312-49v10 V1

To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software.

What group is actively providing tools and creating procedures for testing and validating computer forensics software?
A . Computer Forensics Tools and Validation Committee (CFTVC)
B. Association of Computer Forensics Software Manufactures (ACFSM)
C. National Institute of Standards and Technology (NIST)
D. Society for Valid Forensics Tools and Testing (SVFTT)

View Answer

Answer: C

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system.

What would be the primary reason for you to recommend a disk imaging tool?
A . A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
C. A simple DOS copy will not include deleted files, file slack and other information
D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

View Answer

Answer: C

The use of warning banners helps a company avoid litigation by overcoming an employee assumed __________________________. When connecting to the company’s intranet, network or Virtual Private Network (VPN) and will allow the company’s investigators to monitor, search and retrieve information stored within the network.
A . Right to work
B. Right of free speech
C. Right to Internet Access
D. Right of Privacy

View Answer

Answer: D

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity.

After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?
A . The manufacturer of the system compromised
B. The logic, formatting and elegance of the code used in the attack
C. The nature of the attack
D. The vulnerability exploited in the incident

View Answer

Answer: B

In General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.
A . Network Forensics
B. Data Recovery
C. Disaster Recovery
D. Computer Forensics

View Answer

Answer: D

George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan.

Why would a scanner like Nessus is not recommended in this situation?
A . Nessus is too loud
B. Nessus cannot perform wireless testing
C. Nessus is not a network scanner
D. There are no ways of performing a "stealthy" wireless scan

View Answer

Answer: A

You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?
A . 70 years
B. the life of the author
C. the life of the author plus 70 years
D. copyrights last forever

View Answer

Answer: C

What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?
A . rootkit
B. key escrow
C. steganography
D. Offset

View Answer

Answer: C

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?
A . digital attack
B. denial of service
C. physical attack
D. ARP redirect

View Answer

Answer: B

To preserve digital evidence, an investigator should ____________________.
A . Make two copies of each evidence item using a single imaging tool
B. Make a single copy of each evidence item using an approved imaging tool
C. Make two copies of each evidence item using different imaging tools
D. Only store the original evidence item

View Answer

Answer: C