________ is a specialized viewer software program
a. fastview
b. irfanview
c. thumbsloader
d. absee
Answer: B
________ is a specialized viewer software program
a. fastview
b. irfanview
c. thumbsloader
d. absee
a. fastview
b. irfanview
c. thumbsloader
d. absee
Which option below is not one of the recommended practices for maintaining a keyed padlock?
Which option below is not one of the recommended practices for maintaining a keyed padlock?
a. appoint a key custodian
b. take inventory of all keys when the custodian changes
c. use a master key
d. change locks and keys annually
Answer: C
Which option below is not a recommendation for securing storage containers?
Which option below is not a recommendation for securing storage containers?
a. the container should be located in a restricted area
b. only authorized access should be allowed, and it should be kept to a minimum
c, evidence containers should remain locked when they aren't under direct supervision
d. rooms with evidence containers should have a secured wireless network
Answer: D
Which tool below is not recommended for use in a forensics lab?
Which tool below is not recommended for use in a forensics lab?
a. 2.5-inch adapters for drives
b. firewire and usb adapters
c. SCSI card
d. degusser
Answer: D
In order to qualify for the certified computer crime investigator, basic level certification, candidates must provide documentation of at least ________ cases in which they participated.
In order to qualify for the certified computer crime investigator, basic level certification, candidates must provide documentation of at least ________ cases in which they participated.
a. 5
b. 10
c. 15
d. 20
Answer: B
In order to qualify for the advanced certified computer forensic technician certification, a candidate must have ________ years of hands-on experience in computer forensics investigations.
In order to qualify for the advanced certified computer forensic technician certification, a candidate must have ________ years of hands-on experience in computer forensics investigations.
a. two
b. three
c. five
d. six
Answer: C
A TEMPEST facility is designed to accomplish which of the following goals?
A TEMPEST facility is designed to accomplish which of the following goals?
a. prevent data loss by maintaining consistent backups
b. shield sensitive computing systems and prevent electronic eavesdropping of computer emission
c. ensure network security from the internet using comprehensive security software
d. protect the integrity of data
Answer: B
How often should hardware be replace within a forensics lab?
How often should hardware be replace within a forensics lab?
a. every 6 to 12 months
b. every 12 to 18 months
c. every 18 to 24 months
d. every 24 to 30 months
Answer: B
_______ can be used to restore backup files directly to a workstation.
_______ can be used to restore backup files directly to a workstation.
a. belarc advisor
b. Norton ghost
c. prodiscover
d. photorec
Answer: B
What percentage of consumers utilize intel and AMD PCs?
What percentage of consumers utilize intel and AMD PCs?
a. 60
b. 70
c. 80
d. 90
Answer: D
________ is responsible for creating an monitoring lab policies for staff, and provides a safe, and provides a safe and secure workplace for staff and evidence.
________ is responsible for creating an monitoring lab policies for staff, and provides a safe, and provides a safe and secure workplace for staff and evidence.
a. the lab manager
b. the lab investigator
c. the lab secretary
d. the lab steward
Answer: A
Which IDO standard below is followed by the ASCLD?
Which IDO standard below is followed by the ASCLD?
a. 17025:2005
b. 17026:2007
c. 12075:2007
d. 12076:2005
Answer: A
Which file system below is utilized by the xbox gaming system?
Which file system below is utilized by the xbox gaming system?
a. NTFS
b. ReFS
c. EXT
d. FATX
Answer: D
In order to qualify for the certified computer forensic technician, basic level certification, how many hours of computer forensics training are required?
In order to qualify for the certified computer forensic technician, basic level certification, how many hours of computer forensics training are required?
a. 10
b. 20
c. 30
d. 40
Answer: D
________ describes the characteristics of a safe storage container.
________ describes the characteristics of a safe storage container.
a. ISO2960
b. NISPOM
c. SSO 990
d. STORSEC
Answer: B
Which operating system listed below is not a distribution of the Linux OS?
Which operating system listed below is not a distribution of the Linux OS?
a. minix
b. debian
c. slackwar
d. fedora
Answer: A
Which of the following scenarios should be covered in a disaster recovery plan?
Which of the following scenarios should be covered in a disaster recovery plan?
a. damage caused by lightning strikes
b. damage caused by flood
c. damage caused by a virus contamination
d. all of the above
Answer: D
How long are computing components designed to last in a normal business environment?
How long are computing components designed to last in a normal business environment?
a. 12 to 16 months
b. 14 to 26 months
c. 18 to 36 months
d. 6 to 90 months
Answer: C
What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?
What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?
a. certified computer crime investigator
b. certified forensic computer examiner
c. certified cyber forensics professional
d. encase certified examiner
Answer: C
Candidates who complete the ISCIS test successfully are designated as a ________
Candidates who complete the ISCIS test successfully are designated as a ________
a. certified forensic computer examiner (CFCE)
b. certified forensics investigator (CFI)
c. Certified investigative forensics examiner (CIFE)
d. certified investigative examiner (CIE)
Answer: A
Because they are outdated, ribbon cables should not be considered for use within a forensics lab.
Because they are outdated, ribbon cables should not be considered for use within a forensics lab.
Answer: False
A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.
A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.
Answer: True
The recording of all updates made to a workstation or machine is referred to as configuration management.
The recording of all updates made to a workstation or machine is referred to as configuration management.
Answer: True
The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. department of defense.
The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. department of defense.
Answer: False
Linus live CDs and WinFe disks do not automatically mount hard drives, but can b used to view file systems.
Linus live CDs and WinFe disks do not automatically mount hard drives, but can b used to view file systems.
Answer: True
After the evidence has been presented in a trial by jury, the jury must deliver a(n) ________
After the evidence has been presented in a trial by jury, the jury must deliver a(n) ________
a. exhibit
b. affidavit
c. allegation
d. verdict
Answer: D
________ must be included in an affidavit to support an allegation in order to justify a warrant.
________ must be included in an affidavit to support an allegation in order to justify a warrant.
a. verdicts
b. witnesses
c. exhibits
d. subpoenas
Answer: C
The term ________ describes a database containing information records about crimes that have been committed previously by a criminal.
The term ________ describes a database containing information records about crimes that have been committed previously by a criminal.
a. police ledger
b. police blotter
c. police blogger
d. police recorder
Answer: B
What tool, currently maintained by the IRS criminal investigation division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?
What tool, currently maintained by the IRS criminal investigation division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?
a. AccessData forensic toolkit
b. DeepScan
c. ILook
d. Photorect
Answer: C
An evidence custody form does not usually contain ________
An evidence custody form does not usually contain ________
a. the nature of the case
b. a description of evidence
c. vendor names for computer components
d. a witness list
Answer: D
A chain-of-evidence form, which is used to document what has and had not been done with the original evidence and forensic copies of the evidence, is also known as a(n) ________
A chain-of-evidence form, which is used to document what has and had not been done with the original evidence and forensic copies of the evidence, is also known as a(n) ________
a. single-evidence form
b. multi-evidence form
c. evidence custody form
d. evidence tracking form
Answer: C
Which option below is not a standard systems analysis step?
Which option below is not a standard systems analysis step?
a. determine a preliminary design or approach to the case.
b. obtain and copy an evidence drive
c. share evidence with experts outside of the investigation
d. mitigate or minimize the risks
Answer: C
The sale of sensitive or confidential company information to a competitor is known as ________
The sale of sensitive or confidential company information to a competitor is known as ________
a. industrial sabotage
b. industrial espionage
c. industrial collusion
d. industrial betrayal
Answer: B
The ________ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.
The ________ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.
a. digital evidence recorder
b. digital evidence specialist
c. digital evidence analyst
d. digital evidence examiner
Answer: B
After a judge approves and signs a search warrant, the ________ is responsible for the collection of evidence as defined by the warrant.
After a judge approves and signs a search warrant, the ________ is responsible for the collection of evidence as defined by the warrant.
a. digital evidence recorder
b. digital evidence specialist
c. digital evidence first responder
d. digital evidence scene investigator
Answer: C
The ________ is not one of the three stages of a typical criminal case.
The ________ is not one of the three stages of a typical criminal case.
a. complaint
b. investigation
c. civil suit
d. prosecution
Answer: C
In what year was the computer fraud and abuse act passed?
In what year was the computer fraud and abuse act passed?
a. 1976
b. 1980
c. 1986
d. 1996
Answer: C
________ is not one of the functions of the investigations triad.
________ is not one of the functions of the investigations triad.
a. digital investigations
b. data recovery
c. vulnerability threat assessment and risk management
d. network intrusion detection and incident response
Answer: B
________ describes an accusation of fact that a crime has been committed.
________ describes an accusation of fact that a crime has been committed.
a. attrition
b. attribution
c. allegation
d. assignment
Answer: C
If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) ________
If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) ________
a. exhibit
b. verdict
c. affidavit
d. memo
Answer: C
Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as ________
Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as ________
a. repeatable findings
b. reloadable steps
c. verifiable reporting
d. evidence reporting
Answer: A
________ is not recommended for a digital forensics workstation.
________ is not recommended for a digital forensics workstation.
a. a text editor tool
b. a write-blocker device
c. an SCSI card
d. remote access software
Answer: D
Which Microsoft OS below is the least intrusive to disks in terms of changing data?
Which Microsoft OS below is the least intrusive to disks in terms of changing data?
a. windows 95
b. windows xp
c. windows 7
d. ms-dos 6.22
Answer: D
Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?
Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?
a. first amendment
b. second amendment
c. fourth amendment
d. fifth amendment
Answer: C
Signed into law in 1973, the _____ was/were created to ensure consistency in federal proceedings.
Signed into law in 1973, the _____ was/were created to ensure consistency in federal proceedings.
a. federal proceeding law
b. federal rules of evidence
c. federal consistency standards
d. federal proceedings rules
Answer: B.
If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.
If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.
Answer: True.
Most digital investigations in the private sector involve misuse of computing assets.
Most digital investigations in the private sector involve misuse of computing assets.
Answer: True.
User groups for a specific type of system can be very useful in a forensics investigation.
User groups for a specific type of system can be very useful in a forensics investigation.
Answer: True.
All suspected industrial espionage cases should be treated as civil case investigations.
All suspected industrial espionage cases should be treated as civil case investigations.
Answer: False.
According to the national institute of standards and technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.
According to the national institute of standards and technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.
Answer: False.
Subscribe to:
Posts (Atom)