framework to protect government information, operations,
- CAN-SPAM Act: The CAN-SPAM Act, or Controlling the Assault of Non-Solicited Pornography and Marketing Act, was passed by Congress in 2003 and signed into law by President George W. Bush in 2003. The CAN-SPAM Act is a US law that governs commercial em
- Types of examinations in US court: Here are some types of examinations in US court:Direct examination: The presentation of evidence begins with the calling of witnesses by the attorney. The attorney does the initial questioning of the witness and thi
- California SB 1386: California Senate Bill 1386, or SB 1386, is a law that requires businesses, state agencies, or other entities that own or license computerized data to disclose any security breach to California residents. The law went into effect
- List of Federal Rules of Evidence: These are the Federal Rules of Evidence, as amended to December 1, 2023. ARTICLE I. GENERAL PROVISIONS Rule 101. Scope; DefinitionsRule 102. PurposeRule 103. Rulings on EvidenceRule 10
- Different types of evidence: Evidence: Something that tends to establish or disprove a fact. Evidence can include documents, testimony, and other objects. Evidence is an important factor in court cases and often helps a jury decide the verdi
- Rules of Evidence: The submission of evidence in a legal proceeding, particularly in cybercrime cases, can pose major challenges. Specific knowledge is required to collect, preserve, and transport the evidence because the evidence obtained from
- Article I of the Federal Rules of Evidence: Article I of the Federal Rules of Evidence provides the general provisions and framework for the rest of the rules . It includes fundamental definitions, principles, and objectives of the rules of evid
- Incident Response and its Process Flow: Incident response is a process of responding to incidents that may have occurred due to security breach in the system or network. The goal is to handle the incidents in a way that minimizes the damage a
- SOC Workflow: Security Operations Center (SOC) is a centralized unit that continuously monitors and analyzes ongoing activities on an organization’s information systems such as networks, servers, endpoints, databases, applications, websites, e
- SOC Workflow: Security Operations Center (SOC) is a centralized unit that continuously monitors and analyzes ongoing activities on an organization’s information systems such as networks, servers, endpoints, databases, applications, websites,
- Roles and Responsibilities of a Forensics Investigator : A forensic investigator performs the following tasks: · Determines the extent of any damage done during the crime · Recovers data of investigative value from computin
- Electronic Communications Privacy Act: The Electronic Communications Privacy Act of 1986 (ECPA) was enacted by the United States Congress to extend restrictions on government wire taps of telephone calls to include transmissions of electronic data b
- General Data Protection Regulation (GDPR): The EU general data protection regulation (GDPR) is the strongest privacy and security law in the world. This regulation updated and modernised the principles of the 1995 data protection directive. It was a
- Data Protection Act 2018: The Data Protection Act, enacted in 2018, makes provisions for the regulation of the processing of information relating to individuals, in connection with the Information Commissioner’s functions under certain regulat
- Payment Card Industry Data Security Standard (PCI DSS): Payment Card Industry Data Security Standard is an information security standard used to handle credit cards of major card brands. The standard is administered by the Payment Card Industry
- Computer Forensics and Legal Compliance : Legal compliance in computer forensics ensures that any evidence that is collected and analyzed is admissible in a court of law Compliance with certain regulations and standards plays an important part in
- National Information Infrastructure Protection Act of 1996: The National Information Infrastructure Protection Act of 1996 revises federal criminal code provisions regarding fraud and related activity in connection with computers. Sets penal
-
- When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP
- In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?: rules of evidence, law of probability, chain of custody, policy of separation
- Before you are called to testify as an expert, what must an attorney do first?: engage in damage control, prove that the tools you used to conduct your examination are perfect, read your curriculum vitae to the jury, qualify you as an expert witness
- Jonathan is an investigator, but he is not the first one on the scene. He wants to show the path of evidence collected from the scene to the forensic lab. What should he use?: criminal report, exhibit numbering, Daubert standard report, chain of cu
- Which of the following is true regarding digital evidence?: the investigator does not need a search warrant if they deem the investigation necessary, investigators should not worry about the integrity of evidence, a duplicate copy should be made for
- Which ISO standard enables laboratories to demonstrate that they comply with quality assurance and provide valid results?: ISO/IEC 17025, ISO/IEC 18025, ISO/IEC 16025, ISO/IEC 19025
- "In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the
- Steve thought it would be funny to make some changes on Tom‘s computer at their office. Steve went into the Microsoft Windows registry and changed the keyboard mapping configuration on Tom‘s computer. Now Tom is unable to log into his com
- Which standard is used during a judicial trial to assess whether an expert witness‘s scientific testimony is based on scientifically valid reasoning that can adequately be applied (admissible) to the facts under consideration?: Joiner Standard,
- You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?: To control the room temperat
- Fred, a cybercrime investigator for the FBI, finished storing a solid-state drive in a static resistant bag and filled out the chain of custody form. Two days later, John grabbed the solid-state drive and created a clone of it (with write blockers en
- Madison is on trial for allegedly breaking into her university‘s internal network. The police raided her dorm room and seized all of her computer equipment. Madison‘s lawyer is trying to convince the judge that the seizure was unfounded a
- Identify the term that refers to individuals who, by virtue of their knowledge and expertise, express an independent opinion on a matter related to a case based on the information that is provided: Defense witness, Forensic examiner, Evidence examine
- This is a statement, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted. Which among the following is suitable for the above statement?: Hearsay rule, Testimony
- Debbie has obtained a warrant to search a known pedophile‘s house. Debbie went to the house and executed the search warrant to seize digital devices that have been recorded as being used or downloading illicit images. She seized all digital de
- Jacob, a cybercrime investigator, joined a forensics team to participate in a criminal case involving digital evidence. After the investigator collected all the evidence and presents it to the court, the judge dropped the case and the defense attorne
- Adam is thinking of establishing a hospital in the US and approaches John, a software developer to build a site and host it for him on one of the servers, which would be used to store patient health records. He has learned from his legal advisors tha
- Why would a company issue a dongle with the software they sell?: To provide source code protection, To provide wireless functionality with the software, To provide copyright protection, To ensure that keyloggers cannot be used
- “In order to ensure that the digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effec
- Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technica
- A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence o
- Depending upon the jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers?: 18 USC §1029, 18 USC §1030, 18 USC §1361, 18 USC §1371
- Which among the following acts has been passed by the U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?: Health Insurance Probability and Accountability act of 1996, Gramm-Leach-Bliley act, F
- Tony, an email marketing professional, is accused of enticing people to reveal their personal information such as banking credentials, credit card details, bank balance, etc., via phishing emails. What type of investigation will apply to Tony‘s
- To which phase of the computer forensics investigation process does “planning and budgeting of a forensics lab” belong?: Pre-investigation phase, Reporting phase, Post-investigation phase, Investigation phase
- What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture?: Copyright, Design patent, Trademark, Utility patent
- Jim’s company regularly performs backups of their critical servers. But the company can’t afford to send backup tapes to an off-site vendor for long term storage and archiving. Instead Jim’s company keeps the backup tapes in a safe in the offic
- This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.: Telemarketing act, European Anti-Spam act, The
- Rule 1002 of Federal Rules of Evidence (US) talks about ______: Admissibility of other evidence of contents, Admissibility of duplicates, Admissibility of original, Requirement of original
- "No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?: Locard’s exchang
- Which Federal Rule of Evidence speaks about the Hearsay exception where the availability of the declarant is immaterial and certain characteristics of the declarant such as present sense impression, excited utterance, and recorded recollection are al
- What does Locard‘s Exchange Principle state?: Any information of probative value that is either stored or transmitted in a digital form, Digital evidence must have some characteristics to be disclosed in the court of law, Anyone or anything, en
- SO/IEC 17025 is an accreditation for which of the following: Forensics lab licensing, Encryption, Chain of custody, Encryption
- Which "Standards and Criteria" under SWGDE states that "the agency must use hardware and software that are appropriate and effective for the seizure or examination procedure"?: Standards and Criteria 1.6 Standards, Standards and C
- Which forensic investigation methodology believes that criminals commit crimes solely to benefit their criminal enterprises?: Scientific Working Group on Digital Evidence, Daubert Standard, Enterprise Theory of Investigation, Fyre Standard
- Which among the following U.S. laws requires financial institutions companies that offer consumers financial products or services such as loans, financial or investment advice, or insurance to protect their customers information against security thre
- Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?: Witness Examination, Indirect Examination, Cross Examination, Direct Examination
- Which US law does the interstate or international transportation and receiving of child pornography fall under?: 18 U.S.C. 146A, 18 U.S.C. 466A, 18 U.S.C. 2252, 18 U.S.C. 252
- Which Federal rule of evidence states that a duplicate is admissible to the same extent as an original unless (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicat
- Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?: 18 U.S.C. 1029, 18 U.S.C. 1362, 18 U.S.2511, 18 U.S.C. 2703
- Which among the following search warrants allows the first responder to search and seize the victim‘s computer components such as hardware, software, storage devices, and documentation?: John Doe Search Warrant, Citizen Informant Search Warrant
- Which of the following is a federal law enacted in the US to control the ways that financial institutions deal with the private information of individuals?: SOX, GLBA, HIPAA 1996, PCI DSS
- Who established “methodology for testing computer forensic software tools by the development of general tool specifications, test procedures, test criteria, test sets, and test hardware.”: NCIS, NIST, EC-Council, SWGDE
- Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?: GLBA, SOX, FISMA, HIPAA
- Which of the following laws/rules of the USA deal with fraud and related activity in connection with computers?: 18 USC §1029, Rule 1003, 18 USC §1030, Rule 1002
- You have used a newly released forensic investigation tool, which doesn‘t meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case?: The tool hasn‘t been tested by the
- When obtaining a warrant, it is important to:: particularly describe the place to be searched and particularly describe the items to be seized, generally describe the place to be searched and particularly describe the items to be seized, generally de
- Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses‘ testimony during federal legal proceedings?: SWGDE & SWGIT, IOCE, Frye, Daubert
- Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?: Verbal Formal Report, Written Formal Report, Verbal Informal Report, Written Informal Report
- Which of the following examinations refers to the process of the witness being questioned by the attorney who called the latter to the stand?: Witness Examination, Indirect Examination, Direct Examination, Cross Examination
- A section of your forensics lab houses several electrical and electronic equipment. Which type of fire extinguisher you must install in this area to contain any fire incident?: Class B, Class D, Class C, Class A
- The objective of this act was to protect consumers‘ personal financial information held by financial institutions and their service providers.?: Gramm-Leach-Bliley Act, Sarbanes-Oxley 2002, California SB 1386, HIPAA
- Identify the NIST Publication that provides the required guidelines to help organizations to sanitize data to preserve the confidentiality of the information?: NIST SP 800-88, NIST SP 800-89, NIST SP 800-90, NIST SP 800-87
- Gary, a computer technician, is facing allegations of abusing children online by befriending them and sending them illicit adult images from his office computer. What type of investigation does this case require?: Administrative Investigation, Crimin
- Law enforcement officers are conducting a legal search for which a valid warrant was obtained. While conducting the search, officers observe an item of evidence for an unrelated crime that was not included in the warrant. The item was clearly visible
- What does the Rule 101 of Federal Rules of Evidence states?: Purpose of the Rules, Limited Admissibility of the Evidence, Rulings on Evidence, Scope of the Rules, where they can be applied
- Two organizations, A and B, operating in the field of telecommunications, came into an agreement that they will not enter other‘s territory. But, a few years after the agreement, organization B began to offer services into the A‘s territo
- What must an attorney do first before you are called to testify as an expert?: Prove that the tools you used to conduct your examination are perfect, Engage in damage control, Read your curriculum vitae to the jury, Qualify you as an expert witness
- Which of these documents will help an investigator to determine the details of personnel responsible for evidence handling?: Search Warrant, Chain of Custody, Consent Search Form, Case Assessment Form
- You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after hehas the book published?: 70 years, The life of the author, The life of the author plus 70 years, Copyrights last forever
- In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.: Network Forensics, Data Recovery, Disaster Recovery, Compute
- Which of the following is NOT a physical evidence?: Removable media, Publications, Cables, Image file on a hard disk
- ______allows a forensic investigator to identify the missing links during investigation.: Evidence preservation, Chain of custody, Evidence reconstruction, Exhibit numbering
- A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard l
- Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?: Point-to-point, End-to-end, Thorough, Complete event analysis
- Paul‘s company is in the process of undergoing a complete security audit including logical and physical security testing. After all logical tests were performed; it is now time for the physical round to begin. None of the employees are made awa
- An expert witness is a ____________ who is normally appointed by a party to assist the formulation and preparation of a party‘s claim or defense?: Expert law graduate appointed by attorney, Subject matter specialist, Expert in criminal investig
- Which among the following search warrants allows the first responder to get the victim‘s computer information such as service records, billing records, and subscriber information from the service provider?: Electronic Storage Device Search Warr
- During the trial, an investigator observes that one of the principal witnesses is severely ill and cannot be present for the hearing. He decides to record the evidence and present it to the court. Under which rule should he present such evidence?: Li
- Which U.S. law sets the rules for sending emails for commercial purposes, establishes the minimum requirements for commercial messaging, gives the recipients of emails the right to ask the senders to stop emailing them, and spells out the penalties i
- Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?: bench warrant, wire tap, subpoena, search warrant
- Which rule requires an original recording to be provided to prove the content of a recording?: 1004, 1005, 1002, 1003
- Which U.S. Federal law requires financial institutions that offer consumers financial products or services to protect their customers‘ private information?: Gramm-Leach-Bliley Act (GLBA), Payment Card Industry Data Security Standard (PCI DSS),
- How often must a company keep log files for them to be admissible in a court of law?: All log files are admissible in court no matter their frequency, Weekly, Monthly, Continuously
- Which principle states that "anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave"?: Evidence Theory of Investigation, Locard‘s Evidence Principle
- In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation. Wha
- You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm‘s employees. You meet with the owner of the firm and discover that the company has ne
- An Expert witness give an opinion if:: The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors, To define the issues of the case for determination by the finder of fact, T
- The police believe that Melvin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educatio
- A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves t
- James is dealing with a case regarding a cybercrime that has taken place in Arizona, USA. James needs to lawfully seize the evidence from an electronic device without affecting the user‘s anonymity. Which of the following law should he comply w
- Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or inten
- Which of the following should a computer forensics lab used for investigations have?: isolation, restricted access, open access, an entry log
- Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the ca
- The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.: Locard Exchange Principle, lark Standard, Kelly Policy, Silver-Platter Doctrine
- You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Se
- Which of the following tasks DOES NOT come under the investigation phase of a cybercrime forensics investigation case?: Data collection, Secure the evidence, First response, Data analysis
- To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer f
- With Regard to using an Antivirus scanner during a computer forensics investigation, You should:: Scan the suspect hard drive before beginning an investigation, Never run a scan on your forensics workstation because it could change your systems confi
- This organization maintains a database of hash signatures for known software.: International Standards Organization, Institute of Electrical and Electronics Engineers, National Software Reference Library, American National standards Institute
- What must be obtained before an investigation is carried out at a location?: Search warrant, Subpoena, Habeas corpus, Modus operandi
- While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?: Technical m
- As a CHFI professional, which of the following is the most important to your professional reputation?: Your Certifications, The correct, successful management of each and every case, The fee that you charge, The friendship of local law enforcement of
- Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.: Statement of personal or family history, Prior statement by witness, Statement against interest, Statement under belief of impending death
- What should you do when approached by a reporter about a case that you are working on or have worked on?: Refer the reporter to the attorney that retained you, Say, "no comment", Answer all the reporter‘s questions as completely as po
- During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this eviden
- Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?: 18 U.S.C. 1029 Possession of Access Devices, 18 U.S.C. 1030 Fraud and related activity in connection with computers, 18 U.S.1343 Fraud by wi
- Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management d
- Amelia has got an email from a well-reputed company stating in the subject line that she has won a prize money, whereas the email body says that she has to pay a certain amount for being eligible for the contest. Which of the following acts does the
- While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?: Keep the information of file for later review, Destroy the evidence, Bring the information
- The use of warning banners helps a company avoid litigation by overcoming an employee assumed __________________________. When connecting to the company‘s intranet, network or Virtual Private Network(VPN) and will allow the company‘s inve
- It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?: by law, three, quite a few, only one, at least two
- Which of the following standard represents a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases?: SWGDE & SWGIT, Daubert, Frye, IOCE
- For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?: Relevant circumstances surrounding the collection, General description of the evidence, Exact location the evidence was collected from,
- If you discover a criminal act while investigating a corporate policy abuse, it becomes a publicsector investigation and should be referred to law enforcement?: true, false, Dummy,
- You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name f
- You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal cou
- Steven has been given the task of designing a computer forensics lab for the company he works for. He has found documentation on all aspects of how to design a lab except the number of exits needed. How many exits should Steven include in his design
- This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.: Civil litigation testimony, Expert testimony, Victim advocate testimony, Technical testimony
- When cataloging digital evidence, the primary goal is to: Make bit-stream images of all hard drives, Preserve evidence integrity, Not remove the evidence from the scene, Not allow the computer to be turned off
- When is it appropriate to use computer forensics?: If copyright and intellectual property theft/misuse has occurred, If employees do not care for their boss management techniques, If sales drop off for no apparent reason for an extended period of tim
- When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?: One, Two, Three, Four
- ____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence: Network Forensics, Computer Forensics, Incident Response, Event Reaction
- Corporate investigations are typically easier than public investigations because:: the users have standard corporate equipment and software, the investigator does not have to get a warrant, the investigator has to get a warrant, the users can load wh
- You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents
- Jason is the security administrator of ACMA metal Corporation. One day he notices the company‘s Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in mi
- During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?: Yes, and all evidence can be turned over to the police, Yes, but only if you turn the evidence o
- As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing. What document describes the specifics of the testing, the associated violations, and essentially protects bot
- Which among the following laws emphasizes the need for each Federal agency to develop, document, and implement an organization-wide program to provide information security for the information systems that support its operations and assets?: FISMA, HI
- In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?: evidence must be handled in the same way regardless of the type of case, evidence procedures are not imp
- When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.: Hard Drive Failure, Scope Creep,
- _______ are brought for violation of contracts and lawsuits, where a guilty outcome generally results in monetary damages to the plaintiff.: Criminal Cases, Civil Cases, Administrative Cases,
- Which of the following is not part of First Response by Laboratory Forensics Staff ?: Planning the Search and Seizure, Transporting Electronic Evidence, Documenting the Electronic Crime Scene, Make Forensic copy of Digital Evidences
- Cases which are generally brought by law enforcement agencies in response to a suspected violation of law, where a guilty outcome may result in monetary damages, imprisonment, or both.: Civil, Criminal, Administrative,
- ________ refers to an organization’s ability to optimally use digital evidence in a limited period of time and with minimal investigation costs.: Forensic readiness, First Response Team, Cyber security Wing, Policy that determines the pathway
- Violation of organization’s policies, rules, or protocols will come under which type of investigation?: Criminal, Civil, Administrative,
- ETI investigation can be used to show that individuals commit crimes in furtherance of the criminal enterprise. What does ETI stands for?: Enterprise Theory of Investigation, Ethical Trading Initiative, Ethical Theory of Investigation, Enterprise Tec
- It is essential to understand the laws that apply to the investigation including the internal organization policies before starting the investigation process. Identify Rule 901 of forensic laws:: Prohibits malicious mischief, Relevant evidence genera
- Rules of evidence govern whether, when, how, and for what purpose proof of a case may be placed before a trier of fact for consideration. In Federal Rules of Evidence, which rule if for Admissibility of Duplicates?: Rule 1002, Rule 1004, Rule 1003, R
- Scientific Working Group on Digital Evidence (SWGDE) has defined standards and criteria for the Exchange of Digital Evidence. Which of this SWGDE standards and criteria states that “Procedures used must be generally accepted in the field or support
-
-
-
- Stages of First Response by Laboratory Forensics Staff : The first response by laboratory forensic staff involves six stages. 1. Documenting the Electronic Crime Scene Documentation of the electronic crime sc
- First Response: The term “first responder” refers to the person who arrives at the crime scene first to assess it and alert the management and incidence response teams. The first responder is responsible for protecting and securing the
- Understand the Investigation Phase: The investigation phase includes various stages and processes that need careful and systematic execution to obtain better results. Each step in this phase is equally crucial for the acceptance of the evidence
- Operating System Shutdown Procedure, if System is in "ON" state: Investigators have to make a vital decision at the time of shutting down the computer system because it is important to shut down the operating system in a proper manne
- Chain of Custody: · Chain of custody is a legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory · The chain
- Exhibit Numbering: All the collected evidence should be labeled and marked (numbered) properly as exhibits, using a pre-agreed format. Example: aaa/ddmmyy/nnnn/zz Where: · aaa are the initials of the forensic analyst or law enf
- Evidence Reconstruction: Once the evidence related to the case is analyzed, investigators can use it to reconstruct the crime and identify the missing links. There are three ways, in which investigators can reconstruct a crime: ▪ Temp
-
- A first responder secures the scene perimeter. This is:: Post-investigation phase, Investigation phase, Securing the scene phase, Pre-investigation phase
- During an investigation, the first responders stored mobile devices in specific containers to provide network isolation. All the following are examples of such pieces of equipment, except for:: RF shield box, VirtualBox, Wireless StrongHold bag, Fara
- A suspect is accused of violating the acceptable use of computing resources as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared
- Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?: Protect the device against external communication, Remove the battery o
- After a successful data exfiltration attack against your organization, you are conducting an internal investigation and suspect a significant portion of evidence exists on an end-user‘s personal laptop. You want to be sure not to tip-off the la
- You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?
- Examination of a computer by a technically unauthorized person will almost always result in: Rendering any evidence found inadmissible in a court of law, Completely accurate results of the examination, Rendering any evidence found admissible in a cou
- You are a digital forensic investigator at a large pharmaceutical company. You are responding to a security incident where you have found a computer on the scene, and you believe the computer contains evidence that is valuable to the case. The comput
- Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?: Record the system sta
- An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the
- The efforts to obtain information before a trail by demanding documents, depositions, questioned and answers written under oath, written requests for admissions of fact and examination of the scene is a description of what legal term?: Detection, Hea
- Who is responsible for the following tasks? 1. Secure the scene and ensure that is maintained in a secure state until the Forensic Team advises 2. Make notes about the scene that will eventually be handed over to the Forensic Team: Non-forensics staf
- In forensics, _________ are used to view stored or deleted data from both files and disk sectors: Hex editors, Hash algorithms, SIEM tools, Host interfaces
- Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling it, the
- Which of the following is NOT a part of pre-investigation phase?: Building forensics workstation, Gathering information about the incident, Gathering evidence data, Creating an investigation team
- Which of the following statements pertaining to First Response is true?: First Response is neither a part of pre-investigation phase nor a part of investigation phase. It only involves attending to a crime scene first and taking measures that assist
- What is the first step taken in an investigation for laboratory forensic staff members?: Packaging the electronic evidence, Securing and evaluating the electronic crime scene, Conducting preliminary interviews, Transporting the electronic evidence
- An executive had leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?: Postmortem Analysis, Real-Time Analysis, Packet Analysis, Malware Analysis
- If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?: Keep the device powered on, Turn off the device immediately, Remove the battery immediately, Remove any memory cards immediately
- Which of the following is a responsibility of the first responder?: Determine the severity of the incident, Collect as much information about the incident as possible, Share the collected information to determine the root cause, Document the findings
- You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence cust
- Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers hideout. Pau
- When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?: All virtual memory will be deleted, The wrong partition may be set to active, This action can corrupt the disk, The computer will be set in a con
- What method of copying should always be performed first before carrying out an investigation?: Parity-bit copy, Bit-stream copy, MS-DOS disc copy, System level copy
- Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?: Speculation or opinion as to the cause of the incident, Purpose of the report, Author of the report, Incident summa
- Which of the following statements is incorrect when preserving digital evidence?: Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals, Remove the plug from the power router or modem, Verify if
- Which one of the following is not a first response procedure?: Take photos, Fill forms, Preserve volatile data, Crack passwords
- Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?
- What stage of the incident handling process involves reporting events?: Containment, Follow-up, Identification, Recovery
- What type of analysis helps to identify the time and sequence of events in an investigation?: Time-based, Functional, Relational, Temporal
- Why should you never power on a computer that you need to acquire digital evidence from?: When the computer boots up, files are written to the computer rendering the data unclean, When the computer boots up, the system cache is cleared which could de
- What document does the screenshot represent?: Chain of custody form, Evidence collection form, Expert witness form, Search warrant form
- An executive has leaked the company trade secrets through an external drive. What process should the investigation team take if they could retrieve his system?: Postmortem Analysis, Real-Time Analysis, Packet Analysis, Malware Analysis
- Why should you note all cable connections for a computer you want to seize as evidence?: to know what outside connections existed, in case other devices were connected, to know what peripheral devices exist, to know what hardware existed
- Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has b
- A computer forensics Investigator or forensic analyst Is a specially trained professional who works with law enforcement as well as private businesses to retrieve Information from computers and other types of data storage devices. For this, the analy
- The MD5 program is used to:: wipe magnetic media before recycling it, make directories on an evidence disk, view graphics files on an evidence drive, verify that a disk is not altered when you examine it
- Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them b
- If a suspect computer is located in an area that may have toxic chemicals, you must;: coordinate with the HAZMAT team, determine a way to obtain the suspect computer, assume the suspect machine is contaminated, do not enter alone
- If you plan to startup a suspect‘s computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspect‘s hard drive by booting to the hard drive.: deltree command, CMOS, Boot.sys, Scandisk utility
- Which is a standard procedure to perform during all computer forensics investigations?: with the hard drive removed from the suspect PC, check the date and time in the system‘s CMOS, with the hard drive in the suspect PC, check the date and tim
- When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?: The year the evidence was taken, The sequence number for the parts of the same exhibit, The initials of the forensics analys, The sequential n
- When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?: a write-blocker, a protocol analyzer, a firewall, a disk editor
- You should make at least how many bit-stream copies of a suspect drive?: 1, 2, 3, 4
- The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?: Any data not yet flushed to the system will be lost, All running processes will be lost, The /tmp direc
- A methodical series of techniques and procedures for gathering evidence, from computing equipment and various storage devices and digital media is referred as computer forensics. The person who is responsible for authorization of a policy or procedur
- John is a Forensic Investigator working for Rodridge Corp. He started investigating a forensic case and has collected some evidence. Now John wants to use this evidence for further analysis. What should John do?: He should use the original evidence h
- The digital evidence must have some characteristics to be disclosed in the court of law. The statement “Evidence must be related to the fact being proved”, defines which characteristic?: Believable, Reliable, Admissible, Authentic
- Digital evidence is circumstantial, which makes it difficult for a forensics investigator to trace the system’s activity. Identify the nature of digital evidence:: Sturdy, Unbreakable, Fragile, Strong
- Analysis is the process of interpreting the extracted data to determine their significance to the case. The result of which analysis may indicate the additional steps that needs to be taken in the extraction and analysis processes?: Timeframe Analysi
- “Under no circumstances should anyone, with the exception of qualified computer forensics personnel, make any attempts to restore or recover information from a computer system or device that holds electronic information”. The above statement is v
- When collecting evidence, the collection should proceed from the most volatile to the least volatile. From the given list, identify which one of the following is least volatile:: Registers, cache, Archival media, Temporary file systems, Disk or other
- Mike is a Computer Forensic Investigator. He got a task from an organization to investigate a forensic case. When Mike reached the organization to investigate the place, he found that the computer at the crime scene was switched off. In this scenario
- In Forensic Investigation all evidence collected should be marked as exhibits using the exhibit numbering format. The format of exhibit numbering is aaa/ddmmyy/nnnn/zz. Identify what is zz in the exhibit number format:: Initials of the Forensic Analy
- A Computer Forensics Lab (CFL) is a designated location for conducting computer based investigation on the collected evidence. Identify which one of the following is not a good consideration for the structural design of a forensic lab:: It must be a
- The study of equipment to meet the human requirements of comfort without affecting the efficiency is defined as:: Ergonomics, Economics, Erlonomics, Erdynamics
- A case is associated with a specific role, which is established by the administrator. The New Case wizard captures role and case settings. The New Case wizard displays the Role dialog box and the Case Options dialog box. “Once you select a role, yo
- “EnCase have built-in capabilities to view all file types”. Identify whether the above statement is true or false:: True, False, Dummy,
- The file content of evidence files can be viewed using the View Pane. The View pane provides several tabs to view file content. Which of this tab provides native views of formats supported by Oracle outside in technology?: Text tab, Hex tab, Doc tab,
- EnCase allows you to bookmark any content displayed in the View pane. Bookmarks are stored in their associated case file and can be viewed by selecting the Bookmarks tab. When does a file group bookmark get created?: If more than two files are select
-
-
-
- Analysis of Image formats with hex editors: JPEG-The JPEG (Joint Photographic Experts Group) is a commonly used method to compress photographic images. It uses a compression algorithm to minimize the size of a file without affecting the quality of th
- RAID Storage System: Redundant Array of Independent Disks (RAID) is a technology that simultaneously uses multiple small disks, which function as a single large volume. RAID provides a method of accessing one or many separate hard disks, t
-
- You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?: 0:1000, 150, 0:1709, 150, 1:1709, 150, 0:1709-1858
- What determines the sector addressing for individual sectors on a disk?: CEH, CHS, DPC, HCS
- RAID 10 requires this number of drives to implement.: 4, 5, 10, 9
- This is a library and collection of command line tools for investigating disk images.: TPS, TKS, TPS, TSK
- This is a sequence of bytes, organized into blocks understandable by the system‘s Linker.: Object file, Snort, Object oriented database, HDTV
- Which of the following statements is true with respect to SSDs (solid-state drives)?: Faster data access, lower power usage, and higher reliability are some of the major advantages of SSDs over HDDs, SSDs contain tracks, clusters, and sectors to stor
- Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee in order to hide their nefarious actions. What
- Which component in the hard disk moves over the platter to read and write information?: Actuator, Spindle, Actuator Axis, Head
- Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive? 22,164 cylinders/disk 80 heads/cylinder 63 sectors/track: 53.26 GB, 57.19 GB, 11.17 GB, 10 GB
- A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evidence1.doc, sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin, what will
- You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You ha
- A file requires 10 KB space to be saved on a hard disk partition. An entire cluster of 32 KB has been allocated for this file. The remaining, unused space of 22 KB on this cluster will be identified as: Swap space, Slack space, Cluster space, Sector
- What does mactime, an essential part of the coroner‘s toolkit do?: It traverses the file system and produces a listing of all files based on the modification, access and change timestamps, It can recover deleted file space and search it for dat
- This is original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.: Master Boot Record (MBR), Master File Table (M
- Which of the following is a database in which information about every file and directory on an NT File System (NTFS) volume is stored?: Volume Boot Record, Master Boot Record, GUID Partition Table, Master File Table
- One way to identify the presence of hidden partitions on a suspect‘s hard drive is to:: Add up the total size of all known partitions and compare it to the total size of the hard drive, Examine the FAT and identify hidden partitions by noting a
- What value of the "Boot Record Signature" is used to indicate that the boot-loader exists?: AA55, 00AA, AA00, A100
- During a forensic investigation, a large number of files were collected. The investigator needs to evaluate ownership and accountability of those files. Therefore, he begins to identify attributes such as "author name,” "organization name
- Which of the following data structures stores attributes of a process, as well as pointers to other attributes and data structures?: Lsproc, DumpChk, RegEdit, EProcess
- Data density of a disk drive is calculated by using __________: Slack space, bit density, and slack density., Track density, areal density, and slack density., Track density, areal density, and bit density., Track space, bit area, and slack space.
- Fill in the missing Master Boot Record component. 1. Master boot code 2. Partition table 3. _____________________: Boot loader, Volume boot record, Signature word, Disk signature
- How many times can data be written to a DVD+R disk?: Twice, Once, Zero, Infinite
- What is cold boot (hard boot)?: It is the process of restarting a computer that is already in sleep mode, It is the process of shutting down a computer from a powered-on or on state, It is the process of restarting a computer that is already turned o
- NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?: EFS Certificate Hash, Container Name, Encrypted FE
- NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:: NTFS is a journaling file system, NTFS has lower cluster size space, FAT does not index files, FAT is an older and inefficient file
- Which of the following does not describe the type of data density on a hard disk?: Areal density, Volume density, Linear or recording density, Track density
- What technique is used by JPEGs for compression?: ZIP, TCD, DCT, TIFF-8
- When using an iPod and the host computer is running Windows, what file system will be used?: iPod+, HFS, FAT16, FAT32
- Which of the following stages in a Linux boot process involve initialization of the system‘s hardware?: BIOS Stage, Bootloader Stage, BootROM Stage, Kernel Stage
- Which among the following is an OLE compound file saved in Binary Interchange File Format (BIFF)?: PDF, PNG, XLS, GIF
- Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.: EXT, FAT, FAT32, NTFS
- In a FAT32 system, a 123 KB file will use how many sectors?: 34, 250, 11, 246
- Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?: Data from a CD copied using Windows, Data from a CD copied using Mac-based system, Data from a DVD copied using Windows system,
- In forensics.______are used lo view stored or deleted data from both files and disk sectors.: Hash algorithms, SI EM tools, Host interfaces, Hex editors
- Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute in determining the addresses of data?: Sectors, Interface, Cylinder, Heads
- Hard disk data addressing is a method of allotting addresses to each _______ of data on a hard disk.: Physical block, Operating system block, Hard disk block, Logical block
- What is the size value of a nibble?: 0.5 kilo byte, 0.5 bit, 0.5 byte, 2 bits
- Which file system developed by Apple, Inc., uses Unicode to name the files and folders within the system?: Hierarchical File System Plus (FHS+), Extended File System (EXT2), Hierarchical File System (FHS), File Allocation Table (FAT) In
- How many sectors will a 125 KB file use in a FAT32 file system?: 32, 16, 256, 250
- You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk?: Throw the hard disk into
- The surface of a hard disk consists of several concentric rings known as tracks; each of these tracks has smaller partitions called disk blocks. What is the size of each block?: 512 bytes, 256 bytes, 256 bits, 512 bits
- Before performing a logical or physical search of a drive in Encase, what must be added to the program?: File signatures, Keywords, Hash sets, Bookmarks
- An US-based organization decided to implement a RAID storage technology for their data backup plan. John wants to setup a RAID level that require a minimum of six drives but will meet high fault tolerance and with a high speed for the data read and w
- BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RGBQUAD array, in
- What is the name of the first reserved sector in File allocation table?: Volume Boot Record, Partition Boot Sector, Master Boot Record, BIOS Parameter Block
- Identify the RAID level represented below:: RAID 5, RAID 2, RAID 0, RAID 3
- Which block in ext2 file system stores information about the size and shape of the Ext2 file system?: Inode Bit Map, Group Descriptor, Inode Table, Super Block
- Which of the following will create lost clusters?: Logical structure error, Physical structure error, Logical disk error, Physical disk error
- Which of the following is a part of a Solid-State Drive (SSD)?: Spindle, NAND-based flash memory, Head, Cylinder
- Which of the following is a record of the characteristics of a file system, including its size, the block size, the empty and the filled blocks and their respective counts, the size and location of the inode tables, the disk block map and usage infor
- Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.: 24-bit, 16-bit, 32-bit, 8-bit
- Which file is a sequence of bytes organized into blocks understandable by the system‘s linker?: executable file, None of these, Object file, source file
- A master boot record (MBR) is the first sector ("sector zero") of a data storage device. What is the size of MBR?: Depends on the capacity of the storage device, 4092 Bytes, 512 Bytes, 1048 Bytes
- The process of restarting a computer that is already turned on through the operating system is called?: Ice boot, Warm boot, Cold boot, Hot Boot
- What is the location of a Protective MBR in a GPT disk layout?: Logical Block Address (LBA) 0, Logical Block Address (LBA) 1, Logical Block Address (LBA) 3, Logical Block Address (LBA) 2
- Which of the following stand true for BIOS Parameter Block?: The BIOS Partition Block is the first sector of a data storage device, The BIOS Partition Block describes the physical layout of a data storage volume, The length of BIOS Partition Block re
- Which of the following file system uses Master File Table (MFT) database to store information about every file and directory on a volume?: NTFS File System, ReFS, exFAT, FAT File System
- Which of the following is NOT a graphics file?: Picture1.tga, Picture2.bmp, Picture3.nfo, Picture4.psd
- Which of the following ISO standard defines file systems and protocol for exchanging data between optical disks?: ISO 9660, ISO 9060, IEC 3490, ISO/IEC 13940
- Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1. What is the file type of the image?: gif, jpeg, png, bmp
- If the partition size is 4 GB, each cluster will be 32 K. Even if a file needs only 10 K, the entire 32 K will be allocated, resulting in 22 K of ________.: Sector space, Slack space, Deleted space, Cluster space
- What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives?: SD memory, CF memory, MMC memory, SM memory
- What type of file is represented by a colon (:) with a name following it in the Master File Table of NTFS disk?: A compressed file, A Data stream file, An encrypted file, A reserved file
- What file structure database would you expect to find on floppy disks?: NTFS, FAT32, FAT16, FAT12
- Area density refers to:: the amount of data per disk, the amount of data per partition, the amount of data per square inch, the amount of data per platter
- What is the smallest physical storage unit on a hard drive?: Track, Cluster, Sector, Platter
- Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing compan
- Which of these ISO standards define the file system for optical storage media, such as CD ROM and DVD-ROM?: ISO 13490, ISO 13346, ISO 9960, ISO 9660
- An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are _______
- In a Fllesystem Hierarchy Standard (FHS), which of the following directories contains the binary files required for working?: /sbin, /proc, /mnt, /media
- A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigato
- In the context of file deletion process, which of the following statement holds true?: When files are deleted, the data is overwritten and the cluster marked as available, The longer a disk is in use, the less likely it is that deleted files will be
- The offset in a hexadecimal code is: The last byte after the colon, The 0x at the beginning of the code, The 0x at the end of the code, The first byte after the colon
- When operating systems mark a cluster as used but not allocated, the cluster is considered as ________: Corrupt, Bad, Lost, Unallocated
- Sectors in hard disks typically contain how many bytes?: 256, 512, 1024, 2048
- UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?: BIOS-MBR, GUID Partition Table (GPT), Master Boot Record (MBR), BIOS Parameter
- In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?: one who has NTFS 4 or 5 partitions, one who uses dynamic swap file capability, one who uses hard disk writes on I
- Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?: Sector, Metadata, MFT, Slack Space
- Which type of digital data stores a document file on a computer when it is deleted and helps in the process of retrieving the file until that file space is reused?: Metadata, Residual Data, Archival Data, Transient Data
- Platters are the round flat magnetic metal or ceramic disks in the hard disk that hold the actual data. A concentric circular ring on both sides of each platter is known as a track. Track numbering starts from which number?: -1, 0, 1, 6
- Which one of the following is the smallest allocation unit of a hard disk, which contains a set of tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme?: Sector, Cluster, Track, Platter
- File system is a set of data types, which is employed for storage, hierarchical categorization, management, navigation, access, and recovering the data. Which type of file system is the one in which a number of systems (servers) have access to the sa
- Major file systems include FAT, NTFS, HFS, Ext2, Ext3, etc. Identify the correct statement for FAT file system:: Supports large storage media, Supports file system recovery, Does not support file system recovery, Supports large file names
- Redundant Array of Inexpensive Disks (RAID) is a technology that uses multiple smaller disks simultaneously which functions as a single large volume. In which RAID level disk mirroring is done?: RAID Level 3, RAID Level 0, RAID Level 1, RAID Level 5
- FTP stands for File Transfer Protocol and an FTP server sends and receives files using FTP. What description does the FTP sc-status Error Code 1xx gives?: Service ready in nnn minutes, Data connection already open-transfer starting, Positive Prelimin
- Hex searching allows you to search for repeating instances of data in Hex-format, and to save Hex-format data search strings to an XML file and reuse it in this or other cases. Hexadecimal (Hex) format includes pairs of characters in a base 16 numeri
- EnCase Forensic provides a variety of software modules that put powerful investigative tools at the disposal of forensic investigators. Which of this EnCase Forensic software module allows investigators to mount computer evidence as a local drive for
- The process of examining acquired evidence is cyclical in nature and reflected in the relationship among the four panes of the EnCase interface. Which of the following pane represents a structured view of all gathered evidence in a Windows-like folde
- An evidence case has a tripartite structure consisting of an evidence file, a case file, and EnCase configuration files. By default, a backup copy of the case file is saved every 10 minutes. Selecting which option you can disable the autosave functio
-
-
-
-
- How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?: 128, 64, 32, 16
- You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?: creat
- You are working as an independent computer forensics investigator and received a call from a system administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropr
- Which of the following tools will allow a forensic investigator to acquire the memory dump of a suspect machine so that it may be investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?: Bulk Extra
- An investigator needs to perform data acquisition from a storage media without altering its contents to maintain the integrity of the content. The approach adopted by the investigator relies upon the capacity of enabling read-only access to the stora
- Which tool allows dumping the contents of process memory without stopping the process?: pdump.exe, psdump.exe, pmdump.exe, processdump.exe
- According to RFC 3227, which of the following is considered as the most volatile item on a typical system?: Archival media, Kernel statistics and memory Registers, Registers and cache, Temporary system files
- Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?: Portable Document Format, Advanced Forensics Format (AFF), Proprietary Format,
- Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?: Static Acquisition, Sparse or Logical Acquisition, Bit-stream disk-to-disk Acquisition,
- Which of the following file formats allows the user to compress the acquired data as well as keep it randomly accessible?: Generic Forensic Zip (gfzip), Advanced Forensics Format (AFF), Advanced Forensic Framework 4, Proprietary Format
- Raw data acquisition format creates _________ of a data set or suspect drive.: Segmented image files, Segmented files, Compressed image files, Simple sequential flat files
- Which of the following technique creates a replica of an evidence media?: Data Extraction, Backup, Bit Stream Imaging, Data Deduplication
- An investigator has extracted the device descriptor for a 1GB thumb drive that looks like: Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the “Geek_Squad” part represent?: Product description, Manufacturer Details, Developer description
- Which of the following tools is not a data acquisition hardware tool?: Triage-Responder, Atola Insight Forensic, F-Response Imager, UltraKit
- Which of the following tool creates a bit-by-bit image of an evidence media?: Xplico, AccessData FTK Imager, Recuva, FileMerlin
- Paraben Lockdown device uses which operating system to write hard drive data?: Mac OS, Red Hat, Unix, Windows
- Which of the following tool enables data acquisition and duplication?: Colasoft‘s Capsa, DriveSpy, Wireshark, Xplico
- When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write- blocking device to:: Automate Collection from image files, Avoiding copying data from the boot partition, Acquire data from host-p
- What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?: Every byte of the file(s) is given an MD5 hash to match against a master file, Every byte of the file(s) is verified using 32-bit CRC, Eve
- Derrick, a forensic specialist, was investigating an active computer that was executing various processes. Derrick wanted to check whether this system was used In an Incident that occurred earlier. He started Inspecting and gathering the contents of
- Where does Encase search to recover NTFS files and folders?: MBR, MFT, Slack space, HAL
- When should an MD5 hash check be performed when processing evidence?: After the evidence examination has been completed, On an hourly basis during the evidence examination, Before and after evidence examination, Before the evidence examination has be
- Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the s
- In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?: RAID 1, The images will always be identical because data is mirrored for redundancy, RAID 0, It will always be diff
- To preserve digital evidence, an investigator should ____________________.: Make two copies of each evidence item using a single imaging tool, Make a single copy of each evidence item using an approved imaging tool, Make two copies of each evidence i
- You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might questio
- Digital evidence is defined as “any information of probative value that is either stored or transmitted in a digital form”. Which type of digital data contains system time, logged-on user(s), open files, network information, process information,
- Which type of the digital data is used for the secondary storage and is long-term persisting?: Non-volatile Data, Volatile Data, Transient Data, Temporarily Accessible Data
- Different types of electronic devices are used for collecting potential evidence to investigate a forensic case. In which of this electronic device evidence is found through Address book, Notes, Appointment calendars, Phone numbers and Email?: Digita
- Which information can be easily modified or lost when the system is shut down or rebooted?: Volatile information, Non-volatile information, Both a and b, Neither a nor b
- Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media. The type of data acquisition which is defined as acquiring data that remains unaltered when the system is powe
- Entries include evidence and other file types containing digital evidence that are added to a case. EnCase applications support four classes of evidence-containing files. In which of this files contain a collection of files, but lack the integration
- Source Processor automates and streamlines common investigative tasks that collect, analyze, and report on evidence. Which of this source processor module obtains drives and memory from a target machine?: Personal Information Module, Internet Artifac
-
-
-
-
- Jack is reviewing file headers to verify the file format and hopefully find more information of the file. After a careful review of the data chunks through a hex editor; Jack finds the binary value 0xffd8ff. Based on the above information, what type
- Storage location of Recycle Bin for NTFS file systems (Windows Vista and later) is located at:: Drive:REYCLED, Drive:$Recycle.Bin, Drive:RECYCLER, Drive:RECYCLE.BIN
- Assume there is a file named myfile.txt in C: drive that contains hidden data streams. Which of the following commands would you issue to display the contents of a data stream?: myfile.dat:stream1, C:>ECHO text_message > myfile.txt:stream1, C:M
- One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a docum
- Which set of anti-forensic tools/techniques allows a program to compress and/or encrypt an executable file to hide attack tools from being detected by reverse-engineering or scanning?: Packers, Emulators, Password crackers, Botnets
- Self-monitoring, analysis, and reporting technology (SMART) system is built into hard drives to monitor and report system activity. Which of the following is included in the report generated by SMART?: A log of high temperatures that the drive has re
- Sally accessed the computer system that holds trade secrets of the company where she is employed. She knows she accessed it without authorization and all access (authorized and unauthorized) to this computer is monitored.To cover her tracks, Sally de
- Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?: C:$RECYCLER, C:RECYCLER, C: $Recycled.Bin, C:$Recycle.Bin
- Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the com
- Jacky encrypts her documents using a password. It is known that she uses her daughter‘s year of birth as part of the password. Which password cracking technique would be optimal to crack her password?: Brute-force attack, Hybrid attack, Rule-ba
- Chloe is a forensic examiner who is currently cracking hashed passwords for a crucial mission and hopefully solve the case. She is using a lookup table used for recovering a plain text password from cipher text; it contains word list and brute-force
- Consider that you are investigating a machine running a Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:Recycler<USER SID>.
- Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.: RuneFS, Slacker, FragFS, Waffen FS
- Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look fo
- Which code does the FAT file system use to mark the file as deleted?: H5E, E5H, ESH, 5EH
- What is one method of bypassing a system BIOS password?: Removing the processor, Removing the CMOS battery, Remove all the system memory, Login to Windows and disable the BIOS password
- Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.: Drive:∖$Recycle.Bin, Drive:∖RECYCLER, Drive:∖RECYCLED, Drive:∖Recycle.Bin
- A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect‘s available information b
- Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?: Rainbow Table, Partition Table, Master file Table (MFT), Directory Table
- What do you call the process of applying magnetic field to a digital media device to erase data on the device?: Disk magnetization, Disk cleaning, Disk degaussing, Disk deletion
- Which of the following techniques can be used to beat steganography?: Cryptanalysis, Encryption, Steganalysis, Decryption
- Which of the following is a MAC-based File Recovery Tool?: GetDataBack, Smart Undeleter, VirtualLab Cisdem, Cisdem DataRecovery 3
- Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where "x" represents the _________: Original file name‘s extension, Sequential number, Drive name, Original file name
- When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?: FF D8 FF E0 00 10, FF FF FF FF FF FF, FF 00 FF 00 FF 00, EF 00 EF 00 EF 00
- Which of the following is NOT an anti-forensics technique?: Data Deduplication, Steganography, Encryption, Password Protection
- Jason discovered a file named $RIYG6VR.doc in the C:∖ $Recycle.Bin ∖< USER SID > ∖ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?: It is a doc file deleted in seventh se
- Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.?: Dictionary attack, Brute force attack, Rule-based attack, Man in the middle attack
- In Steganalysis, which of the following describes a Known-stego attack?: The hidden message and the corresponding stego-image are known, Original and stego-object are available and the steganography algorithm is known, Only the steganography medium i
- Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?: A text file deleted from C drive in fifth sequential order, A text file deleted from C
- Which of the following techniques delete the files permanently?: Trail obfuscation, Data Hiding, Artifact Wiping, Steganography
- A forensic examiner encounters a computer with a failed OS installation and the master boot record (MBR) or partition sector damaged. Which of the following tools can find and restore files and Information In the disk?: Helix, R-Studio, NetCat, Wires
- What is the location of master database file INFO2 containing information about the deleted files in Windows systems prior to Windows Vista?: C:∖$Recycled, C:∖Recycle, C:∖$Recycle.Bin, C:∖Recycler
- Which of the following files DOES NOT use Object Linking and Embedding (OLE) technology to embed and link to other objects?: Portable Document Format, MS-office Word Document, MS-office Word OneNote, MS-office Word PowerPoint
- An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine
- You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several
- When you carve an image, recovering the image depends on which of the following skills?: Recognizing the pattern of the header content, Recovering the image from a tape backup, Recognizing the pattern of a corrupt file, Recognizing the image from the
- What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?: Cracks every password in 10 minutes, Distribute processing over 16 or fewer computers, Support for Encrypted File System, Support for MD5 hash v
- John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are
- Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client
- Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers. Bill protects the PDF documents with a password and sends them to
- What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?: rootkit, key escrow, steganography, Offset
- Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ?: Typography, Steganalysis, Picture encoding, Steganography
- Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. He wants to recover all the data, which includes his personal photos, music, documents, videos
- On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?: SAM, AMS, Shadow file, Password.conf
- Which password cracking technique uses every possible combination of character sets?: Rainbow table attack, Brute force attack, Rule-based attack, Dictionary attack
- In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?: Chosen-message attack, Known-cover attack, Known-message
- When examining a file with a Hex Editor, what space does the file header occupy?: the last several bytes of the file, the first several bytes of the file, none, file headers are contained in the FAT, one byte at the beginning of the file
- Which technique is used to hide a secret message within an ordinary message and extract it at the destination to maintain confidentiality of data?: Cryptography, Steganography, Encryption, PKI
- Which of this attack technique is the combination of both a brute-force attack and a dictionary attack to crack a password?: Hybrid Attack, Rule-based Attack, Syllable Attack, Fusion Attack
-
-
-
-
- Jeff is a forensics investigator for a government agency‘s cyber security office. Jeff is tasked with acquiring a memory dump of a Windows 10 computer that was involved in a DDoS attack on the government agency‘s web application. Jeff is
- Which following forensic tool allows investigator to detect and extract hidden streams on NTFS drive?: Stream Detector, Autopsy, TimeStomp, analyzeMFT
- What is the investigator trying to analyze if the system gives the following image as output?: All the logon sessions, Currently active logon sessions, Inactive logon sessions, Details of users who can logon
- During forensics investigations, investigators tend to collect the system time at first and compare it with UTC. What does the abbreviation UTC stand for?: Coordinated Universal Time, Universal Computer Time, Universal Time for Computers, Correlated
- Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?: RegistryChangesView, RegDIIView, RegRipper, ProDiscover
- Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.?: Windows 98, Linux, Windows 8.1,
- An investigator seized a notebook device installed with a Microsoft Windows OS. Which type of files would support an investigation of the data size and structure in the device?: Ext2 and Ext4, APFS and HFS, HFS and GNUC, NTFS and FAT
- Place the following in order of volatility from most volatile to the least volatile: Registers and cache, routing tables, temporary file systems, disk storage, archival media, Archival media, temporary file systems, disk storage, archival media, regi
- A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is t
- What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?: Restore point interval, Automatically created restore points, System CheckPoints required for restoring, Restore point functions
- Which of the following is a tool to reset Windows admin password?: R-Studio, Windows Password Recovery Bootdisk, Windows Data Recovery Software, TestDisk for Windows
- Which of the following registry components (cells) contains registry key information and includes offsets to other cells as well as the Last Write time for the key?: Security descriptor cell, Key cell, Value list cell, Value cell
- To understand the impact of a malicious program after the booting process and to collect recent information from the disk partition, an investigator should evaluate the content of the:: MBR, GRUB, UEFI, BIOS
- You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustivel
- Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?: Ethereal, Choreography, Data grab, Helix Live
- Which of these Windows utility help you to repair logical file system errors?: Resource Monitor, Disk defragmenter, Disk cleanup, CHKDSK
- Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?: Belkasoft Live RAM Capturer, CacheInf, FATKit, Coreography
- Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization‘s DC server. Smith wants to find all the values ty
- Which of the following Windows event logs record events related to device drives and hardware changes?: Security log, System log, Forwarded events log, Application log
- What is the extension used by Windows OS for shortcut files present on the machine?: .pf, .log, .dat, .lnk
- The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the Recycle Bin, a record is added to the log file that exists in the Recycle Bin. Which of the following
- Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.: Devscan, Devcon, fsutil, Reg.exe
- What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?: BIOS Parameter Block (BPB) and the extended BPB, Bootstrap code and the end of the sector marker, BIOS Parameter Block (BPB) and the OEM ID, Jump instruction
- While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?: Windows 8.1, Windows 10, Windows 8, Windows 7
- Windows identifies which application to open a file with by examining which of the following?: The File extension, The file attributes, The file Signature at the end of the file, The file signature at the beginning of the file
- What is the primary function of the tool CHKDSK in Windows that authenticates the file system reliability of a volume?: Repairs logical file system errors, Check the disk for hardware errors, Check the disk for connectivity errors, Check the disk for
- Which of the following registry hive gives the configuration information about which application was used to open various files on the system?: HKEY_LOCAL_MACHINE, HKEY_CLASSES_ROOT, HKEY_USERS, HKEY_CURRENT_CONFIG
- Which of these commands will an attacker use to creatwae data streams on a NTFS file system?: C:ECHO text_message > myfile.txt: stream1, C: MORE text_message > myfile.txt.stream1, C: MORE text_message < myfile.txt.stream1, C:ECHO text_messag
- Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?: ParentIDPrefix, LastWrite, UserAssist key, MRUListEx key
- In which registry does the system store the Microsoft security IDs?: HKEY_CLASSES_ROOT (HKCR), HKEY_CURRENT_CONFIG (HKCC), HKEY_CURRENT_USER (HKCU), HKEY_LOCAL_MACHINE (HKLM)
- Which of the following hives in the Windows registry contain a vast array of configuration information of the system, including hardware and software settings?: HKEY_USERS, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, HKEY_CLASSES_ROOT
- When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?: File Size, File origin and modification, Time and date of deletion, File Name
- Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?: Tokenmon, PSLoggedon, TCPView, Process Monitor
- What happens to the header of the file once it is deleted from the Windows OS file systems?: The hex byte coding of the file remains the same, but the file location differs, The OS replaces the entire hex byte coding of the file, The OS replaces the
- What does the command "C:>wevtutil gl <log name>" display?: List of available Event Logs, Event logs are saved in .xml format, Configuration information of a specific Event Log, Event log record structure
- What advantage does the tool Evidor have over the built-in Windows search?: It can find deleted files even after they have been physically removed, It can find bad sectors on the hard drive, It can search slack space, It can find files hidden within
- Which of the following files contains the traces of the applications installed, run, or uninstalled from a system?: Virtual Files, Image Files, Shortcut Files, Prefetch Files
- James, a forensics specialist, was tasked with investigating a Windows XP machine that was used for malicious online activities. During the Investigation, he recovered certain deleted files from Recycle Bin to Identify attack clues. Identify the loc
- Robert was arrested under child pornography case for uploading child pornography videos to a website. FBI seized all the digital devices pertaining to the case and a forensic investigator was hired to carry out the investigation. The investigator sus
- The Run rd /s /q C:∖$Recycle.bin command is executed on a Windows machine to.: Restore the files deleted from the Recycle Bin, Disable the Recycle Bin, Empty the Recycle Bin, Repair the Recycle Bin
- Which of the following tools can be used to parse the contents of .lnk files to reveal information embedded within the files?: Windows File Analyzer, ProDiscover, Exiv2, IrfanView
- Which of the following application password cracking tool can discover all password protected items on a computer and decrypts them?: Passware Kit Forensic, TestDisk for Windows, Windows Password Recovery Bootdisk, R-Studio
- In the Registry editor, the registry tree HKEY_LOCAL_MACHINE∖SYSTEM∖CurrentControlSet∖Services∖ contains information about each service on the machine. When you select a service, what should the value of Start key specific to
- Tasklist command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following tasklist commands provides information about the listed processes, includin
- Which program is the bootloader when Windows XP starts up?: KERNEL.EXE, NTLDR, LOADER, LILO
- Which part of the Windows Registry contains the user‘s password file?: HKEY_LOCAL_MACHINE, HKEY_CURRENT_CONFIGURATION, HKEY_USER, HKEY_CURRENT_USER
- Pagefile.sys is a virtual memory file used to expand the physical memory of a computer. Select the registry path for the page file:: HKEY_LOCAL_MACHINE∖SYSTEM∖CurrentControlSet∖Control∖Session Manager∖Memory Management,
- Which of the following is a list of recently used programs or opened files?: Most Recently Used (MRU), Master File Table (MFT), GUID Partition Table (GPT), Recently Used Programs (RUP)
- Which of the following commands can be used by the forensic investigators to determine the details of open shared files on a server?: net file, net sessions, psfile, openfiles
- When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.: A Capital X, A Blank Space, The Underscore Symbol, The lo
- What does the command “C:∖>wevtutil gl ” display?: Configuration information of a specific Event Log, Event logs are saved in .xml format, Event log record structure, List of available Event Logs
- A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:∖RECYCLED using a command line tool but does not find anything. What is the reason for this?: H
- Select the data that a virtual memory would store in a Windows-based system?: Running processes, Information or metadata of the files, Application data, Documents and other files
- What is the capacity of Recycle bin in a system running on Windows Vista?: 2.99GB, 3.99GB, Unlimited, 10% of the partition space
- Ivanovich, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?: Swap space, Application data, Files and documents, Slack space
- What is the investigator trying to view by issuing the command displayed in the following screenshot?: List of services recently started, List of services stopped, List of services installed, List of services closed recently
- What does the acronym POST mean as it relates to a PC?: Primary Operations Short Test, PowerOn Self Test, Pre Operational Situation Test, Primary Operating System Test
- The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created. Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?: Global File Syste
- Richard is extracting volatile data from a system and uses the command doskey /history. What is he trying to extract?: Previously typed commands, History of the browser, Events history, Passwords used across the system
- Which of the following tool enables a user to reset his/her lost admin password in a Windows system?: Passware Kit Forensic, SmartKey Password Recovery Bundle Standard, Active@ Password Changer, Advanced Office Password Recovery
- Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is?: HKEY_LOCAL_MACHINE∖SOFTWARE∖Microsoft∖Windows NT∖CurrentVersion ∖ProfileList, HKEY_LOCAL_MACHINE∖SOFTWARE
- Printing under a Windows Computer normally requires which one of the following files types to be created?: EME, MEM, EMF, CME
- Which of the following web browser uses the Extensible Storage Engine (ESE) database format to store browsing records, including history, cache, and cookies?: Safari, Microsoft Edge, Google Chrome, Mozilla Firefox
- Which list contains the most recent actions performed by a Windows User?: MRU, Recents, Windows Error Log, Activity
- The investigator wants to examine changes made to the system‘s registry by the suspect program. Which of the following tool can help the investigator?: TRIPWIRE, RAM Capturer, Regshot, What‘s Running
- Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer. Where should Harold navigate on the computer to find the file?: %systemroot%∖system32∖LSA, %systemroot%∖system32∖dr
- When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called “INFO2” in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.:
- Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?: Globally unique ID, Microsoft Virtual Machine Identifier, Personal App
- Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?: wmic service, Reg.exe, fsutil, Devcon
- In Windows Security Event Log, what does an event id of 530 imply?: Logon Failure - Unknown user name or bad password, Logon Failure - Account logon time restriction violation, Logon Failure - User not allowed to logon at this computer, Logon Failure
- When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:: Recycle Bin, MSDOS.sys, BIOS, Case files
- Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?: Sparse File, Master File Table, Meta Block Group, Slack Space
- Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?: The data is still present until the original location of the file is used, The data is moved to the Restore directory and is kept there inde
- In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?: Determines the data associated with value Enabl
- The given image displays information about date and time of installation of the OS along with service packs, patches, and sub-directories. What command or tool did the investigator use to view this output?: dir /o:n, dir /o:s, dir /o:d, dir /o:e
- What file is processed at the end of a Windows XP boot to initialize the logon dialog box?: NTOSKRNL.EXE, NTLDR, LSASS.EXE, NTDETECT.COM
- Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an
- When investigating a Windows System, it is important to view the contents of the page or swap file because:: Windows stores all of the systems configuration information in this file, This is file that windows use to communicate directly with Registry
- If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?: Lossful compression, Lossy compression, Lossless compression, Time-loss compression
- While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?: The files have been marked as hi
- What is kept in the following directory? HKLM∖SECURITY∖Policy∖Secrets: Cached password hashes for the past 20 users, Service account passwords in plain text, IAS account names and passwords, Local store PKI Kerberos certificates
- What feature of Windows is the following command trying to utilize?: White space, AFS, ADS, Slack file
- What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?: forensic duplication of hard drive, analysis of volatile data, comparison of MD5 checksums, review of SI
- What are the security risks of running a "repair" installation for Windows XP?: Pressing Shift+F10 gives the user administrative rights, Pressing Shift+F1 gives the user administrative rights, Pressing Ctrl+F10 gives the user administrative
- Which of the following hives in Windows registry contain configuration information related to the application type that is used to open various files on the system?: HKEY_CURRENT_CONFIG, HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL MACHINE
- An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had obs
- Diskcopy is:: a utility by AccessData, a standard MS-DOS command, Digital Intelligence utility, dd copying tool
- What happens when a file is deleted by a Microsoft operating system using the FAT file system?: only the reference to the file is removed from the FAT, the file is erased and cannot be recovered, a copy of the file is stored and the original file is
- Investigator Janet comes across a suspicious Windows registry key during a computer hacking forensic investigation. She believes modifying this key is associated with the recent cyberattack on the company‘s servers. In order to confirm this, Ja
- Booting refers to the process of starting or resetting operating systems when the user turns on a computer system. Cold boot is a type of booting, and is defined as the process of starting a computer from a powered-down or off state. Cold boot is als
- During live response, you can retrieve and analyze much of the information in the Registry, and the complete data during post-mortem investigation. Which of this registry Hive contains configuration information relating to which application is used t
- A system’s audit policy is maintained in the Security hive, below the PolicyPolAdtEv key. Its default value is REG_NONE data type and contains binary information into which the audit policy is encoded. The first 4 bytes (DWORD) of the binary data g
- Registry keys that track user’s activities can be found in the NTUSER.DAT file. When a user performs a particular action, the registry keys Lastwrite time is updated. These registry keys track the user’s activity and add or modify timestamp infor
- File deletion is a way of removing a file from a computers file system. The below are the series of events which occur when a file is deleted in windows. Identify which of the following event does not occur when the file is deleted:: The first letter
-
-
-
- Linux Directory Structure: / – The root directory /bin – Binaries /dev – Device files /etc – Configuration files /usr – User binaries and program data /home – User personal data /lib – Shared libraries /sbin – Sys
- dd command common options: The dd command accepts several options to customize its behavior and achieve specific tasks. Here are some of the most commonly used options: Operands bs=BYTES Read and write BYTES bytes at a
- Basic and essential Linux Commands: 1. ls - The most frequently used command in Linux to list directories 2. pwd - Print working directory command in Linux 3. cd - Linux command to navigate through directories 4. mkdir - Command used to
- Nmap command: Nmap is a network scanning tool—an open source Linux command-line tool—used for network exploration, host discovery, and security auditing. Nmap allows you to scan your network and discover not only everything connected t
-
- The newer Macintosh Operating System is based on:: OS/2, BSD Unix, Linux, Microsoft Windows
- Which Linux command displays kernel ring buffers or information about device drivers loaded into the kernel?: dmesg, grep, fsck, pgrep
- What will the following command accomplish? dd if=/dev/xxx of=mbr.backup bs=512 count=1: Back up the master boot record, Restore the master boot record, Mount the master boot record on the first partition of the hard drive, Restore the first 512 byte
- Which command can provide investigators with details of all the loaded modules on a Linux-based system?: list modules -a, plist mod -a, lsmod, lsof -m Which
- In Linux, what is the smallest possible shellcode?: 24 bytes, 8 bytes, 800 bytes, 80 bytes
- Using Linux to carry out a forensics investigation, what would the following command accomplish?dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror: Search for disk errors within an image file, Backup a disk to an image file, Co
- Which of the following directory contains the binary files or executables required for system maintenance and administrative tasks on a Linux system?: /lib, /sbin, /usr, /bin
- With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________: 0, 10, 100, 1
- Which of the following tools will help you to recover deleted files in Mac OS X?: Automator, Spotlight, Grapher, Time Machine
- What is the purpose of command "dd if=mbr.backup of=/dev/xxx bs=512 count=1" on a Unix/Linux system?: Restore BIOS, Back-up BIOS, Back-up MBR, Restore the MBR
- Charles has accidentally deleted an important file while working on his Mac computer. He wants to recover the deleted file as it contains some of his crucial business secrets. Which of the following tool will help Charles?: FileSalvage, DriveSpy, Col
- A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?: /auth, /proc, /var/log/debug, /var/spool/cron
- Which of these files helps a forensics investigator to locate the start-up files created by a malware infection on a Linux system?: Rc.config file, Rc.local file, Rc.cache file, Rc.vimrc file
- What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024: Copy the master boot record to a file, Copy the contents of the system folder to a file, Copy the running memory to a file, Copy the memory dump file to an
- On a Linux system, what is the command "dcfldd if=/dev/sda of=usbimg.dat" used for?: To acquire an entire media device in one dat file, To acquire an entire media device in one image file, To make an ISO image of a CD, To generate segmented
- James, a forensic investigator, is trying to identify hidden processes and files on a system recovered from a crime scene. He is using a rootkit detection technique, which compares characteristics of all system processes and executable files with a d
- What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images?: mcopy, image, MD5, dd
- Where are files temporarily written in Unix when printing?: /usr/spool, /var/print, /spool, /var/spool
- You are asked to perform forensics on a MAC operating system. What kind of information would you obtain when you issue the stat command, followed by its supporting switches in the MAC terminal?: Timestamp information of the selected file, System vers
- In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file /var/log/dmesg?: All mail server message l
- Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?: pstree, ps, grep, pgrep
- In a Linux-based system, what does the command "Last -F" display?: Last functions performed, Login and logout times and dates of the system, Recently opened files, Last run processes
- What is the location of the binary files required for the functioning of the OS in a Linux system?: /run, /bin, /root, /sbin
- What does the superblock in Linux define?: filesynames, diskgeometr, location of the firstinode, available space
- Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync: Fill the disk with zeros, Low-level format, Fil
- On Linux/Unix based Web servers, what privilege should the daemon service be run under?: Guest, Root, You cannot determine what privilege runs the daemon service, Something other than root
- What is the slave device connected to the secondary IDE controller on a Linux OS referred to?: hda, hdd, hdb, hdc
- Which of the following is an iOS Jailbreaking tool?: Kingo Android ROOT, Towelroot, One Click Root, Redsn0w
- Which of the following file system is used by Mac OS X?: EFS, HFS+, EXT2, NFS
- You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string withi
- What will the following command accomplish in Linux? fdisk /dev/hda: Partition the hard drive, Format the hard drive, Delete all files under the /dev/hda folder, Fill the disk with zeros
- Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader). In which stage of the booting process do the bootloaders become active: Bootloader Stage, Kernel Stage, BootROM Stage, BIOS St
- If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude: The system files have been copied by a remote attacker, The system administrator has created an incremental backup, The system has
- Why are Linux/Unix based computers better to use than Windows computers for idle scanning: Linux/Unix computers are easier to compromise, Linux/Unix computers are constantly talking, Windows computers are constantly talking, Windows computers will no
- In Linux validation methods Dcfldd is designed for forensic data acquisition and has validation options integrated i.e.; hash and hashlog. What is the command used command at the shell prompt to create an MD5 hash output file during dcfldd data acqui
- Forensic investigators use the built- in Linux command dd to copy data from a disk drive. The “dd” command can copy the data from any disk that Linux can mount and access. what is the syntax for copying one hard disk partition to another hard dis
-
-
-
- Types of firewalls: There are five key types of firewalls that use different mechanisms to identify and filter out malicious traffic, but the exact number of options is not nearly as important as the idea that different kinds of firewall products
- Net command : The net command is used to update or fix a network or view its settings. The net command is available from within the Command Prompt in all Windows operating systems including Windows 11, Windows 10, Windows 8, Windows 7, Wind
- 7 layers of OSI model: What Is the OSI ModelThe Open Systems Interconnection (OSI) model describes seven layers that computer systems use to communicate over a network. It was the first standard model for network communications, adopted by all ma
- Event Correlation Approaches: Numerous methodologies can be applied to conduct event correlation based on log data. The following are some widely used approaches: Graph-Based Approach: This approach constructs a graph with the system
- Commonly using Network Forensics Tools: Various tools are available for Network forensics to investigate network attacks. Network forensic tools are incredibly useful when it comes to evidence collection, especially in a day and age when most peop
- Default and Common Port Numbers and its protocols & functions: Port number is a 16-bit numerical value that ranges from 0 to 65535. Well-known port (0-1023), registered port (1024-49151), and dynamic port is three types of port number space.
- Nmap command: Nmap is a network scanning tool—an open source Linux command-line tool—used for network exploration, host discovery, and security auditing. Nmap allows you to scan your network and discover not only everything connected t
-
- If you come across a sheepdip machine at your client site, what would you infer?: A sheepdip coordinates several honeypots, A sheepdip computer is another name for a honeypot, A sheepdip computer is used only for virus-checking., A sheepdip computer
- A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are require
- You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP a
- Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connec
- During the course of his investigation, Vincent came across a situation where he needs to run a packet sniffing tool on a Linux-based machine to monitor the network traffic. Which tool should Vincent choose in this case?: Tcpdump, Balbuzard, CurrPort
- What layer of the OSI model do TCP and UDP utilize?: Data Link, Network, Transport, Session
- Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What ter
- Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders were able to gain access into the company firewalls by overloading them with IP packets. Cylie then discovers through her investigation that
- When analyzing logs, it is important that the clocks of all the network devices are synchronized. Which protocol will help in synchronizing these clocks?: Time Protocol, UCT, NTP, UTC
- What will the following command accomplish? C:∖ nmap -v -sS -Po -data_length 6600 0-packet_trace: Test ability of a router to handle over-sized packets, Test the ability of a router to handle under-sized packets, Test the ability of a WLAN to h
- After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as
- When monitoring for both intrusion and security events between multiple computers, it is essential that the computers‘ clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against mu
- Which of the following tool can the investigator use to analyze the network to detect Trojan activities?: Regshot, TRIPWIRE, RAM Computer, Capsa
- Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at lea
- The information security manager at a national legal firm has received several alerts from the intrusion detection system that a known attack signature was detected against the organization‘s file server. What should the information security ma
- A packet is sent to a router that does not have the packet destination address in its route table. How will the packet get to its proper destination?: Root Internet servers, Border Gateway Protocol, Gateway of last resort, Reverse DNS
- Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri‘s duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one o
- Software firewalls work at which layer of the OSI model?: Application, Network, Transport, Data Link
- Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the icon following image in the checkpoint logs represent?: The f
- Recently, an internal web app that a government agency utilizes has become unresponsive. Betty, a network engineer for the government agency, has been tasked to determine the cause of the web application‘s unresponsiveness. Betty launches Wires
- A computer forensics investigator is inspecting the firewall logs for a large financial institution that has employees working 24 hours a day, 7 days a week. What can the investigator infer from the screenshot seen below?: A smurf attack has been att
- Your company‘s network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security. The audit company recommended turnin
- John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to
- After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network ca
- Bob works as information security analyst for a big finance company. One day, the anomaly-based intrusion detection system alerted that a volumetric DDOS targeting the main IP of the main web server was occurring. What kind of attack is it?: IDS atta
- Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?: Network-platform corr
- Which command line tool is used to determine active network connections?: netstat, nbstat, netsh, nslookup
- What system details can an investigator obtain from the NetBIOS name table cache?: List of files opened on other systems, List of files shared between the connected systems, List of the system present on a router, List of connections made to other sy
- When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?: Passive IDS, Active IDS, Progressive IDS, NIPS
- Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?: Session, Physical, Transport, Network
- Why is it a good idea to perform a penetration test from the inside?: It is never a good idea to perform a penetration test from the inside, Because 70% of attacks are from inside the organization, To attack a network from a hacker‘s perspectiv
- When investigating a wireless attack, what information can be obtained from the DHCP logs?: The operating system of the attacker and victim computer, IP traffic between the attacker and the victim, MAC address of the attacker, If any computers on the
- George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are
- When a router receives an update for its routing table, what is the metric value change to that path?: Increased by 2, Decreased by 1, Increased by 1, Decreased by 2
- Identify the log management function in which each log data field is converted to a particular data representation and categorized consistently.: Log normalization, Log viewing, Event correlation, Log conversion
- Smith is an IT technician that has been appointed to his company‘s network vulnerability assessment team. He is the only IT employee on the team. The other team members include employees from Accounting, Management, Shipping, and Marketing. Smi
- You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal comp
- You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company clients. You have rummaged through their trash and found very little information. You do not want to set o
- You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using ldp.exe.
- Which of the following functions of a log management system involves calculation of the message digest for each file and storing the message digest securely to ensure detection of the changes made to the archived logs?: Log parsing, Log normalization
- Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?: Net config, Net file, Net share, Net sessions
- What does the part of the log, “% SEC-6-IPACCESSLOGP”, extracted from a Cisco router represent?: The system was not able to process the packet because there was not enough room for all of the desired IP header options, Immediate action required m
- A(n) _____________________ is one that‘s performed by a computer program rather than the attacker manually performing the steps in the attack sequence.: blackout attack, automated attack, distributed attack, central processing attack
- To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using http
- When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel?: Multiple access points can be set up on the same channel without any issues, Avoid over-saturation of wireless signa
- You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses
- What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?: ICMP header field, TCP header field, IP header field, UDP header field
- Which event correlation approach is used to monitor the computers‘ and computer users‘ behavior to provide an alert if something anomalous is found?: Vulnerability-Based Approach, Role-Based Approach, Automated Field Correlation, Field-Ba
- What does the 63.78.199.4(161) denotes in a Cisco router log? Mar 14 22:57:53.425 EST: %SEC-6-IPACCESSLOGP: list internet-inbound denied udp 66.56.16.77(1029) -> 63.78.199.4(161), 1 packet: Destination IP address, Source IP address, Login IP addre
- In a centralized logging mechanism, what is the purpose of a local SEM server?: The local SEM simply forwards all the logs to the master SEM, The local SEM server executes the subsequent functions of processing and storing the security events for ana
- You are an information security analyst at a large pharmaceutical company. While performing a routine review of audit logs, you have noticed a significant amount of egress traffic to various IP addresses on destination port 22 during off-peak hours.
- > NMAP -sn 192.168.11.200-215 The NMAP command above performs which of the following?: A trace sweep, A port scan, A ping scan, An operating system detect
- Which command line tool is used to detect network interfaces that are running in promiscuous mode?: NET SESSIONS, Promquery, Promqry, Promdetect
- You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work throu
- Which of the following Perl scripts will help an investigator to access the executable image of a process?: Lspd.pl, Lspm.pl, Lpsi.pl, Lspi.pl
- MAC filtering is a security access control methodology, where a ___________ is assigned to each network card to determine access to the network?: 48-bit address, 16-bit address, 24-bit address, 32-bit address
- Which of the following commands shows you all of the network services running on Windows based servers?: Net start, Net use, Net config, Net Session
- Which of the following acts as a network intrusion detection system as well as network intrusion prevention system?: Kismet, Snort, Accunetix, Nikto
- Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the following icon in the checkpoint logs represent?: The firewal
- Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate. He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT. Which firewall would be most ap
- What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?: Fraggle, Smurf scan, SYN flood, Teardrop
- Which of the following tool is used to locate IP addresses?: SmartWhois, Deep Log Analyzer, Towelroot, XRY LOGICAL
- Which of the following information is displayed when Netstat is used with -ano switch?: Contents of IP routing table, Details of routing table, Ethernet statistics, Details of TCP and UDP connections
- An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?: Security event was monitored but not stopped, Malicious URL detected, An email marked as potential spam, Connection rejected
- Which of the following is a device monitoring tool?: Capsa, Regshot, Driver Detective, RAM Capturer
- Wireless access control attacks aim to penetrate a network by evading WLAN access control measures such as AP MAC filters and Wi-Fi port access controls. Which of the following wireless access control attacks allow the attacker to set up a rogue acce
- Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?: Automated Field C
- Rusty, a computer forensics apprentice, uses the command nbtstat-c while analyzing the network information in a suspect system. What information is he looking for?: Network connections, Status of the network carrier, Contents of the network routing t
- What is the CIDR from the following screenshot?: /24, /32, /16, /8
- Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test. The second utility executes five known exploits
- John and Hillary works at the same department in the company. John wants to find out Hillary‘s network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an ema
- Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detect
- Which of the following commands shows you the username and IP address used to access the system via a remote login session and the type of client from which they are accessing the system?: Net share, Net stat, Net config, Net sessions
- Where is the startup configuration located on a router?: Static RAM, BootROM, NVRAM, Dynamic RAM
- Gilchrist, an employee in a reputed organization that conducts forensic investigations, was bribed by an external party to steal an important evidence related to the ongoing case, which involved renowned cricketers. As per the deal, he had to comprom
- You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attac
- Larry is an IT consultant who works for corporations and government agencies. Larry plans on shutting down the city‘s network using BGP devices and zombies? What type of Penetration Testing is Larry planning to carry out?: Router Penetration Te
- George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recom
- Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his l
- You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy t
- You are running through a series of tests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then
- An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?: Smurf, Ping of death, Fraggle, Nmap scan
- Which of the following tool captures and allows you to interactively browse the traffic on a network: Security Task Manager, Wireshark, ThumbsDisplay, RegScanner
- As part of extracting the system data, Jenifer has used the netstat command. What does this tool reveal?: Status of users connected to the internet, Net status of computer usage, Information about network connections, Status of network hardware
- Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile
- To check for POP3 traffic using Ethereal, what port should an investigator search by?: 143, 25, 110, 125
- How many bits is Source Port Number in TCP Header packet?: 16, 32, 48, 64
- Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus. He runs the netstat command on the machine to see its current connections. In the following s
- After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by se
- What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?: digital attack, denial of se
- A company‘s policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols because the employees don‘t like changes. Yo
- Andie, a network administrator, suspects unusual network services running on a windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?: net serv, netmgr, lusrmgr, net start
- Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the given below icon in the checkpoint logs represent?: The firew
- At what layer of the OSI model do routers function on?: 4, 3, 1, 5
- After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks. What countermeasures could he take to prevent DDoS attacks?: Enable direct broadcasts, Disable direct broadcasts, Disable BGP, Enable BGP
- Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform?: Tracert, Smurf scan, Ping trace, ICMP ping sw
- Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida. They have given her permission to perform social engineering attacks on the company to see if their in-hous
- Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server. Why will Jonathan not succeed?: Only an HTTPS session can
- Why would you need to find out the gateway of a device when investigating a wireless attack?: The gateway will be the IP of the proxy server used by the attacker to launch the attack, The gateway will be the IP of the attacker computer, The gateway w
- How many possible sequence number combinations are there in TCP/IP protocol?: 1 billion, 320 billion, 4 billion, 32 million
- You are a Penetration Tester and are assigned to scan a server. You need to use a scanning technique wherein the TCP Header is split into many packets so that it becomes difficult to detect what the packets are meant for. Which of the below scanning
- Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?: network-based IDS systems (NIDS), host-based IDS systems (HIDS), anomaly detection, signature recognition
- If an attacker‘s computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response?: The zombie will not send a response, 31402, 31399, 31401
- You are working in the security Department of law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no
- As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather?: The IP address of the emp
- You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to te
- An "idle" system is also referred to as what?: PC not connected to the Internet, Zombie, PC not being used, Bot
- Study the log given below and answer the following question: Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS
- What does ICMP Type 3/Code 13 mean?: Host Unreachable, Administratively Blocked, Port Unreachable, Protocol Unreachable
- In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without s
- Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. I
- John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Fire
- What is the target host IP in the following command? c:∖>firewalk -F 80 10.10.150.1 172.16.28.95 -p UDP: 172.16.28.95, 10.10.150.1, Firewalk does not scan target hosts, This command is using FIN packets, which cannot scan target hosts
- Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security. Although they found very few issues, they were able t
- In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?: Security Administrator, Network Administrator, Director of Information Technology, Director of Administration
- You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He
- Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages. What networking protocol language should she learn that routers utilize?: ATM, UDP, BP
- Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his e
- When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time ?: on the individual computer‘s ARP cache, in the Web Server log files
- Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company‘s network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. Wh
- Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that ser
- What type of attack sends SYN requests to a target system with spoofed IP addresses: SYN flood, Ping of death, Cross site scripting, Land
- What TCP/UDP port does the toolkit program netstat use: Port 7, Port 15, Port 23, Port 69
- Company ABC has employed a firewall, IDS, Antivirus, Domain Controller, and SIEM. The company‘s domain controller goes down. From which system would you begin your investigation?: Domain Controller, Firewall, SIEM, IDS
- Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the following icon in the checkpoint logs represent?: The firewal
- The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary fol
- What is the following command trying to accomplish? C:> nmap –sU –p445 192.168.0.0/24: Verify that UDP port 445 is open for the 192.168.0.0 network, Verify that TCP port 445 is open for the 192.168.0.0 network, Verify that NETBIOS is running
- James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network. What type of DoS attack is James testing against his network?: Smurf, Trinoo, Fraggle, SYN flood
- What does the 56.58.152.114(445) denote in a Cisco router log? Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084) -> 56.58.152.114(445), 1 packet: Source IP address, None of the above, Login IP addre
- The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful. (Note: The objective of this question is to test whether the student can read basi
- Lance wants to place a honeypot on his network. Which of the following would be your recommendations?: Use a system that has a dynamic addressing on the network, Use a system that is not directly interacting with the router, Use it on a system in an
- You can use the Windows inbuilt command line utility nbtstat to view NetBIOS name table cache. Which switch with nbtstat command switch shows the NetBIOS name table cache?: Nbtstat –ano, Nbtstat –r, Nbtstat –c, Nbtstat –s
- Wireless communication is the transfer of information between two or more points that are not physically connected. Which of this wireless standard has the Bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz?: 802.11a,
-
-
-
-
- You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com.
- You are the incident response manager at a regional bank. While performing routine auditing of web application logs, you find several attempted login submissions that contain the following strings: < SCRIPT type="text/javascript" >
- You are an information security analyst for a national retain chain. The organization has a web server which provides customer reports to internal users for marketing purposes. You are analyzing IIS logs on the web server and find the following log e
- What is the default IIS log location?: SystemDrive∖inetpub∖LogFiles, %SystemDrive%∖inetpub∖logs∖LogFiles, %SystemDrive∖logs∖LogFiles, SystemDrive∖logs∖LogFiles
- During an investigation of an XSS attack, the investigator comes across the term “[a-zA-Z0-9∖%]+” in analyzed evidence details. What is the expression used for?: Checks for upper and lower-case alphanumeric string inside the tag, or its hex
- Cybercriminals sometimes use compromised computers to commit other crimes, which may involve using computers or networks to spread malware or illegal information. Which type of cybercrime stops users from using a device or network, or prevents a comp
- When Investigating a system, the forensics analyst discovers that malicious scripts were Injected Into benign and trusted websites. The attacker used a web application to send malicious code in the form of a browser side script, to a different end-us
- Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration, and critical system files, and then execute commands outside of the web server‘s root directory?: Parameter/Fo
- The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.: http://
- James, a hacker, identifies a vulnerability in a website. To exploit the vulnerability, he visits the login page and notes down the session ID that is created. He appends this session ID to the login URL and shares the link with a victim. Once the vi
- A forensic analyst has been tasked with investigating unusual network activity inside a retail company‘s network. Employees complain of not being able to access services, frequent rebooting, and anomalies in log files. The investigator requeste
- In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims. What is the difference between pharming and phishing attacks
- The following is a log file screenshot from a default installation of IIS 6.0. What time standard is used by IIS as seen in the screenshot?: UTC, GMT, TAI, UT
- Which among the following web application threats is resulted when developers expose various internal implementation objects, such as files, directories, database records, or key-through references?: Remote file inclusion, Insecure direct object refe
- Simona has written a regular expression for the detection of web application-specific attack attempt that reads as /((∖%3C)|<)((∖%2F)|/)*[a-z0-9∖%]+((∖%3E)|>)/ix. Which of the following does the part ((∖%3E)|>)
- Common Apache log format is %h %l %u %t "%r" %>s %b. What does %b represent in the log format?: The status code that the server sends back to the client, The remote log name, The size of the object that server sends to the client, The cl
- Which of the following attack uses HTML tags like <script></script>?: SQL injection, XSS attack, Spam, Phishing
- While looking through the IIS log file of a web server, you find the following entries: What is evident from this log file?: Web bugs, Cross site scripting, Hidden fields, SQL injection is possible
- What is the role of Alloc.c in Apache core?: It handles server start-ups and timeout, It takes care of all the data exchange and socket connections between the client and the server, It handles allocation of resource pools, It is useful for reading a
- William is examining a log entry that reads 192.168.0.1 - - [18/Jan/2020:12:42:29 +0000) "GET / HTTP/1.1" 200 1861. Which of the following logs does the log entry belong to?: The combined log format of Apache access log, The common log form
- Attackers exploit web applications using techniques, such as SQL injection. To avoid getting detected by the application firewall and IDS/IPS systems, attackers use various obfuscation techniques to bypass the security mechanisms. One such technique
- What will the following URL produce in an unpatched IIS Web Server? http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:∖: Directory listing of C: drive on the web server, Insert a Trojan horse into the
- Which of the following are small pieces of data sent from a website and stored on the user‘s computer by the user‘s web browser to track, validate, and maintain specific user information?: Web Browser Cache, Cookies, Temporary Files, Open
- George is a senior security analyst working for a state agency in Florida. His state‘s congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implemen
- Buffer overflow vulnerability of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the_________. There are multiple forms of buffer overflow, including a Heap Buffer Ov
- %3cscript%3ealert(”XXXXXXXX”)%3c/script%3e is a script obtained from a Cross-Site Scripting attack. What type of encoding has the attacker employed?: Double encoding, Hex encoding, Unicode, Base64
- Which of the following tools will help the investigator to analyze web server logs?: LanWhois, Deep Log Analyzer, Deep Log Monitor, XRY LOGICAL
- Where should the investigator look for the Edge browser‘s browsing records, including history, cache, and cookies?: ESE Database, Virtual Memory, Sparse files, Slack Space
- Using Internet logging software to investigate a case of malicious use of computers, the investigator comes across some entries that appear odd. From the log, the investigator can see where the person in question went on the Internet. From the log, i
- When reviewing web logs, you see an entry for resource not found in the HTTP status code filed. What is the actual error code that you would see in the log for resource not found?: 202, 404, 505, 909
- At what layer does a cross site scripting attack occur on?: Presentation, Application, Session, Data Link
- You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that rec
- Where is the default location for Apache access logs on a Linux computer?: usr/local/apache/logs/access_log, bin/local/home/apache/logs/access_log, usr/logs/access_log, logs/usr/apache/access_log
- Kyle is performing the final testing of an application he developed for the accounting department. His last round of testing is to ensure that the program is as secure as possible. Kyle runs the following command. What is he testing at this point? #i
- When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages?: Proxify.net, Dnsstuff.com, Samspade.org, Archive.org
- You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at the sessions the machine has opened with other systems?: Net sessions, Net config, Net share, Net use
- Centralized binary logging is a process in which many websites write binary and unformatted log data to a single log file. What extension should the investigator look to find its log file?: .cbl, .log, .ibl, .txt
- When examining the log files from a Windows IIS Web Server, how often is a new log file created?: the same log is used at all times, a new log file is created everyday, a new log file is created each week, new log is created each time the Web Server
- Steve received a mail that seemed to have come from her bank. The mail has instructions for Steve to click on a link and provide information to avoid the suspension of her account. The link in the mail redirected her to a form asking for details such
- Lynne receives the following email: Dear lynne@gmail.com! We are sorry to inform you that your ID has been temporarily frozen due to incorrect or missing information saved at 2016/11/10 20:40:24. You have 24 hours to fix this problem or risk to be cl
- You need to deploy a new web-based software package for your organization. The package requires three separate servers and needs to be available on the Internet. What is the recommended architecture in terms of server placement?: All three servers ne
- Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to
- You are assisting in the investigation of a possible Web Server Hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a pornographic
-
-
-
-
- The working of the Tor browser is based on which of the following concepts?: Both static and default routing, Default routing, Static routing, Onion routing
- Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. W
-
-
-
-
- While collecting active transaction logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file. Here, what does assigning NULL values imply?: Start and end points fo
- An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"," -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E" represent?: Name of the Database, Name of SQL Server, O
- Which of the following statements is true about SQL Server error logs?: SQL Server error logs record all the events that have occurred on the SQL Server and its databases, Error logs contain IP address of SQL Server client connections, Forensic inves
- What will the following command produce on a website login page? SELECT email, passwd, login_id, full_name FROM members WHERE email = ‘someone@somehwere.com‘; DROP TABLE members; --: Deletes the entire members table, Inserts the Error! Re
- Analyze the hex representation of mysql-bin.000013 file in the screenshot below. Which of the following will be an inference from this analysis?: A user with username bad_guy has logged into the WordPress web application, A WordPress user has been cr
- In a MySQL DBMS, which uses MyISAM storage engine, the databases are stored as folders in the data directory and all the database tables are stored as files inside the database folders. These files carry the name of the tables and are categorized int
- Which MySQL log file contains information on server start and stop?: Binary log, Error log file, Slow query log file, General query log file
- Which of the following files store the MySQL database data permanently, including the data that had been deleted, helping the forensic investigator in examining the case and finding the culprit?: mysql-bin, mysql-log, iblog, ibdata1
- Which of the following Data Files store log-related information that could be useful in recovering databases?: Secondary Log Files (NLF), Primary Log Files (MLF), Virtual Log Files, Transaction Log Data Files (LDF)
- Joshua is analyzing an MSSQL database for finding the attack evidence and other details, where should he look for the database logs?: Model.txt, Model.lgf, Model.ldf, Model.log
- As a part of the investigation, Caroline, a forensic expert, was assigned the task to examine the transaction logs pertaining to a database named "Transfers". She used SQL Server Management Studio to collect the active transaction log files
- Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID “WIN-ABCDE12345F.” Which of the following log file will help Shane in tracking all the client connections and activi
- Which of the following SQL Query can a forensic investigator use to retrieve the active Transaction Log files for a specific database?: DBCC DBTABLE, DBCC DBLOG, DBCC DBINFO, DBCC LOG
- Which of the following is considered as the starting point of a database and stores user data and database objects in an MS SQL server?: Ibdata1, Application data files (ADF), Transaction log data files (LDF), Primary data files (MDF)
- Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?: Data Rows store the actual data, Data Rows present Page type. Page ID, and so on, Data Row
-
-
-
-
- Robert needs to copy an OS disk snapshot of a compromised VM to a storage account in different region for further investigation. Which of the following should he use in this scenario?: Azure Portal, Azure Monitor, Azure CLI, Azure Active Directory
- An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected instance to perform further analysis and collected other data of evidentiary value. What should be their nex
- Cloud forensic investigations impose challenges related to multi-jurisdiction and multi-tenancy aspects. To have a better understanding of the roles and responsibilities between the cloud service provider (CSP) and the client, which document should t
- Frank, a cloud administrator in his company, needs to take backup of the OS disks of two Azure VMs that store business-critical data. Which type of Azure blob storage can he use for this purpose?: Page blob, Block blob, Medium blob, Append blob
- Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?: filecache.db, config.db, sigstore.db, sync_config.db
- An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?: Cloud as a subject, Cloud as a tool, Cloud as an object, Cloud as a service
- In which attack does an attacker place a virtual machine (VM) in proximity to a target cloud server, and take advantage of shared physical resources (processor cache) to extract cryptographic keys/plain text secrets to steal the victim‘s creden
- Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blo
- Which of the following files gives information about the client sync sessions in Google Drive on Windows?: sync_log.log, Sync_log.log, sync.log, Sync.log
- How will you categorize a cybercrime that took place within a CSP‘s cloud environment?: Cloud as a Subject, Cloud as a Tool, Cloud as an Audit, Cloud as an Object
- Which tool does the investigator use to extract artifacts left by GOOGLE Drive on the system?: PEBrowse Professional, RegScanner, RAM Capturer, Dependency Walker
- Robert, a cloud architect, received a huge bill from the cloud service provider, which usually doesn‘t happen. After analyzing the bill, he found that the cloud resource consumption was very high. He then examined the cloud server and discovere
- In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?: config.db, ins
- Which of the following files stores information about local Dropbox installation and account, email IDs linked with the account, current version/build for the local application, the host_id, and local path information?: host.db, sigstore.db, config.d
- In which cloud crime do attackers try to compromise the security of the cloud environment in order to steal data or inject a malware?: Cloud as an Object, Cloud as a Tool, Cloud as an Application, Cloud as a Subject
-
-
-
- How email works:
- Two categories of Email Crimes: 1. Crimes committed by sending e-mails • Spamming •Phishing •Mail bombing •Mail Storms 2. Crimes supported by e-mails •Identity Fraud •Cybersta
- Steps to Investigate Email Crimes: Step 1-Seizing the computer and email accounts Step 2-Acquiring the email data Step 3-Examining Email Messages Step 4-Retrieving email headers Step 5-Analyzing the email heade
- Seizing the computer and email accounts : All computers and email accounts suspected to be involved in the crime should be seized. The investigator can seize the email accounts by changing its existing password—either by asking the victim’s p
- Acquiring the email data : The next step is to acquire the email data for forensic analysis.The acquisition of email data depends on the following scenarios: i) The suspect has been accessing emails via desktop-based email clients such as Outlook
- Acquiring Email Data from Desktop-based Email Clients: •When an email crime is suspected to have occurred on a user’s machine using email clients, the key sources of evidence are the local folders and archived files stored by these programs t
- Local Email Files in Microsoft Outlook: •Personal Storage Table (.pst)POP accounts use the .pst file to save mailbox information on the local computer By default, .pst files are stored atC:∖Users∖%USERNAME%∖Documents∖O
-
- At a trading organization, three employees received email from a senior official at ABC bank asking them to urgently fill customer-specific details at the bank‘s website. As the organization already has a partnership with the bank, all the empl
- Which of the following statements is true regarding SMTP Server: SMTP server breaks the recipient‘s address into recipient‘s name and recipient‘s address before passing it to the DNS server, SMTP server breaks the recipient‘s
- Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following state
- POP3 is an Internet protocol used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?: 143, 25, 110, 993
- In the following email header, where did the email first originate from?: Somedomain.com, Smtp1.somedomain.com, Simon1.state.ok.gov.us, David1.state.ok.gov.us
- CAN-SPAM act requires that you:: Don‘t tell the recipients where you are located, Don‘t identify the message as an ad, Don‘t use true header information, Don‘t use deceptive subject lines
- Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender‘s address)?: Mime-Version header, Content-Transfer-Encoding header, Content-Ty
- In the following directory listing: Which file should be used to restore archived email messages for someone using Microsoft Outlook?: Outlook bak, Outlook ost, Outlook NK2, Outlook pst
- Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?: Mozilla Thunderbird, Microsoft Outlook Express, Mi
- CompanyXYZ has asked you to assess the security of their perimeter email gateway. From your office in New York, you craft a specially formatted email message and send it across the Internet to an employee of CompanyXYZ. The employee of CompanyXYZ is
- Which of the following does Microsoft Exchange E-mail Server use for collaboration of various e-mail applications?: Messaging Application Programming Interface (MAPI), Post Office Protocol version 3 (POP3), Internet Message Access Protocol (IMAP), Si
- From the following spam mail header, identify the host IP that sent this spam? From jie02@netvigator.com jie02@netvigator.com Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8
- Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of
- In which of the following attacks does an attacker duplicates the body of the SOAP message and send it to the server impersonating a legitimate user, thereby accessing the cloud resources as the legitimate user?: Meltdown Attack, Cloud Squatting, Sid
- Steve, a forensic investigator, was asked to investigate an email incident in his organization. The organization has Microsoft Exchange Server deployed for email communications. Which among the following files will Steve check to analyze message head
- After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?: PUB.STM, PRIV.STM, PUB.EDB, PRIV.EDB
- Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?: BINHEX, MIME, UUCODE, UT-16
- Which among the following files provides email header information in the Microsoft Exchange server?: PRIV.EDB, PRIV.STM, gwcheck.db, PUB.EDB
- What information do you need to recover when searching a victim‘s computer for a crime committed with specific e-mail message?: Internet service provider information, E-mail header, Username and password, Firewall log
- When investigating a potential e-mail crime, what is your first step in the investigation?: Trace the IP address to its origin, Write a report, Determine whether a crime was actually committed, Recover the evidence
- You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message?: The X509 Address, The SMT
- When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?: RIM Messaging center, Blackberry Enterprise server,
- During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message trackin
- Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?: Email spamming, P
- You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them?: allinurl:, intitle:, locate:, outlook:
- Microsoft Outlook maintains email messages in a proprietary format in what type of file?: .email, .mail, .pst, .doc
- You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printer out 27 email messages from the suspect and gives the printouts to you.
- All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?: Blackberry Message Center, Microsoft Exchange, Blackberry WAP gateway, Blackberry WEP gateway
- What binary coding is used most often for e-mail purposes?: MIME, Uuencode, IMAP, SMTP
- SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving email.SMTP can send and receive email, but email clients typically use a program with SMTP for sending email. Because SMTP is limited in its ability to queue mess
- IMAP is an Internet protocol used to retrieve emails from a mail server. Through which port does an email client connect with a IMAP server?: 80, 25, 110, 993
- Which of the following is a requirement for senders as per the CAN-SPAM act?: Senders cannot use misleading or false header information, Don‘t identify the message as an ad, Don‘t tell the recipients where you are located, Don‘t use
-
-
-
-
- An investigator is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:: Static analysis
- Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?: Compromising a legitimate site, Click-jacking, Spearphishing, Malve
- Which of the following attacks refers to unintentional download of malicious software via the Internet? Here, an attacker exploits flaws in browser software to install malware merely by the user visiting the malicious website.: Drive-by downloads, Ph
- Edgar is part of the FBI‘s forensic media and malware analysis team; he is analyzing a current malware and is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar‘s approach is to execute th
- What malware analysis operation can the investigator perform using the jv16 tool?: Files and Folder Monitor, Installation Monitor, Network Traffic Monitoring/Analysis, Registry Analysis/Monitoring
- Robert is a regional manager working in a reputed organization. One day, he suspected a malware attack after unwanted programs started popping up after logging into his computer. The network administrator was called upon to trace out any intrusion on
- Brian has the job of analyzing malware for a software security company. Brian has setup a virtual environment that includes virtual machines running various versions of OSes. Additionally, Brian has setup separated virtual networks within this enviro
- A breach resulted from a malware attack that evaded detection and compromised the machine memory without installing any software or accessing the hard drive. What technique did the adversaries use to deliver the attack?: Spyware, Fileless, Trojan, Ja
- Which program uses different techniques to conceal a malware‘s code, thereby making it difficult for security mechanisms to detect or remove it?: Dropper, Packer, Injector, Obfuscator
- Which of the following tool can reverse machine code to assembly language?: Deep Log Analyzer, IDA Pro, PEiD, RAM Capturer
- What is the purpose of using Obfuscator in malware?: Avoid detection by security mechanisms, Avoid encryption while passing through a VPN, Propagate malware to other connected devices, Execute malicious code in the system
- Dan, a hacker, built an attractive website that has buttons and images containing text on each of them saying "Click here to win an iPhone,FaceBook a free trip to New York", and so on. Over these buttons, Dan loads an iframe in such a way t
- Shane has started the static analysis of a malware and is using the tool ResourcesExtract to find more details of the malicious program. What part of the analysis is he performing?: Dynamic analysis, Identifying File Dependencies, File obfuscation St
- An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?: SysAnalyzer, Comodo Programs Manager, Dependency Walker, PEiD
- Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads it to VirusTotal in order to confirm whether the file Is malicious, provide information about Its functionality, and provide Inform
- Which of the following processes is part of the dynamic malware analysis?: Malware disassembly, Process Monitoring, File fingerprinting, Searching for the strings
- Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?: Installing malware analysis tools, Using network simulation tools, Isolating the host device, Enabling shared folders
- Select the tool appropriate for examining the dynamically linked libraries of an application or malware?: PEiD, ResourcesExtract, DependencyWalker, SysAnalyzer
- What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?: Windows Services Monitoring, System Baselining, Start-up Programs Monitoring, Host integrity Monitoring
- Which of the following statements is TRUE with respect to the Registry settings in the user start-up folder HKEY_CURRENT_USER∖Software∖Microsoft∖Windows∖CurrentVersion∖RunOnce∖.: All the values in this subkey run w
- Which of the following malware analysis involves executing the malware code to know how the code interacts with the host system and its impact on the system?: Dynamic Malware Analysis, Primary Malware Analysis, Static Malware Analysis, Secondary Malw
- Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?: Cross View-Based Detection, Heuristic/Behavior-Based Detection, Signature-Based Detection, In
- You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and e
- Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would
- Which response organization tracks hoaxes as well as viruses?: NIPC, FEDCIRC, CERT, CIAC
- Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his claim?: File fingerprinting, Identifying file obf
- Select the tool appropriate for finding the dynamically linked lists of an application or malware.: SysAnalyzer, ResourcesExtract, PEiD, Dependency Walker
- Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After prel
- Which of the following setups should a tester choose to analyze malware behavior?: A virtual system with internet connection, A normal system without internet connect, A normal system with internet connection, A virtual system with network simulation
-
-
-
-
- An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number, which provide information about the model and ori
- In Java, when multiple applications are launched, multiple Dalvik Virtual Machine instances occur that consume memory and time. To avoid that, Android implements a process that enables low memory consumption and quick start-up time. What is the p
- Which of the following methods of mobile device data acquisition captures all the data present on the device, as well as all deleted data and access to unallocated space?: Physical acquisition, Direct acquisition, Logical acquisition, Manual acquisit
- Choose the layer in iOS architecture that provides frameworks for iOS app development?: Core OS, Core services, Media services, Cocoa Touch
- What command-line tool enables forensic investigator to establish communication between an Android device and a forensic workstation in order to perform data acquisition from the device?: SDK Manager, Xcode, APK Analyzer Android, Android Debug Bridge
- What is a good security method to prevent unauthorized users from "tailgating"?: Man trap, Electronic combination locks, Pick-resistant locks, Electronic key systems
- A call detail record (CDR) provides metadata about calls made over a phone service. From the following data fields, which one is not contained in a CDR.: The language of the call, The call duration, A unique sequence number identifying the record, Ph
- Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (P
- Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?: Core Services, Media services, Cocoa Touch, Core OS
- iPhone OS stack consists of four abstraction layers. Which layer among these provides frameworks for iPhone app development?: Cocoa Touch, Media Services, Core OS, Core Services
- An investigator has found certain details after analysis of a mobile device. What can reveal the manufacturer information?: Equipment Identity Register (EIR), Electronic Serial Number (ESN), International mobile subscriber identity (IMSI), Integrated
- Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?: International Mobile Equipment Identifier (IMEI), Equipment Identity Register (EIR), International mobile s
- What must an investigator do before disconnecting an iPod from any type of computer?: Unmount the iPod, Mount the iPod, Disjoin the iPod, Join the iPod
- Which block of the ICCID (Integrated Circuit Card Identification) number on a SIM card represents the country code?: Block A, Block B, Block C, Block D
- What encryption technology is used on Blackberry devices Password Keeper?: 3DES, AES, Blowfish, RC5
- What does 254 represent in ICCID 89254021520014515744?: Issuer Identifier Number, Industry Identifier Prefix, Country Code, Individual Account Identification Number
- Ron, a computer forensics expert, is investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in ON c
- Which of the following components within the android architecture stack take care of displaying windows owned by different applications?: Resource Manager, Media Framework, Surface Manager, Application Framework
- What hashing method is used to password protect Blackberry devices?: AES, RC5, MD5, SHA-1
- During an investigation, Noel found the following SIM card from the suspect‘s mobile. What does the code 89 44 represent?: Issuer Identifier Number and TAC, Industry Identifier and Country code, Individual Account Identification Number and Coun
- For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?: Bypassing iPhone passcode, Debugging iPhone, Rooting iPhone, Copying contents of iPhone
-
-
-
-
- In which IoT attack does the attacker use multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?: Replay attack, Jamming attack, Blueborne attack, Sybil attack
- Which OWASP IoT vulnerability talks about security flaws such as lack of firmware validation, lack of secure delivery, and lack of anti-rollback mechanisms on IoT devices?: Insecure data transfer and storage, Use of insecure or outdated components, L
- Which layer in the IoT architecture is comprised of hardware parts such as sensors, RFID tags, and devices that play an important role in data collection?: Middleware layer Edge, Edge technology layer, Application layer, Access gateway layer
- Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?: Media framework, OpenGL/ES and SGL, Surface Manager, WebKit
-
-
-
-
- What operating system would respond to the following command? c:∖> nmap -sW 10.10.145.65: Windows 95, FreeBSD, Windows XP, Mac OS X
- An insider in an organization deleted all the files containing sensitive information from his Windows 7 machine on the last day of his work at the organization. These deleted files would be stored in the Recycle Bin. But, to make them untraceable, he
- What type of equipment would a forensics investigator store in a StrongHold bag?: PDA, Backup tapes, Hard drives, Wireless cards
-
-
-
-
-
-
- User Registration.....
- User Dashboard.....
-
victorylearner.com Sitemap generated on
13-06-2025 20:38:53 (GMT+5:30)