Archive for November 2017

When confronted with an e-mail server that no longer contains a log with the date information you need for your investigation, and the client has deleted the e-mail, what should you do

Naim 22:03

When confronted with an e-mail server that no longer contains a log with the date information you need for your investigation, and the client has deleted the e-mail, what should you do



a. Search available log files for any forwarded messages
b. Restore the e-mail server from a backup
c. Check the current database files for an existing copy of the email
d. Do nothing because after the file has been deleted, it can no longer be recovered.



Answer: B

Logging options on many email servers can be:

Naim 22:00

Logging options on many email servers can be:



a. Disabled by the administrator
b. Set up in a circular logging configuration
c. Configured to a specified size before being overwritten
d. All of the above



Answer: D

Phishing does which of the following

Naim 21:59

Phishing does which of the following



a. Uses DNS poisoning
b. Lures users with false promises
c. Takes people to fake websites
d. Uses DHCP




Answer: B

E-mail headers contain which of the following information (Choose all that apply.)

Naim 21:57

E-mail headers contain which of the following information (Choose all that apply.)




a. The sender and receiver e-mail address
b. An ESMTP number or reference number
c. The e-mail servers the message traveled through to reach its destination
d. The IP address of the receiving server
e. All of the above




Answer: E

When do zero day attacks occur (Choose all that apply)

Naim 21:52

When do zero day attacks occur (Choose all that apply)




a. On the day the application or OS is released
b. Before a patch is available
c. Before the vendor is aware of the vulnerability
d. On the day the patch is created



Answer: B

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.

Naim 21:48

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.




a. Open Hash Database
b. HashKeeper Online
c. National Hashed Software Referenced.
d. National Software Reference Library





Answer: D

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.

Naim 21:48

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.




a. DeepScan Filter
b. Unknown File Filter (UFF)
c. Known File Filter (KFF)
d. FTK Hash Imager




Answer: C

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented

Naim 21:47

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented



a. Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
b. Start the suspect's computer and begin collecting evidence.
c. The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
d. Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.





Answer: C

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Naim 21:47

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.



a. key vault
b. key escrow
c. bump key
d. master key




Answer: B

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.

Naim 21:44

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.




a. litigation
b. scope creep
c. criminal charges
d. violations



Answer: B

You're using Disk Manager to view primary and extended partitions on a subjects drive. The program reports the extended partitions total size as larger than the sum of the sizes of logical partitions in this extended partition. What might you infer from this information.

Naim 21:40

You're using Disk Manager to view primary and extended partitions on a subjects drive. The program reports the extended partitions total size as larger than the sum of the sizes of logical partitions in this extended partition. What might you infer from this information.




Answer: There's a hidden partition

Suppose you're investigating an e-mail harassment case. Generally, is collecting evidence for this type of case easier for an internal corporate investigation or a criminal investigation

Naim 21:33

Suppose you're investigating an e-mail harassment case. Generally, is collecting evidence for this type of case easier for an internal corporate investigation or a criminal investigation



a. Criminal investigation because subpoenas can be issued to acquire any needed evidence quickly.
b. Criminal investigation because law enforcement agencies have more resources at their disposal
c. Internal corporate investigation because corporate investigators typically have ready access to company records.
d. Internal corporate investigation because ISPs almost always turn over email and access logs when requested by a large corporation




Answer: C

The Known File Filter (KFF) can be used for which of the following purposes (Choose all that apply)

Naim 21:32

The Known File Filter (KFF) can be used for which of the following purposes (Choose all that apply)



a. Filter known program file from view
b. Calculate hash values of image files
c. Compare hash values of known files with evidence files
d. Filter out evidence that doesn't relate to our investigation
a. Filter known program file from view




Answer: D
Subscribe to: Posts (Atom)