Question 1
Question
The first 3 bytes of an XIF file are exactly the same as a TIF file.
Question 2
Question
Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.
Question 3
Question
Most digital cameras use the bitmap format to store photos.
Question 4
Question
When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.
Question 5
Question
Each graphics file type has a unique header value.
Question 6
Question
How many bits are required to create a pixel capable of displaying 65,536 different colors?
Question 7
Question
Which of the following is not considered to be a non-standard graphics file format?
Question 8
Question
All TIF files start at offset 0 with what 6 hexadecimal characters?
Answer
-
2A 49 48
-
FF 26 9B
-
49 49 2A
-
AC 49 2A
Question 9
Question
What kind of graphics file combines bitmap and vector graphics types?
Answer
-
metafile
-
bitmap
-
jpeg
-
tif
Question 10
Question
The process of converting raw picture data to another format is called _________________.
Answer
-
splicing
-
carving
-
demosaicing
-
vector quantization
Question 11
Question
What format was developed as a standard for storing metadata in image files?
Question 12
Question
Which of the following formats is not considered to be a standard graphics file format?
Question 13
Question
Select below the utility that is not a lossless compression utility:
Answer
-
PKZip
-
WinZip
-
StuffIt
-
Lzip
Question 14
Question
In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.
Answer
-
Huffman
-
Lempel-Ziv-Welch (LZW)
-
Vector Quantization
-
Adaptive Quantization
Question 15
Question
What file type starts at offset 0 with a hexidecimal value of FFD8?
Question 16
Question
How many different colors can be displayed by a 24 bit colored pixel?
Answer
-
256
-
65,536
-
16,777,216
-
4,294,967,296
Question 17
Question
The _____________ format is a proprietary format used by Adobe Photoshop.
Question 18
Question
For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
Question 19
Question
Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.
Answer
-
raster file format
-
bitmap file format
-
jpeg file format
-
raw file format
Question 20
Question
The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.
Answer
-
lossy
-
lossless
-
vector quantization
-
adaptive
Question 21
Question
For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.
Question 22
Question
Which graphics file format below is rarely compressed?
Answer
-
GIF
-
JPEG
-
BMP
-
None of the above
Question 23
Question
When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?
Answer
-
major significant bit (MSB)
-
least significant bit (LSB)
-
most significant bit (MSB)
-
leading significant bit (LSB)
Question 24
Question
What act defines precisely how copyright laws pertain to graphics?
Question 25
Question
Which of the following is not a type of graphic file that is created by a graphics program?
Answer
-
bitmap images
-
vector graphics
-
metafile graphics
-
raster graphics
Question 26
Question
Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.
Question 27
Question
One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.
Question 28
Question
The advantage of recording hash values is that you can determine whether data has changed.
Question 29
Question
In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.
Question 30
Question
Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing specific files or sectors.
Question 31
Question
What format below is used for VMware images?
Question 32
Question
In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?
Question 33
Question
Which password recovery method uses every possible letter, number, and character found on a keyboard?
Answer
-
rainbow table
-
dictionary attack
-
hybrid attack
-
brute-force attack
Question 34
Question
The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.
Answer
-
litigation
-
scope creep
-
criminal charges
-
violations
Question 35
Question
Which of the following file systems can't be analyzed by OSForensics?
Question 36
Question
In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.
Answer
-
format
-
fdisk
-
grub
-
diskpart
Question 37
Question
Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:
Answer
-
Last Bit
-
AccessData PRTK
-
OSForensics
-
Passware
Question 38
Question
Within Windows Vista and later, partition gaps are _____________ bytes in length.
Question 39
Question
Which option below is not a disk management tool?
Answer
-
Partition Magic
-
Partition Master
-
GRUB
-
HexEdit
Question 40
Question
Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.
Answer
-
hashing
-
bit-shifting
-
registry edits
-
slack space
Question 41
Question
A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.
Answer
-
compiler
-
shifter
-
macro
-
script
Question 42
Question
What letter should be typed into DiskEdit in order to mark a good sector as bad?
Question 43
Question
Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.
Answer
-
key vault
-
key escrow
-
bump key
-
master key
Question 44
Question
What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?
Answer
-
salted passwords
-
scrambled passwords
-
indexed passwords
-
master passwords
Question 45
Question
When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?
Answer
-
Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
-
Start the suspect's computer and begin collecting evidence.
-
The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.
-
Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.
Question 46
Question
In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.
Answer
-
keygrabber
-
keylogger
-
packet capture
-
protocol analyzer
Question 47
Question
The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.
Question 48
Question
The term for detecting and analyzing steganography files is _________________.
Answer
-
carving
-
steganology
-
steganalysis
-
steganomics
Question 49
Question
A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.
Question 50
Question
The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.
Question 51
Question
Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.
Question 52
Question
Forensics tools can't directly mount VMs as external drives.
Question 53
Question
The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.
Question 54
Question
The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.
Question 55
Question
The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.
Question 56
Question
What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?
Answer
-
KVM
-
Parallels
-
Microsoft Virtual PC
-
VirtualBox
Question 57
Question
The __________ disk image file format is associated with the VirtualBox hypervisor.
Question 58
Question
What Windows Registry key contains associations for file extensions?
Answer
-
HKEY_CLASSES_ROOT
-
HKEY_USERS
-
HKEY_LOCAL_MACHINE
-
HKEY_CURRENT_CONFIG
Question 59
Question
In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters
Question 60
Question
The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?
Question 61
Question
Select below the option that is not a common type 1 hypervisor:
Answer
-
VMware vSphere
-
Microsoft Hyper-V
-
Citirix XenServer
-
Oracle VirtualBox
Question 62
Question
The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?
Answer
-
People
-
Technology
-
Operations
-
Management
Question 63
Question
The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.
Answer
-
netstat
-
ls
-
ifconfig
-
tcpdump
Question 64
Question
Select below the program within the PsTools suite that allows you to run processes remotely:
Answer
-
PsService
-
PsPasswd
-
PsRemote
-
PsExec
Question 65
Question
The tcpdump and Wireshark utilities both use what well known packet capture format?
Answer
-
Netcap
-
Pcap
-
Packetd
-
RAW
Question 66
Question
The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.
Answer
-
Tcpdstat
-
Tcpslice
-
Ngrep
-
tcpdump
Question 67
Question
The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.
Answer
-
Kali Linux
-
Ubuntu
-
OSForensics
-
Sleuth Kit
Question 68
Question
In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?
Answer
-
Show-NetworkAdapters
-
Query-ipconfig
-
Get-VMNetworkAdapter
-
Dump-Netconfig
Question 69
Question
What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?
Answer
-
.nvram
-
.vmem
-
.vmpage
-
.vmx
Question 70
Question
What processor instruction set is required in order to utilize virtualization software?
Question 71
Question
Select the file below that is used in VirtualBox to create a virtual machine:
Question 72
Question
The __________________ is the version of Pcap available for Linux based operating systems.
Answer
-
Winpcap
-
Libpcap
-
Tcpcap
-
Netcap
Question 73
Question
What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?
Answer
-
tcpdump
-
Argus
-
Ngrep
-
Tcpslice
Question 74
Question
At what layers of the OSI model do most packet analyzers function?
Answer
-
Layer 1 or 2
-
Layer 2 or 3
-
Layer 3 or 4
-
Layer 4 or 5
Question 75
Question
In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.
Answer
-
smurf
-
SYN flood
-
spoof
-
ghost
Question 76
Question
The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.
Question 77
Question
The Pagefile.sys file on a computer can contain message fragments from instant messaging applications.
Question 78
Question
In an e-mail address, everything before the @ symbol represents the domain name.
Question 79
Question
Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.
Question 80
Question
An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.
Question 81
Question
What command below could be used on a UNIX system to help locate log directories?
Answer
-
show log
-
detail
-
search
-
find
Question 82
Question
The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.
Answer
-
fixmail.exe
-
scanpst.exe
-
repairpst.exe
-
rebuildpst.exe
Question 83
Question
E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.
Answer
-
log recycling
-
circular logging
-
log purging
-
log cycling
Question 84
Question
Syslog is generally configured to put all e-mail related log information into what file?
Answer
-
/usr/log/mail.log
-
/var/log/messages
-
/proc/mail
-
/var/log/maillog
Question 85
Question
What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?
Question 86
Question
On a UNIX system, where is a user's mail stored by default?
Answer
-
/var/mail
-
/var/log/mail
-
/username/mail
-
/home/username/mail
Question 87
Question
Where does the Postfix UNIX mail server store e-mail?
Answer
-
/home/username/mail
-
/var/mail/postfix
-
/var/spool/postfix
-
/etc/postfix
Question 88
Question
One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.
Answer
-
Nigerian Scam
-
Lake Venture Scam
-
Conficker virus
-
Iloveyou Scam
Question 89
Question
What information is not typically included in an e-mail header?
Answer
-
The sender's physical location
-
The originating IP address
-
The unique ID of the e-mail
-
The originating domain
Question 90
Question
In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?
Question 91
Question
What type of Facebook profile is usually only given to law enforcement with a warrant?
Answer
-
private profile
-
advanced profile
-
basic profile
-
Neoprint profile
Question 92
Question
Which option below is the correct path to the sendmail configuration file?
Answer
-
/var/etc/sendmail.cf
-
/var/mail/sendmail.cf
-
/usr/local/sendmail.cf
-
/etc/mail/sendmail.cf
Question 93
Question
In what state is sending unsolicited e-mail illegal?
Answer
-
Florida
-
Washington
-
Maine
-
New York
Question 94
Question
What service below can be used to map an IP address to a domain name, and then find the domain name's point of contact?
Question 95
Question
Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?
Answer
-
Fookes Aid4mail
-
DataNumen Outlook Repair
-
EnCase Forensics
-
AccessData FTK
Question 96
Question
Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.
Answer
-
Microsoft Mail Storage Engine (MSE)
-
Microsoft Stored Mail Extensions (SME)
-
Microsoft Extended Mail Storage (EMS)
-
Microsoft Extensible Storage Engine (ESE)
Question 97
Question
The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.
Answer
-
destruction
-
spamming
-
spoofing
-
theft
Question 98
Question
In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.
Question 99
Question
Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.
Answer
-
AccessData FTK
-
DataNumen
-
R-Tools R-Mail
-
Fookes Aid4Mail
Question 100
Question
Which service below does not put log information into /var/log/maillog?
Answer
-
SMTP
-
Exchange
-
IMAP
-
POP
Question 101
Question
What frequencies can be used by GSM with the TDMA technique?
Answer
-
1200 to 1500 MHz
-
2.4 GHz to 5.0 GHz
-
600 to 1000 MHz
-
800 to 1000 MHz
Question 102
Question
What digital network technology is a digital version of the original analog standard for cell phones?
Question 103
Question
The _______________ component is made up of radio transceiver equipment that defines cells and communicates with mobile phones; sometimes referred to as a "cell phone tower".
Answer
-
Base station controller (BSC)
-
Mobile switching center (MSC)
-
Base transceiver controller (BTC)
-
Base transceiver station (BTS)
Question 104
Question
What organization is responsible for the creation of the requirements for carriers to be considered 4G?
Question 105
Question
Nonvolatile memory on a mobile device can contain OS files and stored user data, such as a __________________ and backed-up files.
Question 106
Question
The ___________________ technology is designed for GSM and Universal Mobile Telecommunications Systems (UMTS) technology, supports 45 Mbps to 144 Mbps transmission speeds.
Question 107
Question
Which of the NIST guidelines below requires using a modified boot loader to access RAM for analysis?
Answer
-
Chip-off
-
Manual extraction
-
Hex dumping
-
Micro read
Question 108
Question
GSM refers to mobile phones as "mobile stations" and divides a station into two parts, the __________ and the mobile equipment (ME).
Answer
-
antenna
-
SIM card
-
radio
-
transceiver
Question 109
Question
What digital network technology was developed during World War II?
Question 110
Question
What type of mobile forensics method listed by NIST guidelines involves looking at a device's content page by page and taking pictures?
Answer
-
Manual extraction
-
Chip-off
-
Micro read
-
Logical extraction
Question 111
Question
What method below is not an effective method for isolating a mobile device from receiving signals?
Answer
-
placing the device into a plastic evidence bag
-
placing the device into a paint can, preferably one previously containing radio-wave blocking paint
-
placing the device into airplane mode
-
turning the device off
Question 112
Question
Select below the option that is not a typical feature of smartphones on the market today:
Answer
-
Microprocessor
-
Flash
-
ROM
-
Hard drive
Question 113
Question
What standard introduced sleep mode to enhance battery life, and is used with TDMA?
Answer
-
IS-99
-
IS-140
-
IS-136
-
IS-95
Question 114
Question
Within NIST guidelines for mobile forensics methods, the ______________ method requires physically removing flash memory chips and gathering information at the binary level.
Answer
-
Chip-off
-
Logical extraction
-
Micro read
-
Manual extraction
Question 115
Question
On what mobile device platform does Facebook use a SQLite database containing friends, their ID numbers, and phone numbers as well as files that tracked all uploads, including pictures?
Answer
-
Android
-
Blackberry
-
Windows RT
-
iPhone
Question 116
Question
Where is the OS stored on a smartphone?
Answer
-
RAM
-
Microprocessor
-
ROM
-
Read/write flash
Question 117
Question
The ________________ technology uses the IEEE 802.16e standard and Orthogonal Frequency Division Multiple Access (OFDMA) and supports transmission speeds of 12 Mbps
Question 118
Question
Which of the following is not a type of peripheral memory card used in PDAs?
Answer
-
Secure Digital (SD)
-
Compact Flash (CF)
-
MultiMediaCard (MMC)
-
RamBus (RB)
Question 119
Question
Which component of cell communication is used to route digital packets for the network and relies on a database to support subscribers?
Answer
-
Base station controller (BSC)
-
Base transciever station (BTS)
-
Base transciever controller (BTC)
-
Mobile switching center (MSC)
Question 120
Question
Most Code Division Multiple Access (CDMA) networks conform to ____________ , created by the Telecommunications Industry Association (TIA).
Answer
-
TS-95
-
802.11
-
IS-95
-
IS-136
Question 121
Question
The use of smart phones for illicit activities is becoming more prevalent.
Question 122
Question
Because mobile phones are seized at the time of arrest, a search warrant is not necessary to examine the device for information.
Question 123
Question
Most Code Division Multiple Access networks conform to IS-95. The systems are referred to as CDMAOne, and when they went to 3G service, they became CDMAThree.
Question 124
Question
While travelling internationally with a GSM phone, you can pop in a SIM card for the country you're currently in, rather than get a new phone.
Question 125
Question
Search and seizure procedures for mobile devices are as important as procedures for computers.