Free certification test prep

NO.216 When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

NO.217 What feature of Windows is the following command trying to utilize?

NO.218 In Steganalysis, which of the following describes a Known-stego attack?

NO.219 You are a computer forensics investigator working with local police department and you are called to assist in an investigation of threatening emails. The complainant has printer out 27 email messages from the suspect and gives the printouts to you. You inform her that you will need to examine her computer because you need access to the _________________________ in order to track the emails back to the suspect.

NO.220 Where are files temporarily written in Unix when printing?

NO.221 Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.

He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

NO.222 What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

NO.223 What type of equipment would a forensics investigator store in a StrongHold bag?

NO.224 What is the slave device connected to the secondary IDE controller on a Linux OS referred to?

NO.225 Why would you need to find out the gateway of a device when investigating a wireless attack?

NO.226 BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

NO.227 What does the 63.78.199.4(161) denotes in a Cisco router log?
Mar 14 22:57:53.425 EST: %SEC-6-IPACCESSLOGP: list internet-inbound denied udp 66.56.16.77(1029) ->
63.78.199.4(161), 1 packet

NO.228 Chris has been called upon to investigate a hacking incident reported by one of his clients.
The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?

NO.229 A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.

NO.230 Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully.
Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices. How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

NO.231 Which of the following Event Correlation Approach checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

NO.232 What is the investigator trying to analyze if the system gives the following image as output?

NO.233 Amelia has got an email from a well-reputed company stating in the subject line that she has won a prize money, whereas the email body says that she has to pay a certain amount for being eligible for the contest.
Which of the following acts does the email breach?

NO.234 Which MySQL log file contains information on server start and stop?

NO.235 Which of the following Registry components include offsets to other cells as well as the LastWrite time for the key?

NO.236 Which of the following processes is part of the dynamic malware analysis?