SEC+ Revision Questions Introduction to Computer Forensics Flashcards
What must be determined by the first responder to an incident?
A. The severity of the event
B. Which other personnel must be called in
C. The dollar amount associated with the incident
D. Who is at fault
A. The severity of the event
After seizing computer equipment alleged to have been involved in a crime, it is left in a corridor unattended for ten minutes while officers subdue a violent suspect. The seized equipment is no longer admissible as evidence because of what violation?
A. Order of volatility
B. Damage control
C. Chain of custody
D. Time offset
C. Chain of custody
A warrant has been issued to investigate a server believed to be used to swap credit card information by organized crime. Following the order of volatility, which data should you collect first?
A. Electronic memory (RAM)
B. Hard disk
C. USB flash drive
D. CMOS
A. Electronic memory (RAM)
A server configured with a RAID-5 array must be properly imaged to preserve the original state of the data. You decide against imaging each physical hard disk in the array. Which two tasks must you perform? (Choose two.)
A. Change the server CMOS boot order.
B. Image the array as a single logical disk.
C. Ensure your imaging solution supports RAID.
D. Update the firmware for the RAID controller.
B. Image the array as a single logical disk.
&
C. Ensure your imaging solution supports RAID.
While capturing network traffic, you notice an abnormally excessive number of outbound SMTP packets. To determine whether this is an incident that requires escalation, what else should you consult?
A. The contents of your inbox
B. The mail server log
C. The mail server documentation
D. The web server log
B. The mail server log
You decide to work late on a Saturday night to replace wiring in your server room. Upon arriving, you realize there has been a break-in and server backup tapes appear to be missing. What should you do as law enforcement officials arrive?
A. Clean up the server room.
B. Sketch a picture of the broken-into premises on a notepad.
C. Alert officials that the premise has surveillance video.
D. Check the surrounding area for the perpetrator.
C. Alert officials that the premise has surveillance video.
Which of the following best visually illustrates the state of a computer at the time it was seized by law enforcement?
A. Digital photograph of the motherboard
B. Screenshot
C. Visio network diagram
D. Steganography
B. Screenshot
Choose the correct order of volatility when collecting digital evidence:
A. Hard disk, DVD-R, RAM, swap file
B. Swap file, RAM, DVD-R, hard disk
C. RAM, DVD-R, swap file, hard disk
D. RAM, swap file, hard disk, DVD-R
D. RAM, swap file, hard disk, DVD-R
What can a forensic analyst do to reduce the number of files that must be analyzed on a seized disk?
A. Write a Visual Basic script.
B. Delete files thought to be operating system files.
C. Ensure the original disk is pristine and use a hash table on a copy of the files.
D. Ensure the original disk is pristine and use a script to process a copy of the files.
C. Ensure the original disk is pristine and use a hash table on a copy of the files.
A professional who is present at the time of evidence gathering can be summoned to appear in court or to prepare a report on their findings for use in court. What is this person referred to as?
A. Plaintiff
B. Defendant
C. Auditor
D. Forensic expert witness
D. Forensic expert witness
Which of the following best describes chain of custody?
A. Delegating evidence collection to your superior
B. Preserving, protecting, and documenting evidence
C. Capturing a system image to another disk
D. Capturing memory contents before hard disk contents
B. Preserving, protecting, and documenting evidence
In working on an insider trading case, you are asked to prove that an e-mail message is authentic and was sent to another employee. Which items should you consider? (Choose two.)
A. Was the message encrypted?
B. Was the message digitally signed?
C. Are user public keys properly protected?
D. Are user private keys properly protected?
B. Was the message digitally signed?
&
D. Are user private keys properly protected?
What type of evidence would be the most difficult for a perpetrator to forge?
A. IP address
B. MAC address
C. Cell phone SIM card
D. Documents on a USB flash drive
C. Cell phone SIM card
What is the purpose of disk forensic software? (Choose two.)
A. Using file encryption to ensure copied data mirrors original data
B. Using file hashes to ensure copied data mirrors original data
C. Protecting data on the original disks
D. Creating file hashes on the original disks
B. Using file hashes to ensure copied data mirrors original data
&
C. Protecting data on the original disks
You are preparing to gather evidence from a cell phone. Which of the following is false?
A. CDMA mobile devices do not use SIM cards.
B. CDMA mobile devices store user data on the mobile device.
C. GSM mobile devices do not use SIM cards.
D. GSM mobile devices use SIM cards.
C. GSM mobile devices do not use SIM cards.
You must analyze data on a digital camera’s internal memory. You plan to connect your forensic computer to the camera using a USB cable. What should you do to ensure you do not modify data on the camera?
A. Ensure the camera is turned off.
B. Flag all files on the camera as read-only.
C. Log in with a nonadministrative account on the forensic computer.
D. Use a USB write-blocking device.
D. Use a USB write-blocking device.
What can be used to ensure seized mobile wireless devices do not communicate with other devices?
A. SIM card
B. Faraday bag
C. Antistatic bag
D. GPS jammer
B. Faraday bag
Robin works as a network technician at a stock brokerage firm. To test network forensic capturing software, she plugs her laptop into an Ethernet switch and begins capturing network traffic. During later analysis, she notices some broadcast and multicast packets as well as only her own computer’s network traffic. Why was she unable to capture all network traffic on the switch?
A. She must enable promiscuous mode on her NIC.
B. She must disable promiscuous mode on her NIC.
C. Each switch port is an isolated collision domain.
D. Each switch port is an isolated broadcast domain.
C. Each switch port is an isolated collision domain.
A network intrusion detection device captures network traffic during the commission of a crime on a network. You notice NTP and TCP packets from all network hosts in the capture. You must find a way to correlate captured packets to a date and time to ensure the packet captures will be considered as admissible as evidence. What should you do? (Choose two.)
A. Nothing. NTP keeps time in sync on a network.
B. Nothing. Packet captures are time stamped.
C. Without digital signatures, date and time cannot be authenticated.
D. Without encryption, date and time cannot be authenticated.
A. Nothing. NTP keeps time in sync on a network.
&
B. Nothing. Packet captures are time stamped.
You arrive at a scene where a computer must be seized as evidence. The computer is powered off and has an external USB hard drive plugged in. What should you do?
A. Turn on the computer.
B. Unplug the external USB hard drive.
C. Thoroughly document the state of the equipment.
D. Place the computer in a Faraday bag.
C. Thoroughly document the state of the equipment.
You are asked to examine a hard disk for fragments of instant messaging conversations as well as deleted files. How should you do this?
A. Use bit stream copying tools.
B. Log in to the computer and copy the original hard drive contents to an external USB hard drive.
C. Map a drive across the network to the original hard drive and copy the contents to an external USB hard drive.
D. View log files.
A. Use bit stream copying tools.
Which type of file is most likely to contain incriminating data?
A. Password-protected Microsoft Word file
B. Encrypted Microsoft Word file
C. Digitally signed Microsoft Word file
D. File hash of Microsoft Word file
B. Encrypted Microsoft Word file
How can a forensic analyst benefit from analyzing metadata? (Choose three.)
A. JPEG metadata can reveal specific camera settings.
B. Microsoft Word metadata can reveal the author name.
C. Microsoft Excel metadata can reveal your MAC address.
D. PDF metadata can reveal the registered company name.
A. JPEG metadata can reveal specific camera settings.
&
B. Microsoft Word metadata can reveal the author name.
&
D. PDF metadata can reveal the registered company name.
Which of the following rules must be followed when performing forensic analysis? (Choose two.)
A. Work only with the original authentic data.
B. Work only with a copy of data.
C. Seek legal permission to conduct an analysis.
D. Seek your manager’s permission to conduct an analysis.
B. Work only with a copy of data.
&
C. Seek legal permission to conduct an analysis.
