Pregunta 1
Pregunta
The first 3 bytes of an XIF file are exactly the same as a TIF file.
Pregunta 2
Pregunta
Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.
Pregunta 3
Pregunta
Most digital cameras use the bitmap format to store photos.
Pregunta 4
Pregunta
When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.
Pregunta 5
Pregunta
Each graphics file type has a unique header value.
Pregunta 6
Pregunta
How many bits are required to create a pixel capable of displaying 65,536 different colors?
Pregunta 7
Pregunta
Which of the following is not considered to be a non-standard graphics file format?
Pregunta 8
Pregunta
All TIF files start at offset 0 with what 6 hexadecimal characters?
Respuesta
-
2A 49 48
-
FF 26 9B
-
49 49 2A
-
AC 49 2A
Pregunta 9
Pregunta
What kind of graphics file combines bitmap and vector graphics types?
Respuesta
-
metafile
-
bitmap
-
jpeg
-
tif
Pregunta 10
Pregunta
The process of converting raw picture data to another format is called _________________.
Respuesta
-
splicing
-
carving
-
demosaicing
-
vector quantization
Pregunta 11
Pregunta
What format was developed as a standard for storing metadata in image files?
Pregunta 12
Pregunta
Which of the following formats is not considered to be a standard graphics file format?
Pregunta 13
Pregunta
Select below the utility that is not a lossless compression utility:
Respuesta
-
PKZip
-
WinZip
-
StuffIt
-
Lzip
Pregunta 14
Pregunta
In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.
Respuesta
-
Huffman
-
Lempel-Ziv-Welch (LZW)
-
Vector Quantization
-
Adaptive Quantization
Pregunta 15
Pregunta
What file type starts at offset 0 with a hexidecimal value of FFD8?
Pregunta 16
Pregunta
How many different colors can be displayed by a 24 bit colored pixel?
Respuesta
-
256
-
65,536
-
16,777,216
-
4,294,967,296
Pregunta 17
Pregunta
The _____________ format is a proprietary format used by Adobe Photoshop.
Pregunta 18
Pregunta
For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
Pregunta 19
Pregunta
Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.
Respuesta
-
raster file format
-
bitmap file format
-
jpeg file format
-
raw file format
Pregunta 20
Pregunta
The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.
Respuesta
-
lossy
-
lossless
-
vector quantization
-
adaptive
Pregunta 21
Pregunta
For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.
Pregunta 22
Pregunta
Which graphics file format below is rarely compressed?
Respuesta
-
GIF
-
JPEG
-
BMP
-
None of the above
Pregunta 23
Pregunta
When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?
Respuesta
-
major significant bit (MSB)
-
least significant bit (LSB)
-
most significant bit (MSB)
-
leading significant bit (LSB)
Pregunta 24
Pregunta
What act defines precisely how copyright laws pertain to graphics?
Pregunta 25
Pregunta
Which of the following is not a type of graphic file that is created by a graphics program?
Respuesta
-
bitmap images
-
vector graphics
-
metafile graphics
-
raster graphics
Pregunta 26
Pregunta
Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.
Pregunta 27
Pregunta
One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.
Pregunta 28
Pregunta
The advantage of recording hash values is that you can determine whether data has changed.
Pregunta 29
Pregunta
In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.
Pregunta 30
Pregunta
Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing specific files or sectors.
Pregunta 31
Pregunta
What format below is used for VMware images?
Pregunta 32
Pregunta
In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?
Pregunta 33
Pregunta
Which password recovery method uses every possible letter, number, and character found on a keyboard?
Respuesta
-
rainbow table
-
dictionary attack
-
hybrid attack
-
brute-force attack
Pregunta 34
Pregunta
The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.
Respuesta
-
litigation
-
scope creep
-
criminal charges
-
violations
Pregunta 35
Pregunta
Which of the following file systems can't be analyzed by OSForensics?
Pregunta 36
Pregunta
In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.
Respuesta
-
format
-
fdisk
-
grub
-
diskpart
Pregunta 37
Pregunta
Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:
Respuesta
-
Last Bit
-
AccessData PRTK
-
OSForensics
-
Passware
Pregunta 38
Pregunta
Within Windows Vista and later, partition gaps are _____________ bytes in length.
Pregunta 39
Pregunta
Which option below is not a disk management tool?
Respuesta
-
Partition Magic
-
Partition Master
-
GRUB
-
HexEdit
Pregunta 40
Pregunta
Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.
Respuesta
-
hashing
-
bit-shifting
-
registry edits
-
slack space
Pregunta 41
Pregunta
A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.
Respuesta
-
compiler
-
shifter
-
macro
-
script
Pregunta 42
Pregunta
What letter should be typed into DiskEdit in order to mark a good sector as bad?
Pregunta 43
Pregunta
Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.
Respuesta
-
key vault
-
key escrow
-
bump key
-
master key
Pregunta 44
Pregunta
What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?
Respuesta
-
salted passwords
-
scrambled passwords
-
indexed passwords
-
master passwords
Pregunta 45
Pregunta
When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?
Respuesta
-
Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
-
Start the suspect's computer and begin collecting evidence.
-
The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
-
Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.
Pregunta 46
Pregunta
In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.
Respuesta
-
keygrabber
-
keylogger
-
packet capture
-
protocol analyzer
Pregunta 47
Pregunta
The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.
Pregunta 48
Pregunta
The term for detecting and analyzing steganography files is _________________.
Respuesta
-
carving
-
steganology
-
steganalysis
-
steganomics
Pregunta 49
Pregunta
A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.
Pregunta 50
Pregunta
The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.
Pregunta 51
Pregunta
Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.
Pregunta 52
Pregunta
Forensics tools can't directly mount VMs as external drives.
Pregunta 53
Pregunta
The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.
Pregunta 54
Pregunta
The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.
Pregunta 55
Pregunta
The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.
Pregunta 56
Pregunta
What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?
Respuesta
-
KVM
-
Parallels
-
Microsoft Virtual PC
-
VirtualBox
Pregunta 57
Pregunta
The __________ disk image file format is associated with the VirtualBox hypervisor.
Pregunta 58
Pregunta
What Windows Registry key contains associations for file extensions?
Respuesta
-
HKEY_CLASSES_ROOT
-
HKEY_USERS
-
HKEY_LOCAL_MACHINE
-
HKEY_CURRENT_CONFIG
Pregunta 59
Pregunta
In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters
Pregunta 60
Pregunta
The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?
Pregunta 61
Pregunta
Select below the option that is not a common type 1 hypervisor:
Respuesta
-
VMware vSphere
-
Microsoft Hyper-V
-
Citirix XenServer
-
Oracle VirtualBox
Pregunta 62
Pregunta
The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?
Respuesta
-
People
-
Technology
-
Operations
-
Management
Pregunta 63
Pregunta
The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.
Respuesta
-
netstat
-
ls
-
ifconfig
-
tcpdump
Pregunta 64
Pregunta
Select below the program within the PsTools suite that allows you to run processes remotely:
Respuesta
-
PsService
-
PsPasswd
-
PsRemote
-
PsExec
Pregunta 65
Pregunta
The tcpdump and Wireshark utilities both use what well known packet capture format?
Respuesta
-
Netcap
-
Pcap
-
Packetd
-
RAW
Pregunta 66
Pregunta
The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.
Respuesta
-
Tcpdstat
-
Tcpslice
-
Ngrep
-
tcpdump
Pregunta 67
Pregunta
The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.
Respuesta
-
Kali Linux
-
Ubuntu
-
OSForensics
-
Sleuth Kit
Pregunta 68
Pregunta
In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?
Respuesta
-
Show-NetworkAdapters
-
Query-ipconfig
-
Get-VMNetworkAdapter
-
Dump-Netconfig
Pregunta 69
Pregunta
What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?
Respuesta
-
.nvram
-
.vmem
-
.vmpage
-
.vmx
Pregunta 70
Pregunta
What processor instruction set is required in order to utilize virtualization software?
Pregunta 71
Pregunta
Select the file below that is used in VirtualBox to create a virtual machine:
Pregunta 72
Pregunta
The __________________ is the version of Pcap available for Linux based operating systems.
Respuesta
-
Winpcap
-
Libpcap
-
Tcpcap
-
Netcap
Pregunta 73
Pregunta
What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?
Respuesta
-
tcpdump
-
Argus
-
Ngrep
-
Tcpslice
Pregunta 74
Pregunta
At what layers of the OSI model do most packet analyzers function?
Respuesta
-
Layer 1 or 2
-
Layer 2 or 3
-
Layer 3 or 4
-
Layer 4 or 5
Pregunta 75
Pregunta
In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.
Respuesta
-
smurf
-
SYN flood
-
spoof
-
ghost
Pregunta 76
Pregunta
The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.
Pregunta 77
Pregunta
The Pagefile.sys file on a computer can contain message fragments from instant messaging applications.
Pregunta 78
Pregunta
In an e-mail address, everything before the @ symbol represents the domain name.
Pregunta 79
Pregunta
Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.
Pregunta 80
Pregunta
An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.
Pregunta 81
Pregunta
What command below could be used on a UNIX system to help locate log directories?
Respuesta
-
show log
-
detail
-
search
-
find
Pregunta 82
Pregunta
The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.
Respuesta
-
fixmail.exe
-
scanpst.exe
-
repairpst.exe
-
rebuildpst.exe
Pregunta 83
Pregunta
E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.
Respuesta
-
log recycling
-
circular logging
-
log purging
-
log cycling
Pregunta 84
Pregunta
Syslog is generally configured to put all e-mail related log information into what file?
Respuesta
-
/usr/log/mail.log
-
/var/log/messages
-
/proc/mail
-
/var/log/maillog
Pregunta 85
Pregunta
What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?
Pregunta 86
Pregunta
On a UNIX system, where is a user's mail stored by default?
Respuesta
-
/var/mail
-
/var/log/mail
-
/username/mail
-
/home/username/mail
Pregunta 87
Pregunta
Where does the Postfix UNIX mail server store e-mail?
Respuesta
-
/home/username/mail
-
/var/mail/postfix
-
/var/spool/postfix
-
/etc/postfix
Pregunta 88
Pregunta
One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.
Respuesta
-
Nigerian Scam
-
Lake Venture Scam
-
Conficker virus
-
Iloveyou Scam
Pregunta 89
Pregunta
What information is not typically included in an e-mail header?
Respuesta
-
The sender's physical location
-
The originating IP address
-
The unique ID of the e-mail
-
The originating domain
Pregunta 90
Pregunta
In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?
Pregunta 91
Pregunta
What type of Facebook profile is usually only given to law enforcement with a warrant?
Respuesta
-
private profile
-
advanced profile
-
basic profile
-
Neoprint profile
Pregunta 92
Pregunta
Which option below is the correct path to the sendmail configuration file?
Respuesta
-
/var/etc/sendmail.cf
-
/var/mail/sendmail.cf
-
/usr/local/sendmail.cf
-
/etc/mail/sendmail.cf
Pregunta 93
Pregunta
In what state is sending unsolicited e-mail illegal?
Respuesta
-
Florida
-
Washington
-
Maine
-
New York
Pregunta 94
Pregunta
What service below can be used to map an IP address to a domain name, and then find the domain name's point of contact?
Pregunta 95
Pregunta
Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?
Respuesta
-
Fookes Aid4mail
-
DataNumen Outlook Repair
-
EnCase Forensics
-
AccessData FTK
Pregunta 96
Pregunta
Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.
Respuesta
-
Microsoft Mail Storage Engine (MSE)
-
Microsoft Stored Mail Extensions (SME)
-
Microsoft Extended Mail Storage (EMS)
-
Microsoft Extensible Storage Engine (ESE)
Pregunta 97
Pregunta
The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.
Respuesta
-
destruction
-
spamming
-
spoofing
-
theft
Pregunta 98
Pregunta
In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.
Pregunta 99
Pregunta
Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.
Respuesta
-
AccessData FTK
-
DataNumen
-
R-Tools R-Mail
-
Fookes Aid4Mail
Pregunta 100
Pregunta
Which service below does not put log information into /var/log/maillog?
Respuesta
-
SMTP
-
Exchange
-
IMAP
-
POP
Pregunta 101
Pregunta
What frequencies can be used by GSM with the TDMA technique?
Respuesta
-
1200 to 1500 MHz
-
2.4 GHz to 5.0 GHz
-
600 to 1000 MHz
-
800 to 1000 MHz
Pregunta 102
Pregunta
What digital network technology is a digital version of the original analog standard for cell phones?
Pregunta 103
Pregunta
The _______________ component is made up of radio transceiver equipment that defines cells and communicates with mobile phones; sometimes referred to as a "cell phone tower".
Respuesta
-
Base station controller (BSC)
-
Mobile switching center (MSC)
-
Base transceiver controller (BTC)
-
Base transceiver station (BTS)
Pregunta 104
Pregunta
What organization is responsible for the creation of the requirements for carriers to be considered 4G?
Pregunta 105
Pregunta
Nonvolatile memory on a mobile device can contain OS files and stored user data, such as a __________________ and backed-up files.
Pregunta 106
Pregunta
The ___________________ technology is designed for GSM and Universal Mobile Telecommunications Systems (UMTS) technology, supports 45 Mbps to 144 Mbps transmission speeds.
Pregunta 107
Pregunta
Which of the NIST guidelines below requires using a modified boot loader to access RAM for analysis?
Respuesta
-
Chip-off
-
Manual extraction
-
Hex dumping
-
Micro read
Pregunta 108
Pregunta
GSM refers to mobile phones as "mobile stations" and divides a station into two parts, the __________ and the mobile equipment (ME).
Respuesta
-
antenna
-
SIM card
-
radio
-
transceiver
Pregunta 109
Pregunta
What digital network technology was developed during World War II?
Pregunta 110
Pregunta
What type of mobile forensics method listed by NIST guidelines involves looking at a device's content page by page and taking pictures?
Respuesta
-
Manual extraction
-
Chip-off
-
Micro read
-
Logical extraction
Pregunta 111
Pregunta
What method below is not an effective method for isolating a mobile device from receiving signals?
Respuesta
-
placing the device into a plastic evidence bag
-
placing the device into a paint can, preferably one previously containing radio-wave blocking paint
-
placing the device into airplane mode
-
turning the device off
Pregunta 112
Pregunta
Select below the option that is not a typical feature of smartphones on the market today:
Respuesta
-
Microprocessor
-
Flash
-
ROM
-
Hard drive
Pregunta 113
Pregunta
What standard introduced sleep mode to enhance battery life, and is used with TDMA?
Respuesta
-
IS-99
-
IS-140
-
IS-136
-
IS-95
Pregunta 114
Pregunta
Within NIST guidelines for mobile forensics methods, the ______________ method requires physically removing flash memory chips and gathering information at the binary level.
Respuesta
-
Chip-off
-
Logical extraction
-
Micro read
-
Manual extraction
Pregunta 115
Pregunta
On what mobile device platform does Facebook use a SQLite database containing friends, their ID numbers, and phone numbers as well as files that tracked all uploads, including pictures?
Respuesta
-
Android
-
Blackberry
-
Windows RT
-
iPhone
Pregunta 116
Pregunta
Where is the OS stored on a smartphone?
Respuesta
-
RAM
-
Microprocessor
-
ROM
-
Read/write flash
Pregunta 117
Pregunta
The ________________ technology uses the IEEE 802.16e standard and Orthogonal Frequency Division Multiple Access (OFDMA) and supports transmission speeds of 12 Mbps
Pregunta 118
Pregunta
Which of the following is not a type of peripheral memory card used in PDAs?
Respuesta
-
Secure Digital (SD)
-
Compact Flash (CF)
-
MultiMediaCard (MMC)
-
RamBus (RB)
Pregunta 119
Pregunta
Which component of cell communication is used to route digital packets for the network and relies on a database to support subscribers?
Respuesta
-
Base station controller (BSC)
-
Base transciever station (BTS)
-
Base transciever controller (BTC)
-
Mobile switching center (MSC)
Pregunta 120
Pregunta
Most Code Division Multiple Access (CDMA) networks conform to ____________ , created by the Telecommunications Industry Association (TIA).
Respuesta
-
TS-95
-
802.11
-
IS-95
-
IS-136
Pregunta 121
Pregunta
The use of smart phones for illicit activities is becoming more prevalent.
Pregunta 122
Pregunta
Because mobile phones are seized at the time of arrest, a search warrant is not necessary to examine the device for information.
Pregunta 123
Pregunta
Most Code Division Multiple Access networks conform to IS-95. The systems are referred to as CDMAOne, and when they went to 3G service, they became CDMAThree.
Pregunta 124
Pregunta
While travelling internationally with a GSM phone, you can pop in a SIM card for the country you're currently in, rather than get a new phone.
Pregunta 125
Pregunta
Search and seizure procedures for mobile devices are as important as procedures for computers.