CHFIv9
• SAM database file
The information about the system users is stored in which file?
• Prefetching is disabled
The value 0 associated with the registry entry EnablePrefetcher tells the system to use which prefetch?
• Boot prefetching is enabled
What prefetch does value 2 from the registry entry EnablePrefetcher tell the system to use?
• Kernel stage
What stage of the Linux boot process includes the task of loading the virtual root file system created by the initrd image and executes the Linuxrc program?
• BIOS stage
What stage of the Linux boot process initializes the system hardware and retrieves the information stored in the CMOS (Complementary Metal-Oxide Semiconductor) chip?
• Drive:\RECYCLED
Where are deleted items stored on Windows 98 and earlier versions of Windows?
• Drive:\RECYCLER
Where are deleted items stored on the Windows 2000, XP, and NT versions of Windows?
• Logical block 2
Which HFS volume structure contains the Master Directory Block (MDB), which defines a wide variety of data about the volume itself?
• LBA 34
Which LBA will be the first usable sector?
• RFC 5322
Which RFC defines normal email communication?
• Get-boot sector
Which cmdlet can investigators use in Windows PowerShell to parse GPTs of both types of hard disks including the ones formatted with either UEFI or MBR?
• istat
Which command from The Sleuth Kit (TSK) displays details of a metadata structure such as inode?
• Kernel mode
Which component of the NTFS architecture is the processing mode that permits the executable code to have direct access to all the system components?
• Ntldlr.dll
Which component of the NTFS architecture reads the contents of the Boot.ini file?
• second
Which field is the standard identifier set to CD001 for a CD-ROM compliant to the ISO 9660 standard?
• Number 3
Which field type refers to the volume descriptor as a partition descriptor?
• Number 1
Which field type refers to the volume descriptor as a primary?
• Ext3
Which file system used in Linux was developed by Stephen Tweedie in 2001 as a journaling file system that improves reliability of the system?
• Mount count
Which information held by the superblock allows the system to determine if the file system needs to be fully checked and increments each time the system places access to the file system?
• Mode
Which inode field determines what the inode describes and the permissions that users have to it?
• Log generation
Which is NOT a log management system function?
• DXE (Driver Execution Environment) Phase
Which item describes the UEFI boot process phase in which the majority of the initialization occurs?
• SEC phase
Which item describes the following UEFI boot process phase? The phase of EFI consisting of initialization code the system executes after powering the system on, manages platform reset events, and sets the system state.
• The primary volume descriptor
Which of the following ISO 9660 compliant portion of a compact disc describes the location of the contiguous root directory similar to the super block of the UNIX file system?
• GNU parted
Which of the following basic partitioning tools displays details about GPT partition tables in Linux OS?
• Quantum storage devices
Which of the following is NOT a digital data storage type?
• Recovering files from a network drive
Which of the following is NOT a feature of the Recover My Files tool?
• Non-volatile memory
Which of the following is NOT an advantage of SSDs over HDDs?
• Smaller evidence in size
Which of the following is NOT an element of cyber crime?
• BIOS parameter block
Which of the following is a data structure situated at sector 1 in the volume boot record of a hard disk to explain the physical layout of a disk volume?
• OFFSET
Which of the following is either the start of a file or the start of a memory address, where its value is added to a base address to derive the actual address?
• BDS phase
Which of the following is one of the five UEFI boot process phases?
• PEI phase
Which of the following is one of the five UEFI boot process phases?
• 32,768
Which of the following is the correct number of bytes reserved at the beginning of a CD-ROM for booting a computer?
• Incident handlers
Which of the following stakeholders is the first responder for all the security events or occurrences taking place on a cloud?
• Improper Error Handling
Which web application threat arises when a web application is unable to handle technical issues properly and the website returns information, such as database dumps, stack traces, and codes?
• Insecured storage
Which web application threat occurs when an attacker is allowed to gain access as a legitimate user to a web application or data such as account records, credit card numbers, passwords, or other authenticated information?
• Broken access control
Which web application threat occurs when attackers identify a flaw, bypass authentication, and compromise the network?
• Unvalidated input
Which web application threat occurs when attackers tamper with the URL, HTTP requests, headers, hidden fields, form fields, or query strings?
• 64 bytes
How large is the partition table structure that stores information about the partitions present on the hard disk?
• Avoid leaning and develop self-confidence
How should expert witnesses conduct themselves while presenting testimony to any court or attorney?
LBA2
In the GUID Partition table, which Logical Block Address contains the Partition Entry Array?
• Cylinder groups
What UFS file system part comprises a collection, including a header with statistics and free lists, a number of inodes containing file attributes, and a number of data blocks?
• Boot block
What UFS file system part is composed of a few blocks in the partition reserved at the beginning?
• PaaS
What cloud service offers a platform for developing applications and services?
• FAT area
What component of a typical FAT32 file system contains duplicates of the File Allocation Table to help the system check for empty or idle spaces and detailed information about clusters and their contents including files and directories?
• GIF
What is a CompuServe-generated format from 1987 that uses lossless data compression techniques, maintaining the visual quality of the image?
• Malvertising
What is a common technique used to distribute malware on the web by embedding malware-laden advertisements in authentic online advertising channels to spread onto systems of unsuspecting users?
• Blackhat SEO
What is a common technique used to distribute malware on the web with tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to get a higher search engine ranking for malware pages?
• Autopsy
What is a digital forensics platform and graphical interface to TSK and other digital forensics tools?
• Hamming codes
What is a form of error correcting code (ECC) used to help calculate the redundant bits in a RAID 2?
• ASCII
What is a machine-readable language used in major digital operations, such as sending and receiving emails?
• JPEG
What is a method of lossy compression for digital images that allows users to adjust the degree of compression?
• GUID Partition Table
What is a standard partitioning scheme for hard disks and part of the Unified Extensible Firmware Interface?
• Data loss
What is considered the biggest threat to mobile devices?
• Raid level 1
What is the RAID level that executes mirroring as it duplicates drive data onto multiple drives?
• SOX
What is the act passed by U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?
-1
What is the last addressable block where negative addressing of the logical blocks starts from the end of the volume in GPT?
• 34 TB
What is the maximum file system size in ext3?
• 1 EiB
What is the maximum file system size in ext4?
• To educate the public and court
What is the role of an expert witness?
• Client layer
What layer of web application architecture includes all the web appliances, such as smartphones and PCs, where interaction with a web application deployed on a web server occurs?
• Business Layer
What layer of web application architecture is responsible for the core functioning of the system and includes logic and applications, such as .NET, used by developers to build websites according to client requirements?