QuestionQ1
Digital Forensics Concepts and ApplicationYou have been asked to search for Alternate Data Streams on the following Windows partitions: 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total gigabytes and partitions do you need to search?
- A 4GBs of data, the NTFS partition only.
- B 12GBs of data, the FAT16, FAT32, and NTFS partitions.
- C 6GBs of data, the FAT32 partition only.
- D 10GBs of data, both the FAT32 and NTFS partitions.
QuestionQ2
Defensive Infrastructure and TacticsWhich tool is best suited to remove the unwanted add-on shown below?
- A ProcessExplorer
- B Taskkill
- C Paros
- D Hijack This
Community Discussion
QuestionQ3
Digital Forensics Concepts and ApplicationAt the beginning of an investigation on a Windows system, the lead handler runs the following command after inserting a USB drive. What is this command intended to do?
C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
- A To create a file on the USB drive that contains a listing of the C: drive
- B To show hidden and archived files on the C: drive and copy them to the USB drive
- C To copy a forensic image of the local C: drive onto the USB drive
- D To compare a list of known good hashes on the USB drive to files on the local C: drive
Community Discussion
QuestionQ4
Intrusion Detection and Packet AnalysisAn analyst will capture traffic from an air-gapped network that does not use DNS. The analyst needs to identify unencrypted Syslog data in transit. Which of the following is the most efficient for this purpose?
- A tcpdump –s0 –i eth0 port 514
- B tcpdump –nnvvX –i eth0 port 6514
- C tcpdump –nX –i eth0 port 514
- D tcpdump –vv –i eth0 port 6514
Community Discussion
QuestionQ5
Penetration Testing ConceptsWhich of the following is most accurately defined as “anything that could potentially target known or existing vulnerabilities in a system?”
- A Vector
- B Gateway
- C Threat
- D Exploit
Community Discussion