Question 131 · 647 in bank
When you carve an image, recovering the image depends on which of the following skills?
Show answer
Answer: A
Computer Hacking Forensic Investigator (CHFI)647 questions across 65 pages are complete and free, with no account or card.
647 questions in this bank
Free access · progress saved on this device
When you carve an image, recovering the image depends on which of the following skills?
Answer: A
Maria has executed a suspicious executable file in a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for in this scenario?
Answer: A
Which of the following files gives information about the client sync sessions in Google Drive on Windows?
Answer: B
When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.
Answer: D
When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.
Answer: A
What does 254 represent in ICCID 89254021520014515744?
Answer: B
ok for country code, but it's of 2 digit not 3 https://www.imei.info/faq-what-is-ICCID/ IMEI.info: The format of the ICCID is: MMCC IINN NNNN NNNN NN C x MM = Constant (ISO 7812 Major Industry Identifier) CC = Country Code II = Issuer Identifier
Source: Adapted from community discussion — thebigdax
Smith, as a part his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card. What can Jason do in this scenario to reset the PIN and access SIM data?
Answer: D
An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?
Answer: B
When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:
Answer: A
How will you categorize a cybercrime that took place within a CSP's cloud environment?
Answer: A
I think ti is A Cloud as a subject It refers to a crime in which the attackers attempt to compromise the security of a cloud environment to steal data or inject malware. Example: Stealing the identity of a cloud user, unauthorized modification or deletion of stored data, and installation of malware on the cloud. ▪ Cloud as an object In this type of crime, attackers use a cloud system to commit a crime against the CSP; here, the cloud behaves like an object. In this case, the main objective of the attacker is to impact the CSP instead of the cloud environment. Example: DDoS attacks over the cloud that can cause failure in the entire cloud environment. ▪ Cloud as a tool The cloud becomes a tool when the attacker uses a compromised cloud account to attack other accounts. In such cases, both the source and target cloud can store the evidence data. Example: Using a cloud to perform an attack on other clouds or when a crime-related evidence is saved and shared in the cloud
Source: Adapted from community discussion — MrRubi
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
312-49 practice, question 131. 647 questions available.
Version 1.0.0. How we source questions