312-49v10
Free trial
Verified
Question 1
When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?
- A: Title 18, Section 1030
- B: Title 18, Section 2703(d)
- C: Title 18, Section Chapter 90
- D: Title 18, Section 2703(f)
Question 2
You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data.
What method would be most efficient for you to acquire digital evidence from this network?
- A: create a compressed copy of the file with DoubleSpace
- B: create a sparse data copy of a folder or file
- C: make a bit-stream disk-to-image file
- D: make a bit-stream disk-to-disk file
Question 3
You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?
- A: the attorney-work-product rule
- B: Good manners
- C: Trade secrets
- D: ISO 17799
Question 4
What is the investigator trying to analyze if the system gives the following image as output?
- A: All the logon sessions
- B: Currently active logon sessions
- C: Inactive logon sessions
- D: Details of users who can logon
Question 5
This organization maintains a database of hash signatures for known software.
- A: International Standards Organization
- B: Institute of Electrical and Electronics Engineers
- C: National Software Reference Library
- D: American National standards Institute
Question 6
The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.
- A: Locard Exchange Principle
- B: Clark Standard
- C: Kelly Policy
- D: Silver-Platter Doctrine
Question 7
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?
- A: Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned
- B: Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment
- C: Inform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy
- D: Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies
Question 8
You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?
- A: trademark law
- B: copyright law
- C: printright law
- D: brandmark law
Question 9
To preserve digital evidence, an investigator should ____________________.
- A: Make two copies of each evidence item using a single imaging tool
- B: Make a single copy of each evidence item using an approved imaging tool
- C: Make two copies of each evidence item using different imaging tools
- D: Only store the original evidence item
Question 10
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
- A: The manufacturer of the system compromised
- B: The logic, formatting and elegance of the code used in the attack
- C: The nature of the attack
- D: The vulnerability exploited in the incident
Question 11
Printing under a Windows Computer normally requires which one of the following files types to be created?
- A: EME
- B: MEM
- C: EMF
- D: CME
Question 12
An Expert witness give an opinion if:
- A: The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
- B: To define the issues of the case for determination by the finder of fact
- C: To stimulate discussion between the consulting expert and the expert witness
- D: To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case
Question 13
You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case.
How would you permanently erase the data on the hard disk?
- A: Throw the hard disk into the fire
- B: Run the powerful magnets over the hard disk
- C: Format the hard disk multiple times using a low level disk utility
- D: Overwrite the contents of the hard disk with Junk data
Question 14
What file structure database would you expect to find on floppy disks?
- A: NTFS
- B: FAT32
- C: FAT16
- D: FAT12
Question 15
A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.
- A: Mere Suspicion
- B: A preponderance of the evidence
- C: Probable cause
- D: Beyond a reasonable doubt
Question 16
You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents.
Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?
- A: Stringsearch
- B: grep
- C: dir
- D: vim
Question 17
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider
(ISP). You contact ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?
- A: The ISP can investigate anyone using their service and can provide you with assistance
- B: The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant
- C: The ISP can't conduct any type of investigations on anyone and therefore can't assist you
- D: ISP's never maintain log files so they would be of no use to your investigation
Question 18
The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be?
- A: Any data not yet flushed to the system will be lost
- B: All running processes will be lost
- C: The /tmp directory will be flushed
- D: Power interruption will corrupt the pagefile
Question 19
Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives. One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:
- A: HKEY_LOCAL_MACHINE\hardware\windows\start
- B: HKEY_LOCAL_USERS\Software\Microsoft\old\Version\Load
- C: HKEY_CURRENT_USER\Microsoft\Default
- D: HKEY_LOCAL_MACHINE\Software\Microsoft\CurrentVersion\Run
Question 20
Which of the following file system is used by Mac OS X?
- A: EFS
- B: HFS+
- C: EXT2
- D: NFS
Question 21
When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?
- A: Passive IDS
- B: Active IDS
- C: Progressive IDS
- D: NIPS
Question 22
Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here?
- A: Send DOS commands to crash the DNS servers
- B: Perform DNS poisoning
- C: Perform a zone transfer
- D: Enumerate all the users in the domain
Question 23
What will the following command produce on a website login page? SELECT email, passwd, login_id, full_name FROM members WHERE email =
'someone@somehwere.com'; DROP TABLE members; --'
- A: Deletes the entire members table
- B: Inserts the Error! Reference source not found.email address into the members table
- C: Retrieves the password for the first user in the members table
- D: This command will not produce anything since the syntax is incorrect
Question 24
You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work through Firewalls? (Choose two.)
- A: 162
- B: 161
- C: 163
- D: 160
Question 25
You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test."
What is the result of this test?
- A: Your website is vulnerable to CSS
- B: Your website is not vulnerable
- C: Your website is vulnerable to SQL injection
- D: Your website is vulnerable to web bugs
Free preview mode
Enjoy the free questions and consider upgrading to gain full access!