Quiz
Midterm Study 2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (125)
1The first 3 bytes of an XIF file are exactly the same as a TIF file.
- ATrue
- BFalse
2Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.
- ATrue
- BFalse
3Most digital cameras use the bitmap format to store photos.
- ATrue
- BFalse
4When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.
- ATrue
- BFalse
5Each graphics file type has a unique header value.
- ATrue
- BFalse
6How many bits are required to create a pixel capable of displaying 65,536 different colors?
- A8
- B16
- C32
- D64
7Which of the following is not considered to be a non-standard graphics file format?
- A.dxf
- B.tga
- C.rtl
- D.psd
8All TIF files start at offset 0 with what 6 hexadecimal characters?
- A2A 49 48
- BFF 26 9B
- C49 49 2A
- DAC 49 2A
9What kind of graphics file combines bitmap and vector graphics types?
- Ametafile
- Bbitmap
- Cjpeg
- Dtif
10The process of converting raw picture data to another format is called _________________.
- Asplicing
- Bcarving
- Cdemosaicing
- Dvector quantization
11What format was developed as a standard for storing metadata in image files?
- Ajpeg
- Btif
- Cexif
- Dbitmap
12Which of the following formats is not considered to be a standard graphics file format?
- Agif
- Bjpeg
- Cdxf
- Dtga
13Select below the utility that is not a lossless compression utility:
- APKZip
- BWinZip
- CStuffIt
- DLzip
14In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.
- AHuffman
- BLempel-Ziv-Welch (LZW)
- CVector Quantization
- DAdaptive Quantization
15What file type starts at offset 0 with a hexidecimal value of FFD8?
- Atiff
- Bjpeg
- Cxdg
- Dbmp
16How many different colors can be displayed by a 24 bit colored pixel?
- A256
- B65,536
- C16,777,216
- D4,294,967,296
17The _____________ format is a proprietary format used by Adobe Photoshop.
- A.tga
- B.fh11
- C.svg
- D.psd
18For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
- AFFE0
- BFFE1
- CFFD8
- DFFD9
19Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.
- Araster file format
- Bbitmap file format
- Cjpeg file format
- Draw file format
20The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.
- Alossy
- Blossless
- Cvector quantization
- Dadaptive
21For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.
- AFFE0
- BFFD8
- CFFD9
- DFFFF
22Which graphics file format below is rarely compressed?
- AGIF
- BJPEG
- CBMP
- DNone of the above
23When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?
- Amajor significant bit (MSB)
- Bleast significant bit (LSB)
- Cmost significant bit (MSB)
- Dleading significant bit (LSB)
24What act defines precisely how copyright laws pertain to graphics?
- A1988 Image Ownership Act
- B1976 Copyright Act
- C1923 Patented Image Act
- D1976 Computer Fraud and Abuse Act
25Which of the following is not a type of graphic file that is created by a graphics program?
- Abitmap images
- Bvector graphics
- Cmetafile graphics
- Draster graphics
26Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.
- ATrue
- BFalse
27One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.
- ATrue
- BFalse
28The advantage of recording hash values is that you can determine whether data has changed.
- ATrue
- BFalse
29In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.
- ATrue
- BFalse
30Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing specific files or sectors.
- ATrue
- BFalse
31What format below is used for VMware images?
- A.vhd
- B.vmdk
- C.s01
- D.aff
32In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?
- ANTFS
- BFAT
- CHFSX
- DExt3fs
33Which password recovery method uses every possible letter, number, and character found on a keyboard?
- Arainbow table
- Bdictionary attack
- Chybrid attack
- Dbrute-force attack
34The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.
- Alitigation
- Bscope creep
- Ccriminal charges
- Dviolations
35Which of the following file systems can't be analyzed by OSForensics?
- AFAT12
- BExt2fs
- CHFS+
- DXFS
36In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.
- Aformat
- Bfdisk
- Cgrub
- Ddiskpart
37Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:
- ALast Bit
- BAccessData PRTK
- COSForensics
- DPassware
38Within Windows Vista and later, partition gaps are _____________ bytes in length.
- A64
- B128
- C256
- D512
39Which option below is not a disk management tool?
- APartition Magic
- BPartition Master
- CGRUB
- DHexEdit
40Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.
- Ahashing
- Bbit-shifting
- Cregistry edits
- Dslack space
41A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.
- Acompiler
- Bshifter
- Cmacro
- Dscript
42What letter should be typed into DiskEdit in order to mark a good sector as bad?
- AM
- BB
- CT
- DD
43Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.
- Akey vault
- Bkey escrow
- Cbump key
- Dmaster key
44What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?
- Asalted passwords
- Bscrambled passwords
- Cindexed passwords
- Dmaster passwords
45When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?
- AInventory and documentation information should be stored on a drive and then the drive should be reformatted.
- BStart the suspect's computer and begin collecting evidence.
- CThe hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
- DConnect the suspect's computer to the local network so that up to date forensics utilities can be utilized.
46In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.
- Akeygrabber
- Bkeylogger
- Cpacket capture
- Dprotocol analyzer
47The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.
- ADeepScan Filter
- BUnknown File Filter (UFF)
- CKnown File Filter (KFF)
- DFTK Hash Imager
48The term for detecting and analyzing steganography files is _________________.
- Acarving
- Bsteganology
- Csteganalysis
- Dsteganomics
49A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.
- Afdisk
- Bformat
- Cdd
- DDiskEdit
50The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.
- AOpen Hash Database
- BHashKeeper Online
- CNational Hashed Software Reference
- DNational Software Reference Library
51Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.
- ATrue
- BFalse
52Forensics tools can't directly mount VMs as external drives.
- ATrue
- BFalse
53The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.
- ATrue
- BFalse
54The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.
- ATrue
- BFalse
55The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.
- ATrue
- BFalse
56What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?
- AKVM
- BParallels
- CMicrosoft Virtual PC
- DVirtualBox
57The __________ disk image file format is associated with the VirtualBox hypervisor.
- A.vmdk
- B.hda
- C.vhd
- D.vdi
58What Windows Registry key contains associations for file extensions?
- AHKEY_CLASSES_ROOT
- BHKEY_USERS
- CHKEY_LOCAL_MACHINE
- DHKEY_CURRENT_CONFIG
59In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters
- A2
- B4
- C6
- D8
60The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?
- A12.04
- B13.11
- C14.04
- D14.11
61Select below the option that is not a common type 1 hypervisor:
- AVMware vSphere
- BMicrosoft Hyper-V
- CCitirix XenServer
- DOracle VirtualBox
62The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?
- APeople
- BTechnology
- COperations
- DManagement
63The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.
- Anetstat
- Bls
- Cifconfig
- Dtcpdump
64Select below the program within the PsTools suite that allows you to run processes remotely:
- APsService
- BPsPasswd
- CPsRemote
- DPsExec
65The tcpdump and Wireshark utilities both use what well known packet capture format?
- ANetcap
- BPcap
- CPacketd
- DRAW
66The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.
- ATcpdstat
- BTcpslice
- CNgrep
- Dtcpdump
67The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.
- AKali Linux
- BUbuntu
- COSForensics
- DSleuth Kit
68In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?
- AShow-NetworkAdapters
- BQuery-ipconfig
- CGet-VMNetworkAdapter
- DDump-Netconfig
69What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?
- A.nvram
- B.vmem
- C.vmpage
- D.vmx
70What processor instruction set is required in order to utilize virtualization software?
- AAMD-VT
- BIntel VirtualBit
- CVirtual Machine Extensions (VMX)
- DVirtual Hardware Extensions (VHX)
71Select the file below that is used in VirtualBox to create a virtual machine:
- A.vdi
- B.vbox
- C.r0
- D.ova
72The __________________ is the version of Pcap available for Linux based operating systems.
- AWinpcap
- BLibpcap
- CTcpcap
- DNetcap
73What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?
- Atcpdump
- BArgus
- CNgrep
- DTcpslice
74At what layers of the OSI model do most packet analyzers function?
- ALayer 1 or 2
- BLayer 2 or 3
- CLayer 3 or 4
- DLayer 4 or 5
75In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.
- Asmurf
- BSYN flood
- Cspoof
- Dghost
76The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.
- ATrue
- BFalse
77The Pagefile.sys file on a computer can contain message fragments from instant messaging applications.
- ATrue
- BFalse
78In an e-mail address, everything before the @ symbol represents the domain name.
- ATrue
- BFalse
79Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.
- ATrue
- BFalse
80An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.
- ATrue
- BFalse
81What command below could be used on a UNIX system to help locate log directories?
- Ashow log
- Bdetail
- Csearch
- Dfind
82The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.
- Afixmail.exe
- Bscanpst.exe
- Crepairpst.exe
- Drebuildpst.exe
83E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.
- Alog recycling
- Bcircular logging
- Clog purging
- Dlog cycling
84Syslog is generally configured to put all e-mail related log information into what file?
- A/usr/log/mail.log
- B/var/log/messages
- C/proc/mail
- D/var/log/maillog
85What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?
- A.txt
- B.tmp
- C.exe
- D.log
86On a UNIX system, where is a user's mail stored by default?
- A/var/mail
- B/var/log/mail
- C/username/mail
- D/home/username/mail
87Where does the Postfix UNIX mail server store e-mail?
- A/home/username/mail
- B/var/mail/postfix
- C/var/spool/postfix
- D/etc/postfix
88One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.
- ANigerian Scam
- BLake Venture Scam
- CConficker virus
- DIloveyou Scam
89What information is not typically included in an e-mail header?
- AThe sender's physical location
- BThe originating IP address
- CThe unique ID of the e-mail
- DThe originating domain
90In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?
- A.ost
- B.edp
- C.edb
- D.edi
91What type of Facebook profile is usually only given to law enforcement with a warrant?
- Aprivate profile
- Badvanced profile
- Cbasic profile
- DNeoprint profile
92Which option below is the correct path to the sendmail configuration file?
- A/var/etc/sendmail.cf
- B/var/mail/sendmail.cf
- C/usr/local/sendmail.cf
- D/etc/mail/sendmail.cf
93In what state is sending unsolicited e-mail illegal?
- AFlorida
- BWashington
- CMaine
- DNew York
94What service below can be used to map an IP address to a domain name, and then find the domain name's point of contact?
- AiNet
- BARIN
- CGoogle
- DERIN
95Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?
- AFookes Aid4mail
- BDataNumen Outlook Repair
- CEnCase Forensics
- DAccessData FTK
96Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.
- AMicrosoft Mail Storage Engine (MSE)
- BMicrosoft Stored Mail Extensions (SME)
- CMicrosoft Extended Mail Storage (EMS)
- DMicrosoft Extensible Storage Engine (ESE)
97The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.
- Adestruction
- Bspamming
- Cspoofing
- Dtheft
98In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.
- AGetExchangeLogs.ps1
- BGetLogInfo.ps1
- CShowExchangeHistory.ps1
- DGetTransactionLogStats.ps1
99Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.
- AAccessData FTK
- BDataNumen
- CR-Tools R-Mail
- DFookes Aid4Mail
100Which service below does not put log information into /var/log/maillog?
- ASMTP
- BExchange
- CIMAP
- DPOP
101What frequencies can be used by GSM with the TDMA technique?
- A1200 to 1500 MHz
- B2.4 GHz to 5.0 GHz
- C600 to 1000 MHz
- D800 to 1000 MHz
102What digital network technology is a digital version of the original analog standard for cell phones?
- AGSM
- BCDMA
- CiDEN
- DD-AMPS
103The _______________ component is made up of radio transceiver equipment that defines cells and communicates with mobile phones; sometimes referred to as a "cell phone tower".
- ABase station controller (BSC)
- BMobile switching center (MSC)
- CBase transceiver controller (BTC)
- DBase transceiver station (BTS)
104What organization is responsible for the creation of the requirements for carriers to be considered 4G?
- AIEEE
- BITU-R
- CISO
- DTIA
105Nonvolatile memory on a mobile device can contain OS files and stored user data, such as a __________________ and backed-up files.
- AProfessional Data Holder
- BPersonal Assistant Organizer
- CPersonal Data Manager
- DPersonal Information Manager
106The ___________________ technology is designed for GSM and Universal Mobile Telecommunications Systems (UMTS) technology, supports 45 Mbps to 144 Mbps transmission speeds.
- AWiMAX
- BLTE
- CMIMO
- DUMB
107Which of the NIST guidelines below requires using a modified boot loader to access RAM for analysis?
- AChip-off
- BManual extraction
- CHex dumping
- DMicro read
108GSM refers to mobile phones as "mobile stations" and divides a station into two parts, the __________ and the mobile equipment (ME).
- Aantenna
- BSIM card
- Cradio
- Dtransceiver
109What digital network technology was developed during World War II?
- ATDMA
- BCDMA
- CGSM
- DiDEN
110What type of mobile forensics method listed by NIST guidelines involves looking at a device's content page by page and taking pictures?
- AManual extraction
- BChip-off
- CMicro read
- DLogical extraction
111What method below is not an effective method for isolating a mobile device from receiving signals?
- Aplacing the device into a plastic evidence bag
- Bplacing the device into a paint can, preferably one previously containing radio-wave blocking paint
- Cplacing the device into airplane mode
- Dturning the device off
112Select below the option that is not a typical feature of smartphones on the market today:
- AMicroprocessor
- BFlash
- CROM
- DHard drive
113What standard introduced sleep mode to enhance battery life, and is used with TDMA?
- AIS-99
- BIS-140
- CIS-136
- DIS-95
114Within NIST guidelines for mobile forensics methods, the ______________ method requires physically removing flash memory chips and gathering information at the binary level.
- AChip-off
- BLogical extraction
- CMicro read
- DManual extraction
115On what mobile device platform does Facebook use a SQLite database containing friends, their ID numbers, and phone numbers as well as files that tracked all uploads, including pictures?
- AAndroid
- BBlackberry
- CWindows RT
- DiPhone
116Where is the OS stored on a smartphone?
- ARAM
- BMicroprocessor
- CROM
- DRead/write flash
117The ________________ technology uses the IEEE 802.16e standard and Orthogonal Frequency Division Multiple Access (OFDMA) and supports transmission speeds of 12 Mbps
- AWiMAX
- BCDMA
- CUMB
- DMIMO
118Which of the following is not a type of peripheral memory card used in PDAs?
- ASecure Digital (SD)
- BCompact Flash (CF)
- CMultiMediaCard (MMC)
- DRamBus (RB)
119Which component of cell communication is used to route digital packets for the network and relies on a database to support subscribers?
- ABase station controller (BSC)
- BBase transciever station (BTS)
- CBase transciever controller (BTC)
- DMobile switching center (MSC)
120Most Code Division Multiple Access (CDMA) networks conform to ____________ , created by the Telecommunications Industry Association (TIA).
- ATS-95
- B802.11
- CIS-95
- DIS-136
121The use of smart phones for illicit activities is becoming more prevalent.
- ATrue
- BFalse
122Because mobile phones are seized at the time of arrest, a search warrant is not necessary to examine the device for information.
- ATrue
- BFalse
123Most Code Division Multiple Access networks conform to IS-95. The systems are referred to as CDMAOne, and when they went to 3G service, they became CDMAThree.
- ATrue
- BFalse
124While travelling internationally with a GSM phone, you can pop in a SIM card for the country you're currently in, rather than get a new phone.
- ATrue
- BFalse
125Search and seizure procedures for mobile devices are as important as procedures for computers.
- ATrue
- BFalse
Information
- Description
- This is a midterm study guide. Hopefully all answers were entered correctly :)
- Author
- Joey Rubino
- Language
- English
- Views
- 1,085
- Tags
- Rating
- No ratings yet Rate this quiz