Quiz
Midterm Prep
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (144)
1According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.
- AVerdadeiro
- BFalso
2All suspected industrial espionage cases should be treated as civil case investigations.
- AVerdadeiro
- BFalso
3User groups for a specific type of system can be very useful in a forensics investigation.
- AVerdadeiro
- BFalso
4Most digital investigations in the private sector involve misuse of computing assets.
- AVerdadeiro
- BFalso
5If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.
- AVerdadeiro
- BFalso
6Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.
- AFederal Proceedings Law
- BFederal Rules of Evidence
- CFederal Consistency Standards
- DFederal Proceedings Rules
7Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?
- AFirst Amendment
- BSecond Amendment
- CFourth Amendment
- DFifth Amendment
8Which Microsoft OS below is the least intrusive to disks in terms of changing data?
- AWindows 95
- BWindows XP
- CWindows 7
- DMS-DOS 6.22
9_______ is not recommended for a digital forensics workstation.
- AA text editor tool
- BA write-blocker device
- CAn SCSI card
- DRemote access software
10Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.
- Arepeatable findings
- Breloadable steps
- Cverifiable reporting
- Devidence reporting
11If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.
- Aexhibit
- Bverdict
- Caffidavit
- Dmemo
12_______ describes an accusation of fact that a crime has been committed.
- AAttrition
- BAttribution
- CAllegation
- DAssignment
13_______ is not one of the functions of the investigations triad.
- ADigital investigations
- BData recovery
- CVulnerability/threat assessment and risk management
- DNetwork intrusion detection and incident response
14In what year was the Computer Fraud and Abuse Act passed?
- A1976
- B1980
- C1986
- D1996
15The _______ is not one of the three stages of a typical criminal case.
- Acomplaint
- Binvestigation
- Ccivil suit
- Dprosecution
16After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.
- ADigital Evidence Recorder
- BDigital Evidence Specialist
- CDigital Evidence First Responder
- DDigital Evidence Scene Investigator
17The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.
- ADigital Evidence First Responder
- BDigital Evidence Specialist
- CDigital Evidence Analyst
- DDigital Evidence Examiner
18The sale of sensitive or confidential company information to a competitor is known as _______.
- Aindustrial sabotage
- Bindustrial espionage
- Cindustrial collusion
- Dindustrial betrayal
19Which option below is not a standard systems analysis step?
- ADetermine a preliminary design or approach to the case.
- BObtain and copy an evidence drive.
- CShare evidence with experts outside of the investigation.
- DMitigate or minimize the risks.
20A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.
- Asingle-evidence form
- Bmulti-evidence form
- Cevidence custody form
- Devidence tracking form
21An evidence custody form does not usually contain _______.
- Athe nature of the case
- Ba description of evidence
- Cvendor names for computer components
- Da witness list
22What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?
- AAccessData Forensic Toolkit
- BDeepScan
- CILook
- DPhotorec
23The term _______ describes a database containing informational records about crimes that have been committed previously by a criminal.
- Apolice ledger
- Bpolice blotter
- Cpolice blogger
- Dpolice recorder
24_______ must be included in an affidavit to support an allegation in order to justify a warrant.
- AVerdicts
- BWitnesses
- CExhibits
- DSubpoenas
25After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.
- Aexhibit
- Baffidavit
- Callegation
- Dverdict
26Linux Live CDs and WinFE disks do not automatically mount hard drives, but can be used to view file systems.
- AVerdadeiro
- BFalso
27The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. Department of Defense.
- AVerdadeiro
- BFalso
28The recording of all updates made to a workstation or machine is referred to as configuration management.
- AVerdadeiro
- BFalso
29A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.
- AVerdadeiro
- BFalso
30Because they are outdated, ribbon cables should not be considered for use within a forensics lab.
- AVerdadeiro
- BFalso
31Candidates who complete the IACIS test successfully are designated as a _______.
- ACertified Forensic Computer Examiner (CFCE)
- BCertified Forensics Investigator (CFI)
- CCertified Investigative Forensics Examiner (CIFE)
- DCertified Investigative Examiner (CIE)
32What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?
- ACertified Computer Crime Investigator
- BCertified Forensic Computer Examiner
- CCertified Cyber Forensics Professional
- DEnCase Certified Examiner
33How long are computing components designed to last in a normal business environment?
- A12 to 16 months
- B14 to 26 months
- C18 to 36 months
- D36 to 90 months
34Which of the following scenarios should be covered in a disaster recovery plan?
- Adamage caused by lightning strikes
- Bdamage caused by flood
- Cdamage caused by a virus contamination
- Dall of the above
35Which operating system listed below is not a distribution of the Linux OS?
- AMinix
- BDebian
- CSlackware
- DFedora
36_______ describes the characteristics of a safe storage container.
- AISO2960
- BNISPOM
- CSSO 990
- DSTORSEC
37In order to qualify for the Certified Computer Forensic Technician, Basic Level certification, how many hours of computer forensics training are required?
- A10
- B20
- C30
- D40
38Which file system below is utilized by the Xbox gaming system?
- ANTFS
- BReFS
- CEXT
- DFATX
39Which ISO standard below is followed by the ASCLD?
- A17025:2005
- B17026:2007
- C12075:2007
- D12076:2005
40_______ is responsible for creating and monitoring lab policies for staff, and provides a safe and secure workplace for staff and evidence.
- AThe lab manager
- BThe lab investigator
- CThe lab secretary
- DThe lab steward
41What percentage of consumers utilize Intel and AMD PCs?
- A60
- B70
- C80
- D90
42_______ can be used to restore backup files directly to a workstation.
- ABelarc Advisor
- BNorton Ghost
- CProDiscover
- DPhotorec
43How often should hardware be replaced within a forensics lab?
- AEvery 6 to 12 months
- BEvery 12 to 18 months
- CEvery 18 to 24 months
- DEvery 24 to 30 months
44A TEMPEST facility is designed to accomplish which of the following goals?
- APrevent data loss by maintaining consistent backups.
- BShield sensitive computing systems and prevent electronic eavesdropping of computer emissions.
- CEnsure network security from the Internet using comprehensive security software.
- DProtect the integrity of data.
45In order to qualify for the Advanced Certified Computer Forensic Technician certification, a candidate must have _______ years of hands-on experience in computer forensics investigations.
- Atwo
- Bthree
- Cfive
- Dsix
46In order to qualify for the Certified Computer Crime Investigator, Basic Level certification, candidates must provide documentation of at least _______ cases in which they participated.
- A5
- B10
- C15
- D20
47Which tool below is not recommended for use in a forensics lab?
- A2.5-inch adapters for drives
- BFireWire and USB adapters
- CSCSI cards
- DDegausser
48Which option below is not a recommendation for securing storage containers?
- AThe container should be located in a restricted area
- BOnly authorized access should be allowed, and it should be kept to a minimum.
- CEvidence containers should remain locked when they aren't under direct supervision.
- DRooms with evidence containers should have a secured wireless network.
49Which option below is not one of the recommended practices for maintaining a keyed padlock?
- AAppoint a key custodian.
- BTake inventory of all keys when the custodian changes.
- CUse a master key.
- DChange locks and keys annually.
50_______ is a specialized viewer software program.
- AFastView
- BIrfanView
- CThumbsLoader
- DABSee
51Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.
- AVerdadeiro
- BFalso
52A forensics investigator should verify that acquisition tools can copy data in the HPA of a disk drive.
- AVerdadeiro
- BFalso
53FTK Imager software can acquire a drive's host protected area.
- AVerdadeiro
- BFalso
54The ImageUSB utility can be used to create a bootable flash drive.
- AVerdadeiro
- BFalso
55Which option below is not a hashing function used for validation checks?
- ARC4
- BMD5
- CSHA-1
- DCRC32
56The Linux command _____ can be used to write bit-stream data to files.
- Awrite
- Bdd
- Ccat
- Ddump
57Which option below is not a Linux Live CD meant for use as a digital forensics tool?
- APenguin Sleuth
- BKali Linux
- CUbuntu
- DCAINE
58The _______ command was developed by Nicholas Harbour of the Defense Computer Forensics Laboratory.
- Add
- Bsplit
- Cecho
- Ddcfldd
59Which RAID type utilizes mirrored striping, providing fast access and redundancy?
- ARAID 1
- BRAID 3
- CRAID 5
- DRAID 10
60Within the fdisk interactive menu, what character should be entered to view existing partitions?
- A1
- Bp
- Co
- Dd
61When using a target drive that is FAT32 formatted, what is the maximum size limitation for split files?
- A512 MB
- B2 GB
- C1 TB
- D1 PB
62Which RAID type provides increased speed and data storage capability, but lacks redundancy?
- ARAID 0
- BRAID 1
- CRAID 0+1
- DRAID 5
63Which RAID type utilizes a parity bit and allows for the failure of one drive without losing data?
- ARAID 1
- BRAID 2
- CRAID 3
- DRAID 5
64_______ creates a virtual volume of a RAID image file, and then makes repairs on the virtual volume, which can then be restored to the original RAID.
- ARuntime Software
- BRaidRestore
- CR-Tools R-Studio
- DFixitRaid
65_______ is the utility used by the ProDiscover program for remote access.
- ASubSe7en
- Bl0pht
- CPDServer
- DVNCServer
66The _______ copies evidence of intrusions to an investigation workstation automatically for further analysis over the network.
- Aintrusion detection system
- Bactive defense mechanism
- Ctotal awareness system
- Dintrusion monitoring system
67Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?
- AAdvanced Forensics Disk
- BAdvanced Forensic Format
- CAdvanced Capture Image
- DAdvanced Open Capture
68What is the name of the Microsoft solution for whole disk encryption?
- ADriveCrypt
- BTrueCrypt
- CBitLocker
- DSecureDrive
69Which technology below is not a hot-swappable technology?
- AUSB-3
- BFireWire 1394A
- CSATA
- DIDE
70Computer-stored records are data the system maintains, such as system log files and proxy server logs.
- AVerdadeiro
- BFalso
71An emergency situation under the PATRIOT Act is defined as the immediate risk of death or personal injury, such as finding a bomb threat in an e-mail.
- AVerdadeiro
- BFalso
72The Fourth Amendment states that only warrants "particularly describing the place to be searched and the persons or things to be seized" can be issued. The courts have determined that this phrase means a warrant can authorize a search of a specific place for anything.
- AVerdadeiro
- BFalso
73State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.
- AVerdadeiro
- BFalso
74To investigate employees suspected of improper use of company digital assets, a company policy statement about misuse of digital assets allows corporate investigators to conduct covert surveillance with little or no cause, and access company computer systems and digital devices without a warrant.
- AVerdadeiro
- BFalso
75_______ would not be found in an initial-response field kit.
- AComputer evidence bags (antistatic bags)
- BLeather gloves and disposable latex gloves
- CA digital camera with extra batteries or 35mm camera with film and flash
- DExternal USB devices or a portable hard drive
76_______ is a common cause for lost or corrupted evidence.
- APublic access
- BNot having enough people on the processing team
- CHaving an undefined security perimeter
- DProfessional curiosity
77What does FRE stand for?
- AFederal Rules of Evidence
- BFederal Regulations for Evidence
- CFederal Rights for Everyone
- DFederal Rules for Equipment
78If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.
- Atwo
- Bfive
- Cone
- Dthree
79_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.
- ASecond-party evidence
- BRumor
- CFiction
- DHearsay
80You must abide by the _______ while collecting evidence.
- AFourth Amendment
- BFederal Rules of Evidence
- Cstate's Rules of Evidence
- DFifth Amendment
81Which of the following is not done when preparing for a case?
- ADescribe the nature of the case.
- BIdentify the type of OS.
- CSet up covert surveillance.
- DDetermine whether you can seize the computer or digital device.
82A _______ is not a private sector organization.
- Asmall to medium business
- Blarge corporation
- Cnon-government organization
- Dhospital
83In cases that involve dangerous settings, what kind of team should be used to recover evidence from the scene?
- AB-Team
- BHAZMAT
- CCDC First Responders
- DSWAT
84_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.
- AHospitals
- BISPs
- CLaw firms
- DNews networks
85The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.
- Aprobable cause
- Bdue diligence
- Caccusations
- Dreliability
86Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?
- AUnited States v. Wong
- BUnited States v. Carey
- CUnited States v. Salgado
- DUnited States v. Walser
87What should you do while copying data on a suspect's computer that is still live?
- AOpen files to view contents.
- BMake notes regarding everything you do.
- CConduct a Google search of unknown extensions using the computer.
- DCheck Facebook for additional suspects.
88The term _______ describes rooms filled with extremely large disk systems that are typically used by large business data centers.
- Astorage room
- Bserver farm
- Cdata well
- Dstorage hub
89_______ does not recover data in free or slack space.
- ARaw format acquisition
- BLive acquisition
- CStatic acquisition
- DSparse acquisition
90When seizing digital evidence in criminal investigations, whose standards should be followed?
- AU.S. DOJ
- BISO/IEC
- CIEEE
- DITU
91The term _______ is used to describe someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.
- Acriminal
- Bpotential data source
- Cperson of interest
- Dwitness
92What type of media has a 30-year lifespan?
- ADVD-Rs
- BDLT magnetic tape
- Chard drive
- DUSB thumb drive
93As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?
- AThe power cable should be pulled.
- BThe system should be shut down gracefully.
- CThe power should be left on.
- DThe decision should be left to the Digital Evidence First Responder (DEFR).
94Which system below can be used to quickly and accurately match fingerprints in a database?
- AFingerprint Identification Database (FID)
- BSystemic Fingerprint Database (SFD)
- CAutomated Fingerprint Identification System (AFIS)
- DDynamic Fingerprint Matching System (DFMS)
95A computer stores system configuration and date and time information in the BIOS when power to the system is off.
- AVerdadeiro
- BFalso
96When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.
- AVerdadeiro
- BFalso
97Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.
- AVerdadeiro
- BFalso
98FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.
- AVerdadeiro
- BFalso
99Each MFT record starts with a header identifying it as a resident or nonresident attribute.
- AVerdadeiro
- BFalso
100A typical disk drive stores how many bytes in a single sector?
- A8
- B512
- C1024
- D4096
101Most manufacturers use what technique in order to deal with the fact that a platter's inner tracks have a smaller circumference than the outer tracks?
- ADisk Track Recording (DTR)
- BZone Based Areal Density (ZBAD)
- CZone Bit Recording (ZBR)
- DCylindrical Head Calculation (CHC)
102What hexadecimal code below identifies an NTFS file system in the partition table?
- A05
- B07
- C1B
- DA5
103When using the File Allocation Table (FAT), where is the FAT database typically written to?
- AThe innermost track
- BThe outermost track
- CThe first sector
- DThe first partition
104Select below the file system that was developed for mobile personal storage devices, such as flash memory devices, secure digital eXtended capacity (SDCX), and memory sticks:
- AFAT12
- BFAT32
- CexFAT
- DVFAT
105What term is used to describe a disk's logical structure of platters, tracks, and sectors?
- Acylinder
- Btrigonometry
- Cgeometry
- Dmapping
106A Master Boot Record (MBR) partition table marks the first partition starting at what offset?
- A0x1CE
- B0x1BE
- C0x1AE
- D0x1DE
107The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.
- Adelete
- Bedit
- Cupdate
- Dclear
108What metadata record in the MFT keeps track of previous transactions to assist in recovery after a system failure in an NTFS volume?
- A$MftMirr
- B$TransAct
- C$LogFile
- D$Backup
109What command below can be used to decrypt EFS files?
- Acipher
- Bcopy
- Cefsrecvr
- Ddecrypt
110Which of the following commands creates an alternate data stream?
- Aecho text > myfile.txt:stream_name
- Bads create myfile.txt{stream_name} "text"
- Ccat text myfile.txt=stream_name
- Decho text
111What term below describes a column of tracks on two or more disk platters?
- Asector
- Bcluster
- Ccylinder
- Dheader
112Which of the following is not a valid configuration of Unicode?
- AUTF-8
- BUTF-16
- CUTF-32
- DUTF-64
113What does the MFT header field at offset 0x00 contain?
- AThe MFT record identifier FILE
- BThe size of the MFT record
- CThe length of the header
- DThe update sequence array
114The ReFS storage engine uses a __________ sort method for fast access to large data sets.
- AA+-tree
- BB+-tree
- Creverse
- Dnumerical
115What third party encryption tool creates a virtual encrypted volume, which is a file mounted as though it were a disk drive?
- APGP Full Disk Encryption
- BVoltage SecureFile
- CBestCrypt
- DTrueCrypt
116The _________ branches in HKEY_LOCAL_MACHINE\Software consist of SAM, Security, Components, and System.
- Aregistry
- Bstorage
- Chive
- Dtree
117What registry file contains user account management and security settings?
- ADefault.dat
- BSoftware.dat
- CSAM.dat
- DNtuser.dat
118What registry file contains installed programs' settings and associated usernames and passwords?
- ADefault.dat
- BSecurity.dat
- CSoftware.dat
- DSystem.dat
119Addresses that allow the MFT to link to nonresident files are known as _______________.
- Avirtual cluster numbers
- Blogical cluster numbers
- Csequential cluster numbers
- Dpolarity cluster numbers
120Software forensics tools are grouped into command-line applications and GUI applications
- AVerdadeiro
- BFalso
121Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.
- AVerdadeiro
- BFalso
122Physically copying the entire drive is the only type of data-copying method used in software acquisitions.
- AVerdadeiro
- BFalso
123ISO standard 27037 states that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.
- AVerdadeiro
- BFalso
124All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.
- AVerdadeiro
- BFalso
125What tool below was written for MS-DOS and was commonly used for manual digital investigations?
- ASMART
- BNorton DiskEdit
- CByteBack
- DDataLifter
126In general, what would a lightweight forensics workstation consist of?
- AA tablet with peripherals and forensics apps
- BA laptop computer built into a carrying case with a small selection of peripheral options
- CA laptop computer with almost as many bays and peripherals as a tower
- DA tower with several bays and many peripheral devices
127In what mode do most software write-blockers run?
- ARW mode
- BAla mode
- CShell mode
- DGUI mode
128Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.
- Acarving
- Bscraping
- Csalvaging
- Dsculpting
129The ProDiscover utility makes use of the proprietary _______________ file format.
- A.img
- B.pro
- C.iso
- D.eve
130What is the purpose of the reconstruction function in a forensics investigation?
- ARe-create a suspect's drive to show what happened during a crime or incident.
- BProve that two sets of data are identical.
- CCopy all information from a suspect's drive, including information that may have been hidden.
- DGenerate reports or logs that detail the processes undertaken by a forensics investigator.
131Which of the following options is not a subfunction of extraction?
- Alogical data copy
- Bdecrypting
- Cbookmarking
- Dcarving
132In what temporary location below might passwords be stored?
- Asystem32.dll
- BCD-ROM drive
- CWindows registry
- Dpagefile.sys
133The __________ Linux Live CD includes tools such as Autopsy and Sleuth Kit, ophcrack, dcfldd, MemFetch, and MBoxGrep, and utilizes a KDE interface.
- AKali
- BArch
- CUbuntu
- DHelix3
134What option below is an example of a platform specific encryption tool?
- AGnuPG
- BTrueCrypt
- CBitLocker
- DPretty Good Privacy (PGP)
135What hex value is the standard indicator for jpeg graphics files?
- AFF D8
- BFF D9
- CF8 D8
- DAB CD
136Passwords are typically stored as one-way _____________ rather than in plaintext.
- Ahex values
- Bvariables
- Chashes
- Dslack spaces
137What program serves as the GUI front end for accessing Sleuth Kit's tools?
- ADetectiveGUI
- BAutopsy
- CKDE
- DSMART
138Which of the following is stated within the ISO 27037 standard?
- AHardware acquisition tools can only use CRC-32 hashing.
- BDigital Evidence First Responders should use validated tools.
- CSoftware forensics tools must provide a GUI interface.
- DSoftware forensics tools must use the Windows OS.
139The physical data copy subfunction exists under the ______________ function.
- Areporting
- Bvalidation / verification
- Cextraction
- Dacquisition
140A keyword search is part of the analysis process within what forensic function?
- Areporting
- Breconstruction
- Cextraction
- Dacquisition
141What algorithm is used to decompress Windows files?
- AFibonacci
- BZopfli
- CShannon-Fano
- DLempel-Ziv
142What is the goal of the NSRL project, created by NIST?
- ACollect known hash values for commercial software and OS files using SHA hashes.
- BSearch for collisions in hash values, and contribute to fixing hashing programs.
- CCreate hash values for illegal files and distribute the information to law enforcement.
- DCollect known hash values for commercial software and OS files using MD5 hashes.
143When performing disk acquisition, the raw data format is typically created with the UNIX/Linux _____________ command.
- Aformat
- Btar
- Cdump
- Ddd
144_______________ proves that two sets of data are identical by calculating hash values or using another similar method.
- AVerification
- BValidation
- CIntegration
- DCompilation
Informações
- Descrição
- since I am required to include a description here it is... happy?
- Autor
- Joey Rubino
- Idioma
- English
- Visualizações
- 152
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz