7140546
Descrição
Quiz por Joey Rubino, atualizado more than 1 year ago
|
Criado por Joey Rubino
mais de 7 anos atrás
|
|
Questão 1
Questão
The first 3 bytes of an XIF file are exactly the same as a TIF file.
Responda
- True
- False
Questão 2
Questão
Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.
Responda
- True
- False
Questão 3
Questão
Most digital cameras use the bitmap format to store photos.
Responda
- True
- False
Questão 4
Questão
When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.
Responda
- True
- False
Questão 5
Questão
Each graphics file type has a unique header value.
Responda
- True
- False
Questão 6
Questão
How many bits are required to create a pixel capable of displaying 65,536 different colors?
Responda
-
8
-
16
-
32
-
64
Questão 7
Questão
Which of the following is not considered to be a non-standard graphics file format?
Responda
-
.dxf
-
.tga
-
.rtl
-
.psd
Questão 8
Questão
All TIF files start at offset 0 with what 6 hexadecimal characters?
Responda
-
2A 49 48
-
FF 26 9B
-
49 49 2A
-
AC 49 2A
Questão 9
Questão
What kind of graphics file combines bitmap and vector graphics types?
Responda
-
metafile
-
bitmap
-
jpeg
-
tif
Questão 10
Questão
The process of converting raw picture data to another format is called _________________.
Responda
-
splicing
-
carving
-
demosaicing
-
vector quantization
Questão 11
Questão
What format was developed as a standard for storing metadata in image files?
Responda
-
jpeg
-
tif
-
exif
-
bitmap
Questão 12
Questão
Which of the following formats is not considered to be a standard graphics file format?
Responda
-
gif
-
jpeg
-
dxf
-
tga
Questão 13
Questão
Select below the utility that is not a lossless compression utility:
Responda
-
PKZip
-
WinZip
-
StuffIt
-
Lzip
Questão 14
Questão
In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.
Responda
-
Huffman
-
Lempel-Ziv-Welch (LZW)
-
Vector Quantization
-
Adaptive Quantization
Questão 15
Questão
What file type starts at offset 0 with a hexidecimal value of FFD8?
Responda
-
tiff
-
jpeg
-
xdg
-
bmp
Questão 16
Questão
How many different colors can be displayed by a 24 bit colored pixel?
Responda
-
256
-
65,536
-
16,777,216
-
4,294,967,296
Questão 17
Questão
The _____________ format is a proprietary format used by Adobe Photoshop.
Responda
-
.tga
-
.fh11
-
.svg
-
.psd
Questão 18
Questão
For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
Responda
-
FFE0
-
FFE1
-
FFD8
-
FFD9
Questão 19
Questão
Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.
Responda
-
raster file format
-
bitmap file format
-
jpeg file format
-
raw file format
Questão 20
Questão
The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.
Responda
-
lossy
-
lossless
-
vector quantization
-
adaptive
Questão 21
Questão
For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.
Responda
-
FFE0
-
FFD8
-
FFD9
-
FFFF
Questão 22
Questão
Which graphics file format below is rarely compressed?
Responda
-
GIF
-
JPEG
-
BMP
-
None of the above
Questão 23
Questão
When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?
Responda
-
major significant bit (MSB)
-
least significant bit (LSB)
-
most significant bit (MSB)
-
leading significant bit (LSB)
Questão 24
Questão
What act defines precisely how copyright laws pertain to graphics?
Responda
-
1988 Image Ownership Act
-
1976 Copyright Act
-
1923 Patented Image Act
-
1976 Computer Fraud and Abuse Act
Questão 25
Questão
Which of the following is not a type of graphic file that is created by a graphics program?
Responda
-
bitmap images
-
vector graphics
-
metafile graphics
-
raster graphics
Questão 26
Questão
Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.
Responda
- True
- False
Questão 27
Questão
One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.
Responda
- True
- False
Questão 28
Questão
The advantage of recording hash values is that you can determine whether data has changed.
Responda
- True
- False
Questão 29
Questão
In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.
Responda
- True
- False
Questão 30
Questão
Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing specific files or sectors.
Responda
- True
- False
Questão 31
Questão
What format below is used for VMware images?
Responda
-
.vhd
-
.vmdk
-
.s01
-
.aff
Questão 32
Questão
In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?
Responda
-
NTFS
-
FAT
-
HFSX
-
Ext3fs
Questão 33
Questão
Which password recovery method uses every possible letter, number, and character found on a keyboard?
Responda
-
rainbow table
-
dictionary attack
-
hybrid attack
-
brute-force attack
Questão 34
Questão
The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.
Responda
-
litigation
-
scope creep
-
criminal charges
-
violations
Questão 35
Questão
Which of the following file systems can't be analyzed by OSForensics?
Responda
-
FAT12
-
Ext2fs
-
HFS+
-
XFS
Questão 36
Questão
In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.
Responda
-
format
-
fdisk
-
grub
-
diskpart
Questão 37
Questão
Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:
Responda
-
Last Bit
-
AccessData PRTK
-
OSForensics
-
Passware
Questão 38
Questão
Within Windows Vista and later, partition gaps are _____________ bytes in length.
Responda
-
64
-
128
-
256
-
512
Questão 39
Questão
Which option below is not a disk management tool?
Responda
-
Partition Magic
-
Partition Master
-
GRUB
-
HexEdit
Questão 40
Questão
Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.
Responda
-
hashing
-
bit-shifting
-
registry edits
-
slack space
Questão 41
Questão
A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.
Responda
-
compiler
-
shifter
-
macro
-
script
Questão 42
Questão
What letter should be typed into DiskEdit in order to mark a good sector as bad?
Responda
-
M
-
B
-
T
-
D
Questão 43
Questão
Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.
Responda
-
key vault
-
key escrow
-
bump key
-
master key
Questão 44
Questão
What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?
Responda
-
salted passwords
-
scrambled passwords
-
indexed passwords
-
master passwords
Questão 45
Questão
When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?
Responda
-
Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
-
Start the suspect's computer and begin collecting evidence.
-
The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
-
Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.
Questão 46
Questão
In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.
Responda
-
keygrabber
-
keylogger
-
packet capture
-
protocol analyzer
Questão 47
Questão
The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.
Responda
-
DeepScan Filter
-
Unknown File Filter (UFF)
-
Known File Filter (KFF)
-
FTK Hash Imager
Questão 48
Questão
The term for detecting and analyzing steganography files is _________________.
Responda
-
carving
-
steganology
-
steganalysis
-
steganomics
Questão 49
Questão
A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.
Responda
-
fdisk
-
format
-
dd
-
DiskEdit
Questão 50
Questão
The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.
Responda
-
Open Hash Database
-
HashKeeper Online
-
National Hashed Software Reference
-
National Software Reference Library
Questão 51
Questão
Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.
Responda
- True
- False
Questão 52
Questão
Forensics tools can't directly mount VMs as external drives.
Responda
- True
- False
Questão 53
Questão
The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.
Responda
- True
- False
Questão 54
Questão
The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.
Responda
- True
- False
Questão 55
Questão
The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.
Responda
- True
- False
Questão 56
Questão
What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?
Responda
-
KVM
-
Parallels
-
Microsoft Virtual PC
-
VirtualBox
Questão 57
Questão
The __________ disk image file format is associated with the VirtualBox hypervisor.
Responda
-
.vmdk
-
.hda
-
.vhd
-
.vdi
Questão 58
Questão
What Windows Registry key contains associations for file extensions?
Responda
-
HKEY_CLASSES_ROOT
-
HKEY_USERS
-
HKEY_LOCAL_MACHINE
-
HKEY_CURRENT_CONFIG
Questão 59
Questão
In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters
Responda
-
2
-
4
-
6
-
8
Questão 60
Questão
The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?
Responda
-
12.04
-
13.11
-
14.04
-
14.11
Questão 61
Questão
Select below the option that is not a common type 1 hypervisor:
Responda
-
VMware vSphere
-
Microsoft Hyper-V
-
Citirix XenServer
-
Oracle VirtualBox
Questão 62
Questão
The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?
Responda
-
People
-
Technology
-
Operations
-
Management
Questão 63
Questão
The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.
Responda
-
netstat
-
ls
-
ifconfig
-
tcpdump
Questão 64
Questão
Select below the program within the PsTools suite that allows you to run processes remotely:
Responda
-
PsService
-
PsPasswd
-
PsRemote
-
PsExec
Questão 65
Questão
The tcpdump and Wireshark utilities both use what well known packet capture format?
Responda
-
Netcap
-
Pcap
-
Packetd
-
RAW
Questão 66
Questão
The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.
Responda
-
Tcpdstat
-
Tcpslice
-
Ngrep
-
tcpdump
Questão 67
Questão
The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.
Responda
-
Kali Linux
-
Ubuntu
-
OSForensics
-
Sleuth Kit
Questão 68
Questão
In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?
Responda
-
Show-NetworkAdapters
-
Query-ipconfig
-
Get-VMNetworkAdapter
-
Dump-Netconfig
Questão 69
Questão
What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?
Responda
-
.nvram
-
.vmem
-
.vmpage
-
.vmx
Questão 70
Questão
What processor instruction set is required in order to utilize virtualization software?
Responda
-
AMD-VT
-
Intel VirtualBit
-
Virtual Machine Extensions (VMX)
-
Virtual Hardware Extensions (VHX)
Questão 71
Questão
Select the file below that is used in VirtualBox to create a virtual machine:
Responda
-
.vdi
-
.vbox
-
.r0
-
.ova
Questão 72
Questão
The __________________ is the version of Pcap available for Linux based operating systems.
Responda
-
Winpcap
-
Libpcap
-
Tcpcap
-
Netcap
Questão 73
Questão
What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?
Responda
-
tcpdump
-
Argus
-
Ngrep
-
Tcpslice
Questão 74
Questão
At what layers of the OSI model do most packet analyzers function?
Responda
-
Layer 1 or 2
-
Layer 2 or 3
-
Layer 3 or 4
-
Layer 4 or 5
Questão 75
Questão
In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.
Responda
-
smurf
-
SYN flood
-
spoof
-
ghost
Questão 76
Questão
The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.
Responda
- True
- False
Questão 77
Questão
The Pagefile.sys file on a computer can contain message fragments from instant messaging applications.
Responda
- True
- False
Questão 78
Questão
In an e-mail address, everything before the @ symbol represents the domain name.
Responda
- True
- False
Questão 79
Questão
Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.
Responda
- True
- False
Questão 80
Questão
An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.
Responda
- True
- False
Questão 81
Questão
What command below could be used on a UNIX system to help locate log directories?
Responda
-
show log
-
detail
-
search
-
find
Questão 82
Questão
The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.
Responda
-
fixmail.exe
-
scanpst.exe
-
repairpst.exe
-
rebuildpst.exe
Questão 83
Questão
E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.
Responda
-
log recycling
-
circular logging
-
log purging
-
log cycling
Questão 84
Questão
Syslog is generally configured to put all e-mail related log information into what file?
Responda
-
/usr/log/mail.log
-
/var/log/messages
-
/proc/mail
-
/var/log/maillog
Questão 85
Questão
What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?
Responda
-
.txt
-
.tmp
-
.exe
-
.log
Questão 86
Questão
On a UNIX system, where is a user's mail stored by default?
Responda
-
/var/mail
-
/var/log/mail
-
/username/mail
-
/home/username/mail
Questão 87
Questão
Where does the Postfix UNIX mail server store e-mail?
Responda
-
/home/username/mail
-
/var/mail/postfix
-
/var/spool/postfix
-
/etc/postfix
Questão 88
Questão
One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.
Responda
-
Nigerian Scam
-
Lake Venture Scam
-
Conficker virus
-
Iloveyou Scam
Questão 89
Questão
What information is not typically included in an e-mail header?
Responda
-
The sender's physical location
-
The originating IP address
-
The unique ID of the e-mail
-
The originating domain
Questão 90
Questão
In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?
Responda
-
.ost
-
.edp
-
.edb
-
.edi
Questão 91
Questão
What type of Facebook profile is usually only given to law enforcement with a warrant?
Responda
-
private profile
-
advanced profile
-
basic profile
-
Neoprint profile
Questão 92
Questão
Which option below is the correct path to the sendmail configuration file?
Responda
-
/var/etc/sendmail.cf
-
/var/mail/sendmail.cf
-
/usr/local/sendmail.cf
-
/etc/mail/sendmail.cf
Questão 93
Questão
In what state is sending unsolicited e-mail illegal?
Responda
-
Florida
-
Washington
-
Maine
-
New York
Questão 94
Questão
What service below can be used to map an IP address to a domain name, and then find the domain name's point of contact?
Responda
-
iNet
-
ARIN
-
Google
-
ERIN
Questão 95
Questão
Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?
Responda
-
Fookes Aid4mail
-
DataNumen Outlook Repair
-
EnCase Forensics
-
AccessData FTK
Questão 96
Questão
Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.
Responda
-
Microsoft Mail Storage Engine (MSE)
-
Microsoft Stored Mail Extensions (SME)
-
Microsoft Extended Mail Storage (EMS)
-
Microsoft Extensible Storage Engine (ESE)
Questão 97
Questão
The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.
Responda
-
destruction
-
spamming
-
spoofing
-
theft
Questão 98
Questão
In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.
Responda
-
GetExchangeLogs.ps1
-
GetLogInfo.ps1
-
ShowExchangeHistory.ps1
-
GetTransactionLogStats.ps1
Questão 99
Questão
Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.
Responda
-
AccessData FTK
-
DataNumen
-
R-Tools R-Mail
-
Fookes Aid4Mail
Questão 100
Questão
Which service below does not put log information into /var/log/maillog?
Responda
-
SMTP
-
Exchange
-
IMAP
-
POP
Questão 101
Questão
What frequencies can be used by GSM with the TDMA technique?
Responda
-
1200 to 1500 MHz
-
2.4 GHz to 5.0 GHz
-
600 to 1000 MHz
-
800 to 1000 MHz
Questão 102
Questão
What digital network technology is a digital version of the original analog standard for cell phones?
Responda
-
GSM
-
CDMA
-
iDEN
-
D-AMPS
Questão 103
Questão
The _______________ component is made up of radio transceiver equipment that defines cells and communicates with mobile phones; sometimes referred to as a "cell phone tower".
Responda
-
Base station controller (BSC)
-
Mobile switching center (MSC)
-
Base transceiver controller (BTC)
-
Base transceiver station (BTS)
Questão 104
Questão
What organization is responsible for the creation of the requirements for carriers to be considered 4G?
Responda
-
IEEE
-
ITU-R
-
ISO
-
TIA
Questão 105
Questão
Nonvolatile memory on a mobile device can contain OS files and stored user data, such as a __________________ and backed-up files.
Responda
-
Professional Data Holder
-
Personal Assistant Organizer
-
Personal Data Manager
-
Personal Information Manager
Questão 106
Questão
The ___________________ technology is designed for GSM and Universal Mobile Telecommunications Systems (UMTS) technology, supports 45 Mbps to 144 Mbps transmission speeds.
Responda
-
WiMAX
-
LTE
-
MIMO
-
UMB
Questão 107
Questão
Which of the NIST guidelines below requires using a modified boot loader to access RAM for analysis?
Responda
-
Chip-off
-
Manual extraction
-
Hex dumping
-
Micro read
Questão 108
Questão
GSM refers to mobile phones as "mobile stations" and divides a station into two parts, the __________ and the mobile equipment (ME).
Responda
-
antenna
-
SIM card
-
radio
-
transceiver
Questão 109
Questão
What digital network technology was developed during World War II?
Responda
-
TDMA
-
CDMA
-
GSM
-
iDEN
Questão 110
Questão
What type of mobile forensics method listed by NIST guidelines involves looking at a device's content page by page and taking pictures?
Responda
-
Manual extraction
-
Chip-off
-
Micro read
-
Logical extraction
Questão 111
Questão
What method below is not an effective method for isolating a mobile device from receiving signals?
Responda
-
placing the device into a plastic evidence bag
-
placing the device into a paint can, preferably one previously containing radio-wave blocking paint
-
placing the device into airplane mode
-
turning the device off
Questão 112
Questão
Select below the option that is not a typical feature of smartphones on the market today:
Responda
-
Microprocessor
-
Flash
-
ROM
-
Hard drive
Questão 113
Questão
What standard introduced sleep mode to enhance battery life, and is used with TDMA?
Responda
-
IS-99
-
IS-140
-
IS-136
-
IS-95
Questão 114
Questão
Within NIST guidelines for mobile forensics methods, the ______________ method requires physically removing flash memory chips and gathering information at the binary level.
Responda
-
Chip-off
-
Logical extraction
-
Micro read
-
Manual extraction
Questão 115
Questão
On what mobile device platform does Facebook use a SQLite database containing friends, their ID numbers, and phone numbers as well as files that tracked all uploads, including pictures?
Responda
-
Android
-
Blackberry
-
Windows RT
-
iPhone
Questão 116
Questão
Where is the OS stored on a smartphone?
Responda
-
RAM
-
Microprocessor
-
ROM
-
Read/write flash
Questão 117
Questão
The ________________ technology uses the IEEE 802.16e standard and Orthogonal Frequency Division Multiple Access (OFDMA) and supports transmission speeds of 12 Mbps
Responda
-
WiMAX
-
CDMA
-
UMB
-
MIMO
Questão 118
Questão
Which of the following is not a type of peripheral memory card used in PDAs?
Responda
-
Secure Digital (SD)
-
Compact Flash (CF)
-
MultiMediaCard (MMC)
-
RamBus (RB)
Questão 119
Questão
Which component of cell communication is used to route digital packets for the network and relies on a database to support subscribers?
Responda
-
Base station controller (BSC)
-
Base transciever station (BTS)
-
Base transciever controller (BTC)
-
Mobile switching center (MSC)
Questão 120
Questão
Most Code Division Multiple Access (CDMA) networks conform to ____________ , created by the Telecommunications Industry Association (TIA).
Responda
-
TS-95
-
802.11
-
IS-95
-
IS-136
Questão 121
Questão
The use of smart phones for illicit activities is becoming more prevalent.
Responda
- True
- False
Questão 122
Questão
Because mobile phones are seized at the time of arrest, a search warrant is not necessary to examine the device for information.
Responda
- True
- False
Questão 123
Questão
Most Code Division Multiple Access networks conform to IS-95. The systems are referred to as CDMAOne, and when they went to 3G service, they became CDMAThree.
Responda
- True
- False
Questão 124
Questão
While travelling internationally with a GSM phone, you can pop in a SIM card for the country you're currently in, rather than get a new phone.
Responda
- True
- False
Questão 125
Questão
Search and seizure procedures for mobile devices are as important as procedures for computers.
Responda
- True
- False
Quer criar seus próprios Quizzes gratuitos com a GoConqr? Saiba mais.