Computer Hacking Forensic Investigator (CHFI) Exam Practice

Which forensic imaging tool is pre-installed on many Linux distributions?

Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to instructions written in assembly language. Which tool should he use for this purpose?

Callen, a forensics officer, was tasked with investigating a recent security incident at an organization. To protect the evidence, Callen maintained a logbook of the project to record observations related to the evidence, used tagging to uniquely identify any evidence, and created a chain of custody record. Identify the investigation step performed by Callen in the above scenario.

Which of the following techniques involves the analysis of logs to detect and study an incident that may have already occurred in a network or device?

What does "slack space" refer to in a file system?

Which tool can be used to detect rogue devices on a network?

What does the superblock in Linux define?

The following regular expression can be used for detecting a typical SQL injection attack: /\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix Identify the signature in the above expression that searches for the word “or” with various combinations of its hex values (both uppercase and lowercase combinations).

Which of the following cloud computing threats arises from improper resource isolation, data storage in multiple jurisdictions, and lack of knowledge on jurisdictions?

Which type of attack relies on intercepting and altering communications between two parties?

Which of the following Azure logs are a type of Azure platform logs that record information on the Azure subscription layer as well as the write operations performed on Azure resources?

The file content of evidence files can be viewed using the View Pane. The View pane provides several tabs to view file content. Which of these tabs provides native views of formats supported by Oracle Outside In technology?

As a Computer Hacking Forensic Investigator, you are analyzing an intrusion incident involving fileless malware delivered via a malicious Word document through phishing. What is the most effective step to disrupt the infection chain?

Williams collected evidence, eliminated the root cause, and closed attack vectors. Which phase is this?

Which approach helps identify relay systems and gathers data from forensic events?

Which attack exploits "http" to access unauthorized directories?

Which EDRM stage involves policies to handle/safeguard electronic data?

What field is a lay witness considered an expert in?

In which RAID level is disk mirroring done?

What does ARP stand for?

Which service helps identify the domain of an IP and its point of contact?

What is the main purpose of digital evidence preservation?

What is a cold boot attack?

Which EFS component uses LPC between LSA and the kernel?

In an APT cybercrime investigation involving global devices, what is the most effective method to manage complex digital evidence?

Which tool extracts LM and NTLM password hashes from the SAM database?

What issue arises from mishandling digital evidence during investigation?

Which Cisco IOS mnemonic indicates a packet matched a log rule in an access list?

Which is a live forensics method?

Which Windows registry datatype stores encoded info?

What is the function of a MAC address?

Which ISO standard addresses electronic discovery (eDiscovery)?

Xavier found the attacker used proxies and a fake identity. What challenge does this represent?

What is the primary function of a honeypot?

Which hashing algorithms are used in forensics?

Mike found the crime scene computer was turned off. What should he do?

Which Apache component handles routines and data exchange with clients?

Which tool is commonly used for network traffic analysis?

Which SSD component is volatile and enhances read/write speed?

Which IoT architecture layer contains hardware components like sensors, RFID tags, and readers?

Which eDiscovery method involves creating bit-by-bit forensic images of devices?

What is the maximum length of an MD5 hash?

Which tool is used to create bit-by-bit disk images?

Which tool helps recover deleted emails from Outlook and Thunderbird?

Which file type starts with hex: 25 50 44 46?

What is the role of a digital forensic investigator?

Which tool helps intercept and log network traffic?

Which OWASP risk involves sending untrusted data to an interpreter?

In evidence transfer, do sender and receiver need to record the date and time?

Which password-cracking technique tries every possible combination of characters?

Which cloud service does Kellan use for scheduling interviews with automatic notifications?

What is a primary responsibility of a forensic investigator when handling digital evidence?

What is the difference between hashing and encryption?

Which tool helps in extracting data from a smartwatch for forensic investigation?

Which type of malware replicates itself to spread across systems?

Which protocol is used to securely transfer files over the Internet?

What is the hex equivalent of the character `)` in the URL-encoded string `%3Cscript%3Ealert%28XSS%29%3C%2Fscript%3E`?

Which Azure CLI command is used to provide time-specific read-only access to a snapshot?

Which methodology is best for acquiring volatile data from a live Linux system with limited physical access?

Which investigation step has Kannon performed when securing devices affected during an attack for further investigation?

Which of the following is NOT a common type of digital evidence?

What is the main advantage of using cloud-based forensic tools?

Which log file type contains records of all system events on a Windows machine?

What is the primary function of volatile memory?

Which method do attackers often use to compress, encrypt, or modify a malware executable file to avoid detection?

What type of external attack is performed when an attacker uses deceptive emails to obtain sensitive information?

Which approach helps investigators identify if a system serves as a relay to a hacker and helps gather forensic event data?

In the context of malware analysis, what does a sandbox environment provide?

Which file signature verification utility helps check the integrity of critical files on Windows?

Which of the following is a common type of cyberattack?

What type of malware captures keystrokes?

Identify the correct sequence of steps involved in the forensic acquisition of an Amazon EC2 instance.

Which section of the ACPO Principles of Digital Evidence states that no action should change data that may be relied upon in court?

Identify the malware distribution technique in which attackers use tactics to improve the ranking of malware pages.

Which command is used to delete a file in Linux?

The role of a forensic investigator is to:

Which of the following would NOT typically be acquired during the dead acquisition technique?

Printing under a Windows Computer normally requires which one of the following file types to be created?

For the purpose of cracking password-protected files, Bob initiated a technique that attempts every combination of characters. Identify the technique.

Which protocol is used by networked systems to translate domain names into IP addresses?

Which of the following challenges of cybercrime is demonstrated by an attacker using proxies and a fake identity?

Which of the following commands will help John get the count of all NetBIOS names resolved by broadcast by querying a WINS server?

Which component of an SSD is volatile memory and requires power to retain data?

Kevin used Tor browser for illegal activities. Which type of web was accessed by Kevin?

Which Windows command can list all active processes?

Maria wants to see if an executable file adds or modifies any registry values after execution. Which event ID should she look for in Windows Event Viewer?

Which of the following Azure logs records information on the Azure subscription layer and write operations on Azure resources?

Which online service helps forensic investigators determine the domain name of an IP address and obtain the point of contact for the domain?

Which U.S. law requires financial institutions to protect customer information against security threats?

Which Tor relay is used for transmitting data in an encrypted format and passing it from the entry relay to the exit relay?

Which investigation step did Callen perform by maintaining a logbook, tagging evidence, and creating a chain of custody record?

What activity did James perform by obtaining documented permission from the device owner to conduct the investigation?

Which command allows investigators to mount an APFS image and view its contents on a Linux system?

What methodology is most suitable for acquiring volatile data from a live Linux system with limited physical access?

What obfuscation method did the attacker use by utilizing “%0b” characters to bypass firewall protection?

Which artifact helps an investigator explore the Tor browser when it is uninstalled or installed in a location other than the Windows desktop?

Which is the correct sequence of stages involved in the first response by laboratory forensic staff?

Which dcfldd command is used by investigators to compare an image file to the original medium (like a drive or partition)?

Which technique is used by attackers to confuse and mislead the forensic investigation process, including log tampering, false email headers, timestamp modification, and file header modifications?

In Java, which process enables low memory consumption and quick start-up times by using a single instance of the Dalvik Virtual Machine?

Which registry datatype in a Windows system is used for storing encoded information?

Which of the following is NOT a valid hashing algorithm?

Which technique involves analyzing logs to detect and study an incident that has already occurred in a network or device?

Which aspect of the Tor network should an investigator focus on primarily to trace the origin of a data transmission?

Which registry location stores Tor browser artifacts and can provide information on user activities on the dark web?

In which forensic data acquisition step do investigators overwrite data with sequential zeros or ones to protect it from recovery?

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

What is the primary role of a write blocker in digital forensics?

Joey, a forensics analyst, found a security event with Event ID 4758 while analyzing logs. What event did Joey identify?

What is the default port for SSH?

In which step of forensic readiness planning do investigators determine what happens to potential evidence data and its impact on the business?

Which practice is associated with scene assessment in ENFSI best practices for forensic examination?

Which of the following AWS services helps forensic investigators to monitor and analyze various log sources, such as Amazon S3 logs, CloudTrail management event logs, DNS logs, etc., to identify security threats?

Which of the following types of jailbreaks allows users to reboot the iOS device any number of times because after every reboot, the device gets jailbroken automatically?

What is the primary purpose of timestamps in digital forensics?

Identify the `dcfldd` command that investigators use to compare an image file to the original medium, such as a drive or partition.

What is the primary purpose of the tool Cain & Abel in forensic investigations?

Which of the following eDiscovery team members performs the deployment of tools on a suspected computer machine and configures, implements, and maintains the deployed tools?

Identify the correct sequence of steps involved in the forensic acquisition of persistent disk volumes (GCP):

In the `netstat` command, which parameter is used to display active TCP connections and includes the Process ID (PID) for each connection?

Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where 'x' represents the ________.

Which forensic technique is used to reconstruct a file system from damaged storage media?

What does the 'traceroute' command do?

Which Linux command can be used to view all active network connections?

Which of the following PowerPoint streams contains information about the presentation layout and its contents?

Which of the following fields of an IIS log entry can be reviewed to determine whether a request made by a client is fulfilled without an error?

Which Windows command is used to check the IP configuration of a system?

What is the role of the forensic investigator?

What type of analysis is performed when reviewing DNS cache to check domain contact attempts?

Which tool assists investigators in retrieving deleted emails from Outlook and Thunderbird?

Identify the SQLite file that contains logged-in users on Alexa devices and gets cleared upon logout.

Which Azure CLI command provides time-limited read-only access to a snapshot?

Which of the following tools is used for recovering deleted files?

After snapshotting a malware-infected EC2 instance, what should the forensics team do next?

In cases involving APTs, what's the best way to manage complex digital evidence?

Which forensic technique involves hashing and comparing binaries?

Which attack exploits a buffer overflow?

What does TSK stand for in digital forensics?

Which command converts E01 image files to dd format on Linux?

Which is NOT a characteristic of volatile memory?

Which tool allows forensic investigators to perform Apache log analysis?

What is a common tool used for network traffic analysis?

What data acquisition method is used when collecting evidence from a powered-off system?

Which is NOT a common type of digital evidence?

Which of the following is a common cyberattack?

What do security cameras, badges, and fire extinguishers represent in a forensics lab?

The offset in a hexadecimal code is:

Which tool shows related modules in an executable and builds a tree of functions?

Which incident response phase includes eliminating the root cause and closing attack vectors?

What is the right combo of Event IDs for account creation, privilege escalation, and service install?

Which tool identifies file extension mismatches to assist forensic investigations?

Which `nbtstat` command gets the count of NetBIOS names resolved by broadcast?

What does 'anti-forensics' refer to?

Which registry keys track a user's folder viewing preferences?

Which Event ID shows allowed connection via UDP/TCP by Windows Filtering Platform?

Which is a volatile storage medium?

What is the process of recovering deleted files from storage?

What is the smallest allocation unit on a hard disk made up of multiple sectors?

A lay witness is considered an expert in what field?

Which correlation approach compares all fields systematically for both positive and negative matches?

Which event log type is used by batch servers executing processes without user interaction?

Where in the registry are Tor browser artifacts stored?

Which tool helps reverse machine code to assembly?

Which ISO standard covers electronic discovery processes?

What should a forensics team do after taking an EBS snapshot of a compromised EC2 instance?

Which Federal Rule promotes fair trials and efficiency in evidence law?

What's a common method to detect rootkits?

What defines how investigators are expected to act during cases?

What describes an organization’s ability to efficiently handle digital evidence?

What is a common Linux file system?

Which layer in the IoT architecture consists of hardware components, including sensors, RFID tags, and readers?

Which tool allows forensic investigators to extract web activity information such as event timestamp, port, server status code, etc.?

Which component in the Microsoft Excel file structure holds information about each workbook’s features?

Which Apache core element manages routines, interacts with clients, and handles data exchange and socket connections?

Which program allows bundling all files together into a single executable file via compression to bypass security software?

Which approach helps investigators identify if a system serves as a relay for a hacker and gather event data?

Which command allows investigators to mount an image in the APFS format and view its contents on a Linux system?

Which hashing algorithm is commonly used in digital forensics?

Which of the following is a common tool used for network traffic analysis?

What is the purpose of chain of custody documentation?

What is the purpose of the MAC address in a network?

Which layer of the OSI model is responsible for data encryption?

Which of the following is a legal document that demonstrates the progression of evidence from its original location to the forensic laboratory?

Which type of digital data stores a document file on a computer when it is deleted and helps in the process of retrieving the file until that file space is reused?

What is the purpose of hashing in digital forensics?

Which role is played by international agencies when cybercrime crosses state or international borders and requires sharing information and resources with other state agencies?

Which of the following challenges of cybercrime is demonstrated when the attacker hides their IP address using proxies and uses a fake identity for communication?

Which device is responsible for translating internal private IP addresses to a public IP address?

Which of the following practices indicates that an organization is not forensically prepared to maintain business continuity?

Which of the following factors of cloud forensics involves assisting organizations in following appropriate rules and adhering to requirements such as securing critical data, maintaining records for audit, and notifying the parties affected by sensitive data exposure?

Which of the following tools helps Rowen to acquire data remotely?

Identify the process that involves discovering, protecting, collecting, reviewing, and presenting electronically stored information (ESI) during an investigation.

Which stage in the booting process of a Linux system establishes a temporary root file system using the initial RAM disk (initrd) until the real file system is mounted?

Mike, a forensic investigator, finds a computer at the crime scene that is switched off. What should he do?

Which forensic artifact would indicate the last time a user logged in to a system?

What is the primary role of EnCase in digital forensics?

What does ARP stand for in networking?

Thomas, a forensics specialist, was resolving a case related to fake email broadcasting. He retrieved data from the victim system for analysis to find the source of the email server. He extracted only “.ost” files for this purpose. What type of data acquisition did Thomas perform?

What is the purpose of hash functions in digital forensics?

In what scenario would a forensic investigator use the tool Wireshark?

Which of the following registry datatypes in a Windows system is used for storing encoded information?

Which of the following techniques refers to the process of discovering the existence of hidden information within a cover medium?

Which hashing algorithm is widely used in digital forensics?

Which attack technique is the combination of both a brute-force attack and a dictionary attack to crack a password?

Which file system is case-sensitive by default?

Williams, a forensics specialist, analyzed a malware sample in binary format using OllyDbg to identify the language and functions. What malware analysis technique did Williams use?

What is the primary function of the tool Autopsy in digital forensics?

A forensic investigator is analyzing a Windows 10 machine that has crashed several times in the past week. What should be the investigator's most immediate action?

Bob, a forensic expert, wants to examine image files in the E01 format on his Linux machine. Which command can he use to convert the E01-format files into the dd format?

What does a "boot sector" virus target?

What is the name of the process of making a bit-by-bit copy of a digital device?

Bob discovered password-protected files during a forensic investigation and initiated a password-cracking technique that tries every possible combination of characters until the password is cracked. Which technique did Bob use?

Which of the following is a common type of malware that replicates itself?

Which of the following is an 802.11 network discovery tool that gathers information about nearby wireless APs in real-time and displays it in different diagnostic views and charts?

Which of the following is an open-source forensic tool that enables the reliable extraction of the entire contents of a computer’s volatile memory, even if protected by an active anti-debugging or anti-dumping system?

Identify the malware distribution technique using which attackers use tactics such as keyword stuffing, doorway pages, page swapping, and the addition of unrelated keywords to get a higher ranking on the web for their malware pages.

Which of the following is a dedicated high-speed network that provides access to consolidated block-level storage, independent of network traffic?

In the OSI model, at which layer does packet filtering occur?

Which of the following refers to the process of the witness being questioned by the attorney who called the latter to the stand?

What is the main difference between TCP and UDP?

Which of the following is a common tool for analyzing network traffic?

Which of the following issues in computer forensics might arise because of improper handling of evidence during an investigation, making the evidence inadmissible in a court of law?

Which of the following files has 25 50 44 46 as the first characters in hexadecimal representation?

In which RAID level disk mirroring is done?

As a Computer Hacking Forensic Investigator, you are analyzing an intrusion incident involving fileless malware delivered via a malicious Word document. Which step would be most effective to disrupt the infection chain?

What is the role of a swap file in a computer system?

Andrew is performing a UEFI boot process. The current phase consists of initialization code that executes after powering on the system. Which UEFI boot phase is this?

Which process involves the technical methods and organizational measures for discovering, tracing, and inculpating individuals or groups responsible for cyberattacks?

John, a forensic investigator, needs to get the count of all NetBIOS names resolved by broadcast by querying a WINS server. Which command should he use?

Which of the following layers in the IoT architecture consists of all the hardware components, including sensors, RFID tags, and readers, and plays an important part in data collection and connecting devices within the network?

Which hashing algorithm is considered the most secure among the options below?

Since Hillary is a lay witness, what field would she be considered an expert in?

What is a key advantage of forensic imaging over direct analysis?

Which tool is commonly used for sniffing network packets?

Which of the following sections of the (ACPO) Principles of Digital Evidence states that no action taken by law enforcement agencies should change data that may subsequently be relied upon in court?

Which port is used for HTTPS traffic?

Identify the default location in Fedora Linux from which Clark obtained system access logs.

Which of the following U.S. laws requires financial institutions to protect their customers' information against security threats?

Kannon, a forensics specialist, secured affected devices for further investigation. Which investigation step did Kannon perform?

During an investigation, you locate evidence that may prove the innocence of the suspect. What type of evidence is this?

Which of the following tools assists investigators in retrieving deleted email messages from Outlook and Thunderbird email clients?

Which port does FTP use for active data transfer?

Which of the following is a proprietary information security standard for organizations that handle cardholder information for major debit, credit, prepaid, e-purse, ATM, and POS cards?

Which of the following tools can be used to analyze network traffic?

What countermeasures could George take to prevent DDoS attacks?

Which feature will you disable to eliminate the ability to enumerate model, OS version, and capabilities on Cisco routers?

Which of the following is an open-source forensics tool that allows investigators to extract and analyze artifacts from PCAP, PcapNG, and ETL packet captures?

What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceedings?

In which of the following attacks does an attacker exploit “http” to gain access to unauthorized directories and execute commands outside the web server’s root directory?

Which type of cyberattack exploits a buffer overflow vulnerability?

Which of the following roles is played by international agencies when cybercrime crosses state or international borders and requires them to share information and resources with other state agencies?

What is the primary purpose of digital evidence preservation?

Which of the following parameters in the Apache common log format represents the client’s IP address?

Which of the following components of EFS is a part of the security subsystem and acts as an interface with the EFS driver by using a local procedure call (LPC) communication port between the local security authority (LSA) and the kernel-mode security reference monitor?

Which of the following is NOT a characteristic of volatile memory?

In digital forensics, which file format is commonly used for creating forensic images of a drive?

Which of the following files in a Windows system helps forensic investigators analyze and identify the historical data for executables run in the system?

Maria has executed a suspicious executable file in a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for in this scenario?

Which of the following tools helps investigators expand investigations by allowing the capture of an entire social media account or timeline from which they can search the captured OCR PDF or MHTML file for related content?

Carlos, a forensic analyst, was investigating a system that was compromised earlier. He started the investigation process by extracting the Apache access log entries and searching for malicious HTML tags or their hex equivalents in HTTP requests. Carlos identified some encoded values, such as %3Cscript%3Ealert%28XSS%29%3C%2Fscript%3E in the query string. He assumed it was an XSS attack and decoded them. Which of the following characters represents the hex equivalent %29 in the above scenario?

Select the tool appropriate for finding the dynamically linked lists of an application or malware.

When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

If you come across a sheepdip machine at your client site, what would you infer?

In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive.org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772 03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84 Len: 64 - 01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 . ............. 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 . .............. 00 00 00 11 00 00 00 00 ........ 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 - 47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8

You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?

What file structure database would you expect to find on floppy disks?

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

When examining a file with a Hex Editor, what space does the file header occupy?

In the context of file deletion process, which of the following statement holds true?

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

A(n) _____________________ is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

Which part of the Windows Registry contains the user's password file?

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

Lance wants to place a honeypot on his network. Which of the following would be your recommendations?

What does the acronym POST mean as it relates to a PC?

Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as it is collected by other members of your team. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

The MD5 program is used to:

Which is a standard procedure to perform during all computer forensics investigations?

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?

“To ensure that the evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effective quality system” is a principle established by:

Chloe is a forensic examiner who is currently cracking hashed passwords for a crucial mission and hopefully solve the case. She is using a lookup table used for recovering a plain text password from cipher text; it contains word list and brute-force list along with their computed hash values. Chloe is also using a graphical generator that supports SHA1. (a) What password technique is being used? (b) What tool is Chloe using?

To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

Which standard is used during a judicial trial to assess whether an expert witness’s scientific testimony is based on scientifically valid reasoning that can adequately be applied (admissible) to the facts under consideration?

Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration, and critical system files, and then execute commands outside of the web server’s root directory?

Which of the following is considered as the starting point of a databases and stores user data and database objects in an MS SQL Server?

Which of the following methods of mobile device data acquisition captures all the data present on the device, as well as all deleted data and access to unallocated space?

During an investigation, Noel found a SIM card from the suspect's mobile. The ICCID on the card is 8944245252001451548. What does the first four digits (89 and 44) in the ICCID represent?

Which of these Windows utilities helps you to repair logical file system errors?

When analyzing logs, it is important that the clocks of all the network devices are synchronized. Which protocol will help in synchronizing these clocks?

During the course of his investigation, Vincent came across a situation where he needs to run a packet sniffing tool on a Linux-based machine to monitor the network traffic. Which tool should Vincent choose in this case?

Rule 1002 of Federal Rules of Evidence (US) talks about _____

Which of the following applications will allow a forensic investigator to track the user login sessions and user transactions that have occurred on an MS SQL Server?

You are an information security analyst for a national retail chain. The organization has a web server which provides customer reports to internal users for marketing purposes. You are analyzing IIS logs on the web server and find the following log entry: #Software: Microsoft Internet Information Services 7.5 #Version 1.0 #Date 2020-04-28 11:50:54 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken 2020-04-28 11:50:54 192.168.1.39 GET /Data/Files/customer_report.xlsx 80 – 192.168.1.200 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22 200 0 0 54 Based on the contents of this log entry, what occurred?

Donald made an OS disk snapshot of a compromised Azure VM under a resource group being used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What is the next thing he should do as a security measure?

You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a 'simple backup copy' of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a 'simple backup copy' will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

Sally accessed the computer system that holds trade secrets of the company where she is employed. She knows she accessed it without authorization and all access (authorized and unauthorized) to this computer is monitored. To cover her tracks, Sally deleted the log entries on this computer. What among the following best describes her action?

Which OWASP IoT vulnerability talks about security flaws such as lack of firmware validation, lack of secure delivery, and lack of anti-rollback mechanisms on IoT devices?

Which of the following directories contains the binary files or executables required for system maintenance and administrative tasks on a Linux system?

According to RFC 3227, which of the following is considered as the most volatile item on a typical system?

An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s"." -E as part of collecting the primary data file and logs from a database. What does the “WIN-CQQMK62867E” represent?

You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?

Jeff is a forensics investigator for a government agency's cybersecurity office. Jeff is tasked with acquiring a memory dump of a Windows 10 computer that was involved in a DDoS attack on the government agency's web application. Jeff is onsite to collect the memory. What tool could Jeff use?

An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine. What would he do to achieve this?

A forensic examiner encounters a computer with a failed OS installation and the master boot record (MBR) or partition sector damaged. Which of the following tools can find and restore files and information in the disk?

Choose the layer in iOS architecture that provides frameworks for iOS app development?

ISO/IEC 17025 is an accreditation for which of the following?

Recently, an internal web app that a government agency utilizes has become unresponsive. Betty, a network engineer for the government agency, has been tasked to determine the cause of the web application's unresponsiveness. Betty launches Wireshark and begins capturing the traffic on the local network. While analyzing the results, Betty noticed that a SYN flood attack was underway. How did Betty know a SYN flood attack was occurring?

You have been asked to investigate the possibility of computer fraud in the finance department of a company. It is suspected that a staff member has been committing finance fraud by printing cheques that have not been authorized. You have exhaustively searched all data files on a bitmap image of the target computer, but have found no evidence. You suspect the files may not have been saved. What should you examine next in this case?

Examination of a computer by a technically unauthorized person will almost always result in:

“No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court” — this principle is advocated by which of the following?

Which of the following statements is true regarding SMTP Server?

You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?

Debbie has obtained a warrant to search a known pedophile's house. Debbie went to the house and executed the search warrant to seize digital devices that have been recorded as being used for downloading illicit images. She seized all digital devices except a digital camera. Why did she not collect the digital camera?

To understand the impact of a malicious program after the booting process and to collect recent information from the disk partition, an investigator should evaluate the content of the:

Which of the following statements is TRUE about SQL Server error logs?

Assume there is a file named myfile.txt in C: drive that contains hidden data streams. Which of the following commands would you issue to display the contents of a data stream?

A computer forensics investigator or forensic analyst is a specially trained professional who works with law enforcement as well as private businesses to retrieve information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer. Which of the following is not a duty of the analyst during a criminal investigation?

Which command can provide the investigators with details of all the loaded modules on a Linux-based system?

Jack is reviewing file headers to verify the file format and hopefully find more information of the file. After a careful review of the data chunks through a hex editor; Jack finds the binary value 0xFFD8. Based on the above information, what type of format is the file/image saved as?

In which IoT attack does the attacker use multiple forged identities to create a strong illusion of traffic congestion, affecting communication between neighboring nodes and networks?

Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?

Malware analysis can be conducted in various manners. An investigator gathers a suspicious executable file and uploads it to VirusTotal in order to confirm whether the file is malicious, provide information about its functionality, and provide information that will allow to produce simple network signatures. What type of malware analysis was performed here?

Netstat is a tool for collecting Information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

Cybercriminals sometimes use compromised computers to commit other crimes, which may involve using computers or networks to spread malware or illegal information. Which type of cybercrime stops users from using a device or network, or prevents a company from providing a software service to its customers?

This law sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have you stop emailing them, and spells out tough penalties for violations.

Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?

Which of the following malware targets Android mobile devices and installs a backdoor that remotely installs applications from an attacker-controlled server?

Which layer in the IoT architecture is comprised of hardware parts such as sensors, RFID tags, and devices that play an important role in data collection?

At a trading organization, three employees receive email from a senior official at ABC bank asking them to urgently fill customer-specific details at the bank’s website. As the organization already has a partnership with bank, all the employees visited the website and updated customer-related information, such as their bank account details, confidential documents, and credit card information. After a day, all the concerned customers complained that large amounts of money has been spent using their credit cards and they cannot log into their bank accounts. What kind of attack is this?

Steve thought it would be funny to make some changes on Tom's computer at their office. Steve went into the Microsoft Windows registry and changed the keyboard mapping configuration on Tom’s computer. Now Tom is unable to log into his computer because of the changes. Could Steve’s actions warrant a cybercrime investigation?

Data is striped at a byte level across multiple drives and parity information is distributed among all member drives. What RAID level is represented here?

Brian has the job of analyzing malware for a software security company. Brian has setup a virtual environment that includes virtual machines running various versions of OSes. Additionally, Brian has setup separated virtual networks within this environment. The virtual environment does not connect to the company's intranet nor does it connect to the external Internet. With everything setup, Brian now received an executable file from client that has undergone a cyberattack. Brian ran the executable file in the virtual environment to see what it would do. What type of analysis did Brian perform?

Frank, a cloud administrator in his company, needs to take backup of the OS disks of two Azure VMs that store business-critical data. Which type of Azure blob storage can he use for this purpose?

During a forensic investigation, a large number of files were collected. The investigator needs to evaluate ownership and accountability of those files. Therefore, he begins to identify attributes such as “author name”, “organization name”, “network name”, or any additional supporting data that is meant for the owner’s identification purpose. Which term describes these attributes?

Simona has written a regular expression for the detection of web application-specific attack attempt that reads as /((\%3C)|<)((\%2F)| V)*[a-z0-9\%]+((\%3E)|>)/ix. Which of the following does the part ((\%3E)|>) look for?

An investigator is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1 -106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on interface outside What does %ASA-1-106021 denote?

A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evidence1.doc, sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin, what will happen to the data?

Which of the following is a requirement for senders as per the CAN-SPAM act?