Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CHFI > Targeted > Flashcards

Targeted Flashcards

(62 cards)

Start Studying
1
Q

What allows for a lawful search to be conducted without a warrant or probable cause?

A

Consent of person with authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When is warrantless seizure of evidence justified?

A

When destruction of evidence is imminent and there is probable cause that the seized item is evidence of criminal activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When can an investigator collect evidence without formal consent?

A

When properly worded banners are displayed on a computer screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a web app threat in which the application unintentionally reveals sensitive information to an unauthorized user?

A

Information Leakage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of information can be found in a common metadata field for a file?

A

Network name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which registry key can be analyzed to retrieve folder information?

A

BagMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which registry key tracks files that have been opened or saved within a Windows shell dialog box?

A

OpenSaveMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which registry key may shed light on a user’s activity in a system and can indicate execution of a program or script on a device?

A

RunMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which file format is being viewed if the first hex characters are 42 4D?

A

BMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which file format is being viewed if the first hex characters are 47 49 46 38?

A

GIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which file format is being viewed if the first hex characters are 89 50 4e 47?

A

PNG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which file format is being viewed if the first hex characters are ff d8 ff?

A

JPEG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which file format is being viewed if the first hex characters are 25 50 44 46?

A

PDF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which file format is being viewed if the first hex characters are d0 cf 11 e0 a1 b1 1a e1?

A

XLS, DOC, or PPT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which file format is being viewed if the first hex characters are 50 4b 03 04 14 00 06 00?

A

XLSX, DOCX, or PPTX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which file format is being viewed if the first hex characters are 4e 42 2a 00?

A

JNT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which file format is being viewed if the first hex characters are 50 4b 03 04?

A

ZIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which file format is being viewed if the first hex characters are 52 61 72 21 1a 07?

A

RAR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which file format is being viewed if the first hex characters are 30 26 b2 75 8e 66 cf 11?

A

WMV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which file format is being viewed if the first hex characters are 52 49 46 46?

A

AVI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which file format is being viewed if the first hex characters are 49 44 33 03?

A

MP3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which file format is being viewed if the first hex characters are 49 20 49?

A

TIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which software tool is designed strictly for maintaining the integrity of evidence during data acquisition?

A

SAFE Block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the difference between the NIST SP 800-88 recommended types of sanitization, clear, purge, and destroy?

A

clear: sanitizes media but does not guarantee infeasible recover. allows media reuse.
purge: sanitizes media and guarantees infeasible recovery. allows media reuse.
destroy: destroys media and guarantees infeasible recovery. media not reusable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are the 3 types of data files MSSQL server stores data and logs in?
Primary data files (MDF) secondary data files (NDF) transaction log data files (LDF)
26
Which MySQL utility program is used to dump single or multiple databases for backup purposes?
Mysqldump
27
Which MySQL utility program is used to check the access privileges defined for a hostname or username?
Mysqlaccess
28
Which MySQL utility program is used to process the MyISAM log file and perform recovery operation, display version information, etc?
myisamlog
29
Which MySQL utility program is used to obtain the status of the MyISAM table, identify the corrupted tables, repair the corrupted tables, etc.?
Myisamchk
30
Which MySQL utility program is used to display the content of bin logs (mysql-bin.nnnnnn) in text format?
Mysqlbinlog
31
Which MySQL utility program is used to export metadata, data, or both from one or more databases?
mysqldbexport
32
What python-based tool can be used to analyze suspect MS Office Documents?
oleid
33
What are the different types of logon events?
2: Interactive (user logged on) 3: Network (logged on from network) 4: Batch 5: Service (service started by service control manager) 7: Unlock 8: NetworkCleartext (logged on from network, PW passed unhashed) 9: NewCredentials (cloned current token and specified new credentials for outbound connections 10: RemoteInteractive (User logged on remotely) 11: CachedInteractive (user logged on with cached network credentials
34
What are the two components of an Apache Web Server?
Apache Core: basic functionalities such as allocation of requests and connection maintenance Apache Modules: Add-ons used for extending core functionality
35
What are the elements of the Apache core component?
http_protocol: responsible for managing routines http_main: handles server startup and timeouts as well as main server loop http_request: controls stepwise procedure followed among modules to complete client request as well as error handling http_core: Includes a header file thaht is not required by the app module Alloc.c: handles allocation of resource pools http_config: reads and handles configuration files and arranges the modules
36
What are the two types of Apache Web Server logs?
Access log: records all requests processed by server | error log: diagnostic information and errors the server faced during requests
37
Which program may be used to convert a dd image into a bootable VM?
QEMU disk image utility
38
What TSK command is used to odisplay general details of a file system?
fsstat
39
What TSK command is used to display the details of a metadata structure?
istat
40
What TSK command is used to display the file and directory names in a disk?
fls
41
What TSK command is used to display the details of an image file?
img_stat
42
What is Windows Event ID 4688?
A new process has been created
43
What is Windows Event ID 5156?
Windows Filtering Platform has allowed connection (outbound network connection)
44
What is Windows Event ID 7045?
Service was installed in the system
45
What is Windows Event ID 4657?
Registry value was modified
46
What is Windows Event ID 4660?
Object was deleted (such as account name, domain, process ID, etc.)
47
What is Windows Event ID 4663?
An attempt was made to access an object
48
What is Windows Event ID 7036?
Windows Protection Service has entered the stopped state
49
What is Windows Event ID 7040?
The start of Windows Protection Service was changed from autostart to demand start/auto start disabled
50
Which utility may be used to acquire Mozilla Thunderbird data?
SysTools MailPro+
51
What is the minimum Linux kernel version to support ext4?
2.6.19
52
What is file carving?
technique to recover files and fragments of files from a hard disk in the absence of file system metadata
53
What application should be used for file carving in Windows?
R-Studio, Autopsy, Recover My Files, Ease US Data Recovery Wizard, WinUndelete, R-Undelete
54
What application should be used for file carving in Linux?
R-Studio, Mondo Rescue, Scalpel, Autopsy, Foremost, PhotoRec
55
What application should be used for file carving in macOS?
AppleXsoft File Recovery, 321Soft Data Recovery, Disk Doctors, Disk Drill, R-Studio, Data Rescue 4, Mac Data Recovery Guru
56
What is RAID 0?
Striping only, no redundancy. Min 2 drives
57
What is RAID 1?
Mirroring only. Requires even number of drives
58
What is RAID 2?
Bit-level striping. Better data-integrity, but slower than RAID 0
59
What is RAID 3?
Byte-level striping and dedicated parity disk. Requires at least 3 drives
60
What is RAID 5?
Byte-level striping and distributed parity among drives. Data writing is slow. Min 3 drives
61
What is RAID 6?
Double parity RAID. Data striped across multiple drives and uses dual parity for better redundancy than RAID 5. Min 4 drives.
62
What is RAID 10?
Combo of 0 and 1. Min 4 drives. Includes fault tolerance of RAID 1 and includes redundancy through mirroring

CHFI (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions