312-49 practice questions 1–10

1. Question 1 · 647 in bank

   When an investigator contacts by telephone the domain administrator or controller listed by a Who is lookup to request all e-mails sent and received for a user account be preserved, what U.S.C. statute authorizes this phone call and obligates the ISP to preserve e-mail records?

   • ATitle 18, Section 1030
   • BTitle 18, Section 2703(d)
   • CTitle 18, Section Chapter 90
   • DTitle 18, Section 2703(f)

   Show answer

   Answer: D

   Explanation

   The U.S code unannotated Title 18. involves crimes and criminal procedure $ 2703. Required disclosure of customer communications or records. a) contents of wire or electronic communication in electronic storage b)contents of wire or electronic communications in a remote computing service c)records concerning elctronic communication service or remote computing d)requirement for court order e)no cause of action against a provicer disclosing infromation under this chapter f)requirement to preserve Evidence.

   Source: Adapted from community discussion — ZeroDay

   Next question

2. Question 2 · 647 in bank

   You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

   • Acreate a compressed copy of the file with DoubleSpace
   • Bcreate a sparse data copy of a folder or file
   • Cmake a bit-stream disk-to-image file
   • Dmake a bit-stream disk-to-disk file

   Show answer

   Answer: C

   Next question

3. Question 3 · 647 in bank

   Item 2If you come across a sheepdip machine at your client site, what would you infer?

   • AA sheepdip coordinates several honeypots
   • BA sheepdip computer is another name for a honeypot
   • CA sheepdip computer is used only for virus-checking.
   • DA sheepdip computer defers a denial of service attack

   Show answer

   Answer: C

   Next question

4. Question 4 · 647 in bank

   Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

   • AA disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
   • BEvidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
   • CA simple DOS copy will not include deleted files, file slack and other information
   • DThere is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

   Show answer

   Answer: C

   Explanation

   A disk imaging tool not necessarily will check for CRC32s and not even is a requeriment in fact, to be able to perform any kind of validation by itself. But, a DOS copy will not take those elements we will need for our investigation. So, think answer is absolutly correct.

   Source: Adapted from community discussion — Bodescu

   Next question

5. Question 5 · 647 in bank

   In a computer forensics investigation, what describes the route that evidence takes from the time you find it until the case is closed or goes to court?

   • Arules of evidence
   • Blaw of probability
   • Cchain of custody
   • Dpolicy of separation

   Show answer

   Answer: C

   Next question

6. Question 6 · 647 in bank

   You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with the CEO?

   • Athe attorney-work-product rule
   • BGood manners
   • CTrade secrets
   • DISO 17799

   Show answer

   Answer: A

   Next question

7. Question 7 · 647 in bank

   How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

   • A128
   • B64
   • C32
   • D16

   Show answer

   Answer: C

   Next question

8. Question 8 · 647 in bank

   One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, [1] extension?

   • Athe File Allocation Table
   • Bthe file header
   • Cthe file footer
   • Dthe sector map

   Show answer

   Answer: B

   Explanation

   One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

   Source: Adapted from community discussion — Selzar

   Next question

9. Question 9 · 647 in bank

   You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?

   • AWeb bug
   • BCGI code
   • CTrojan.downloader
   • DBlind bug

   Show answer

   Answer: A

   Next question

10. Question 10 · 647 in bank

    You are working as Computer Forensics investigator and are called by the owner of an accounting firm to investigate possible computer abuse by one of the firm's employees. You meet with the owner of the firm and discover that the company has never published a policy stating that they reserve the right to inspect their computing assets at will. What do you do?

    • AInform the owner that conducting an investigation without a policy is not a problem because the company is privately owned
    • BInform the owner that conducting an investigation without a policy is a violation of the 4th amendment
    • CInform the owner that conducting an investigation without a policy is a violation of the employee's expectation of privacy
    • DInform the owner that conducting an investigation without a policy is not a problem because a policy is only necessary for government agencies

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

312-49 practice, question 1. 647 questions available.