Bundle
Bundle for WGU C702 exam 2023
8 Items
Forensics and Network Intrusion - C702 Questions and Answers 2023
How large is the partition table structure that stores information about the partitions present on the hard disk? 64 bytes On Macintosh computers, ... [Show More] which architecture utilizes EFI to initialize the hardware interfaces after the BootROM performs POST? Intel-based Macintosh Computers :What component of a typical FAT32 file system occupies the largest part of a partition and stores the actual files and directories? Data Area What is a technology that uses multiple smaller disks simultaneously that function as a single large volume? RAID What is the maximum file system size in ext3? 32 TB What is the maximum file system size in ext4? 1 EiB :What layer of web application architecture is responsible for the core functioning of the system and includes logic and applications, such as .NET, used by developers to build websites according to client requirements? business layer What stage of the Linux boot process includes the task of loading the virtual root file system created by the initrd image and executes the Linuxrc program? Kernel Stage What UFS file system part comprises a collection, including a header with statistics and free lists, a number of inodes containing file attributes, and a number of data blocks? cylinder group Which attribute ID does NTFS set as a flag after encrypting a file where the Data Decryption Field (DDF) and Data Recovery Field (DRF) is stored? 0x100 Which cmdlet can investigators use in Windows PowerShell to analyze the GUID Partition Table data structure of the hard disk? Get-GPT Which cmdlet can investigators use in Windows PowerShell to analyze the GUID Partition Table to find the exact type of boot sector and display the partition object? Get-PartitionTable Which field type refers to the volume descriptor as a supplementary? Number 2 Which HFS volume structure is the starting block of the volume bitmap? Logical Block 3 Which inode field determines what the inode describes and the permissions that users have to it? Mode Which inode field enables the file system to correctly allow the right sort of access? Owner Information Which item describes the following UEFI boot process phase?The phase of EFI consisting of clearing the UEFI program from memory, transferring the UEFI program to the OS, and updating the OS calls for the run time service using a small part of the memory. Run Time Phase :Which of the following basic partitioning tools displays details about GPT partition tables in Linux OS? GNU Parted Which of the following basic partitioning tools displays details about GPT partition tables in Macintosh OS? Disk Utility Which of the following Federal Rules of Evidence contains Rulings on Evidence? Rule 103 What are the five UEFI Boot Process Phases Security Phase Pre-EFI Initialization Phase Driver Execution Phase Boot Device Selection Phase Run Time Phase Which of the following stakeholders is responsible for conducting forensic examinations against allegations made regarding wrongdoings, found vulnerabilities, and attacks over the cloud? Investigators :Which of the two parts of the Linux file system architecture has the memory space where the system supplies all services through an executed system call? Kernel Space Which tool helps collect information about network connections operative in a Windows system? netstat :How many bytes does a directory entry have allotted for each file and directory in the FAT file system? 32 bytes How many bytes is each partition entry in GPT? 128 bytes What component of a typical FAT32 file system contains a Volume Boot Record that comprises the BIOS Parameter Block (BPB) including basic file system information, such as file system type, pointers to the position of the other sections, and the OS's boot loader code? reserved area What component of a typical FAT32 file system contains duplicates of the File Allocation Table to help the system check for empty or idle spaces, and contains detailed information about clusters and their contents, including files and directories? FAT area What information held by the superblock allows the mounting software to verify the superblock for the EXT2 file system? Magic number :What is a CompuServe-generated format from 1987 that uses lossless data compression techniques, maintaining the visual quality of the image? GIF How many bit values does HFS use to address allocation blocks? 16 bits Which command from The Sleuth Kit (TSK) displays details of a metadata structure such as inode? istat On Macintosh computers, which architecture utilizes Open Firmware to initialize the hardware interfaces after the BootROM performs POST? Power-PC What is a common technique used to distribute malware on the web by mimicking legitimate institutions in an attempt to steal passwords, credit cards, and bank account data? Spearphishing [Show Less]
- Exam
- $12.95
- 0
- 82
Forensics and Network Intrusion - C702 questions and answers 2023
JPEG Most common graphic file format, full color graphic format (16.7 million colors) with a relatively small file size BMP (bitmap image file or ... [Show More] bitmap) is a raster graphics image file format used to store digital images. WINDOWS GIF a lossless format for image files that supports both animated and static images. Remote Acquisitions Prodiscover Wetstone Live Wire F Response F-Response vendor-neutral specialty remote access utility designed to work with any digital forensics program, allows reading of suspect drive Windows Recovery- EaseUS Format recovery Emptied from recycle bin Partition loss/damage Software crash Virus Unexpected shutdown Disk Digger undeletes and recovers lost files from hard drives, memory cards, and usb flash drives Quick Recovery Lost, Deleted, Deteriorated files Repairs bad sectors Encrypted and password protected files Advance Disk Recovery Scans for deleted files and folders Quick scan Deep scan Data Recovery Pro Restores deleted emails and some files Data Rescue 4 MAC Recover from crashed/virus/ corrupted or accidentally formatted. Net Commands Net Config; Net file; Net Use; Net View; Net Name; Net start; Net sessions; Steganography Techniques Cover Generation Technique;Substitution Technique;Transform Domain Technique;Spread Spectrum Technique; Cover Generation Technique: A cover generation method actually creates a cover for the sole purpose of hiding information Substitution Technique: Replaces redundant or unneeded bits of a cover with the bits from the secret message Transform Domain Technique: Hides the message data in the transform space of a signal. Can be commonly used in JPEG's photos Spread Spectrum Technique: There are two types of spread spectrum techniques, direct sequence and frequency hopping. Guidelines for Evidence Collection [RFC 3227] provides a list of the volatile data that should be captured first: 1. System date and time, 2. Current network connections, 3. Current open ports and applications listening on those ports, 4. Applications that are currently running forensic investigations in a wireless environment: 1. Obtain a search warrant. 2. Identify wireless devices. 3. Document and maintain chain of custody. 4. Detect wireless connections. 5. Determine wireless field's strength. 6. Map wireless zones and hot spots. 7. Connect to the wireless network. 8. Acquire and analyze data. 9. Generate a report. A computer forensic expert makes sure that the following rules are upheld during an investigation process: 1. Preservation of evidence 2. Prevention of contamination of evidence 3. Extraction and preservation of evidence 4. Accountability of evidence 5. Limited interference of the crime scene on normal life 6. Ethics of investigation Steps to evaluate and secure a scene: 1. Follow the policies of the legal authority for securing the crime scene. 2. Verify the type of incident. 3. Ensure that the scene is safe for responders. 4. Isolate other persons who are present at the scene. 5. Locate and help the victim. 6. Verify any data that is related to the offense. Steps to evaluate and secure a scene: (continued) 7. Transmit flash messages to responding units. 8. Request help as needed 9. Establish a security perimeter. 10. Protect volatile evidence. 11. Document the devices that contain perishable data. 12. Observe the situation and record observations.13. Protect physical evidence or hidden fingerprints. The generic processes of the First Responder Procedures are to: 1. Protect the system and resources. 2. Contain the intrusion. 3. Preserve the evidence [logs, files, etc.] in a legally acceptable way. 4. Notify Management, Incidence Response, etc. Federal Rules of Evidence [OPINIONS AND EXPERT TESTIMONY] Rule 701 - Opinion Testimony by Lay Witnesses; Rule 702 - Testimony by Expert Witnesses; Rule 703 - Bases of an Expert's Opinion Testimony; Rule 704 - Opinion on an Ultimate Issue; Rule 705 - Disclosing the Facts or Data Underlying an Expert's Opinion; Rule 706 - Court-Appointed Expert Witnesses; Pre-Investigation Phase Set up CFL, toolkit, workstationset up investigaiton team and approval from authorityPlanning process, define mission goals, secure case perimeter and devices involved. Investigation Phase Acquisition, preservation, and analysis of the data to identify the source of crime and culprit. Implement the technical knowledge to find evidence, examine, document and preserve the findings. Post-Investigation Phase Ensure target audience can easily understand report Ensure report provides adequate and acceptable evidence report should comply with all local laws and standards should be legally sound and acceptable in court of law Slack Space Unused storage capacity Swap space The space on the disk reserved for the full virtual memory space of a process. Hashing Algorithm Lengths SHA-1 SHA-512 MD5 256 CRC-32 MD6 - 512 Netstat Commands Netstat -a Displays all connections and listening ports. -e Displays Ethernet statistics. -n Displays addresses and port numbers in numerical form. -r Displays the routing table. -o Displays the owning process ID associated with each connection. Steganography Steganography (pronounced STEHG-uh-NAH-gruhf-ee, from Greeksteganos, or "covered," and graphie, or "writing") is the hiding of a secret message within an ordinary message and the extraction of it at its destination to maintain the confidentiality of data. [Show Less]
- Exam
- $11.95
- 0
- 88
C702 Steganalysis Questions and Answers 2023
Chosen message attack The steganalyst generates a stego-object from some steganography tool or algorithm of a chosen message. The goal in this attack is t... [Show More] o determine patterns in the stego-object that may point to the use of specific steganography tools or algorithms. Chosen stego attack The steganography algorithm and stego-object are known Known stego attack The steganography algorithm, stego-object and original object are known Known message attack The hidden message and the corresponding stego-image are known. The analysis of patterns that correspond to the hidden information could help decipher such messages in future. Known cover attack The stego-object as well as the original medium is available. The stego-object is compared with the original cover object to detect any hidden information. Stego-only attack Only the stego-object is available for analysis. [Show Less]
- Exam
- $10.45
- 0
- 145
C702 Chapter 5 Questions and Answers 2023
anti-forensics set of techniques that attackers or perpetrators use in order to avert or sidetrack the forensic investigation process or try to make it mu... [Show More] ch harder In the FAT file system, the OS replaces the first letter of a deleted file name with a hex byte code, E5h Windows 98 and earlier store deleted files in Drive:\Recycled Windows 2000, XP, and NT store deleted files in Drive:\Recycler size limit for early versions of recycle bin 3.99gb $Ry.ext how recycle bin info is stored in Windows Vista and later Dxy.ext older versions of windows - how they store recycle bin files. x represents teh drive name, y a sequential number starting from 0 and .ext being the original file's extension In Windows versions newer that Vista and XP, the OS stores the complete path and file or folder name in a hidden file called INFO2 DiskDigger undeletes and recovers lost files from hard drives, memory cards and USB flash drives Handy Recovery data recovery software designed to restore files accidentally deleted from hard disks and memory cards Quick Recovery recovers files that have been lost, deleted, corrupted or even deteriorated Stellar Phoenix recovers lost, deleted, or inaccessible data from Windows OS HDDs and other storage media Total Recall recovers lost data from hard drives, RAID, photos, deleted files, iPods and even removable disks Advanced Disk Recovery scans the entire system for deleted files and folders and recovers them. two types of scans: quick and deep Windows Data Recovery Software software can recover accidentally deleted files, including files emptied from the recycle bin and from windows explorer Orion File Recovery Software searches for deleted files on the hard drive, or any external or portable drive connected to the computer Data Rescue PC recovers files from a crashed or virus-corrupted hard drive. Smart Undeleter recovers deleted files, even those that were deleted before the installation of the utility. can run from a floppy disk without installation on the hard drive DDR Professional Recovery Software recovers deleted files in all major data loss situations, whether lost from fixed hard drive partitions or from any USB storage media drive Data Recovery Pro restores deleted emails and email attachments, so no important messages are ever lost. will also deely scan your hard drive, external drives, iPods GetDataBack recovers data if the hard drive's partition table, boot record, FAT/MFT or root directory are lost or damaged UndeletePlus scans a computer or storage medium for deleted files and restores them on command File Scavenger file "undelete" and data recovery utility for Windows 10,8,7,Vist, Server 2003,2000, NT and ME/98/95. recovers files that have been accidentally deleted, provided that recovery is attempted before the files are permanently overwritten VirtualLab data recovery software that works with all Windows Oss from Windows 98 to Windows 10, 8, 7, Fat 12/16/32 and NTFS WinUndelete can be used to recover deleted files from a hard drive, flash drive, USB external drive, digital camera card, and more R-Undelete recovers files from FAT and NTFS file systems. recovers files on any local disk recognized by the software Recover4All Professional recovers files accidnetly deleted under windows. Pandora allows one to find and recover recoverable deleted files from NTFS and FAT-formatted volumes, regardless of their type Seagate File Recovery Software recovers the files and rescue service plans for storage devices Wise Datat Recover used to retrieve the lost or formatted data, or data lost due to system crash Glary Undelete works on FAT and NTFS file systems. recovers the files emptied from the recycle bin, in a DOs window, from windows explorer Disk Drill data recovery software for windows PC. PhotoRect recovers lots files, videos, documents and archives from hard disks, CD-ROMS, and lost pics from digital camera memory How to recover on Mac Time Machine MAC recovery tools applexsoft, disk doctors, r-studio, data rescue, stellar phoenix, file salvage, 321soft, disk drill, mac data recovery guru, cisdem 7-Data partition recovery software, recovers data from lost, deleted or damaged partitions by accident Acronis partition recovery tool used to recover lost or deleted data RS partition recovery tool that recovers the volumes and corrupted partitions and formatted and repartitioned hard drives to find lost data Partition Find & Mount partition recovery software recovers deleted and lost partitions. advance datat recovery software tools enables a user to recover deleted, corrupted, lost or missing data from Windows NTFS partitions [Show Less]
- Exam
- $11.95
- 0
- 143
WGU Forensics and Network Intrusion - C702 & DFE Questions and Answers 2023
Web Application Threats - 1 Most security breaches occur in web applications, rather than in web servers, as web applications might contain bugs due to co... [Show More] ding issues in the development phase. Consequently, web applications are prone to various types of threats, some of which are outlined below: ▪ Injection Flaws Injection flaws are the most common application vulnerabilities that allow untrusted user-supplied data to be interpreted and executed as a command or query. The attackers inject malicious code, commands, or scripts into the input gates of flawed web applications in such a manner that the applications interpret and run with the newly supplied malicious input, which in turn allows the attackers to extract sensitive information. Such injection flaws are commonly found in in SQL, NoSQL, and LDAP queries as well as OS commands. Injection flaws have been regarded as the topmost security vulnerability in web applications in 2017 by the Open Web Application Security Project (OWASP). ▪ SQL Injection In this type of attack, the attacker injects malicious SQL commands or queries as input data. This helps them bypass the security measures of the web application and retrieve sensitive content from the database server. ▪ Cross Site Scripting In this type of attack, the attackers bypass the client's ID security mechanisms and gain access privileges. Subsequently, they inject the malicious scripts into specific fields in the web pages. These malicious XSS scripts can rewrite the HTML content of a website, hijack user sessions or redirect users to malicious websites, and deface website. XSS is one of OWASP's top 10 web application security vulnerabilities for 2017. ▪ Cross Site Request Forgery In this attack method, an authenticated user is made to perform certain tasks on the web application that is chosen by an attacker. For example, an attacker can make a user click on a particular link sent via email or chat. ▪ Broken Access Control This is a method in which an attacker identifies a flaw in access-control policies and exploits it to bypass the authentication mechanism. This enables the attacker to gain access to sensitive data, modify access rights, or operate accounts of other users. This is a part of 2017 OWASP top 10 security vulnerabilities. ▪ Broken Authentication Attackers exploit implementation flaws in the authentication and session management functions of a web application to obtain administrative privileges or impersonate other users. Common vulnerable areas include timeouts, secret questions, and password management. Broken authentication is one of OWASP's top 10 web application security vulnerabilities for 2017. ▪ Buffer Overflow The buffer overflow of a web application occurs when it fails to guard its buffer properly and allows writing beyond its maximum size. Thus, it overwrites adjacent memory locations. There are multiple forms of buffer overflow, including heap buffer overflows and format string attacks. The purpose of these attacks is to corrupt the execution stack of the web application. ▪ Cookie Poisoning Cookie poisoning refers to the modification of a cookie for bypassing security measures or gaining unauthorized access to information. In this type of attack, the attackers bypass the authentication process by altering the information present inside a cookie. Once the attackers gain control over a network, they can modify its content, use the system for a malicious attack, or steal information from the users' systems. ▪ Sensitive Data Exposure Sensitive information, such as account records, credit-card numbers, passwords, or other authenticated information are generally stored by web applications either in a database or on a file system. If the developers make any mistakes while enforcing encryption techniques on a web application or ignore the security aspects of some parts of the application, attackers can easily exploit those flaws to gain unauthorized access to sensitive information. Sensitive data can be exploited and misused by both insiders and outsiders to perform identity theft, credit-card fraud, and other cybercrimes. This threat is included in OWASP top 10 security vulnerabilities for 2017. ▪ Information Leakage refers to a drawback in a web application where the application unintentionally reveals sensitive information to an unauthorized user. Such information leakage can cause great losses to a company. Hence, the company needs to employ proper content filtering mechanisms to protect all its information or data sources, such as systems or other network resources, from information leakage. ▪ Improper Error Handling This threat arises when a web application is unable to handle internal errors properly. In such cases, the website returns information, such as database dumps, stack traces, and error codes, in the form of errors. ▪ Insufficient Logging & Monitoring Log files keep records of the actions and events that occur while an application/service is running. This vulnerability occurs when the logs do not record security-critical events or provide unclear warnings or error messages. The lack of log monitoring or the maintenance of logs at insecure locations greatly increases the chance of a major security incident. Moreover, insufficient logging and monitoring practices leave no audit trail for forensic analysis, making the detection of any malicious behavior exceedingly difficult for forensic investigators. It is one of 2017 OWASP's top 10 web application security vulnerabilities. ▪ Path/Directory Traversal When attackers exploit HTTP by using directory traversal, they gain unauthorized access to directories, following which they may execute commands outside the web server's root directory. ▪ Parameter/Form Tampering This type of tampering attack aims at manipulating the communication parameters exchanged between a client and server to make changes in application data, such as user IDs and passwords with event logs or the cost and quantity of products. In order to improve the functionality and control of the application, the system collects such information and stores it in hidden form fields, cookies, or URL query strings. Hackers use tools such as WebScarab and Paros proxy to launch this type of attack. Successful exploitation might lead to other attacks such as file inclusion and XSS. ▪ Denial-of-Service (DoS) A denial of service (DoS) attack aims at terminating the operations of a website or server by making its resources unavailable to clients. For example, a DoS attack may shut down the functioning of a website related to banking or an email service for a few hours or even days, resulting in the loss of both time and money. ▪ Unvalidated Input In this type of attack, attackers tamper with the URL, HTTP requests, headers, hidden fields, form fields, query strings, etc. to bypass a security measures in a system. User login IDs and other related data get stored in cookies, which become a source of attacks. Examples of attacks that cause unvalidated input include SQL injection, cross-site scripting (XSS), and buffer overflows. ▪ Security Misconfiguration The lack of a repeatable security-hardening process at any layer of the application stack, which includes web servers, databases, frameworks, host OSes, application servers, and storage devices, can lead to a security misconfiguration vulnerability. The use of default configurations, passwords, or out-of-date software can increase the risk of an attack. This is included in OWASP 2017 top 10 security vulnerabilities. ▪ Log Tampering Web applications maintain logs to track the usage patterns, such as admin login credentials and user login credentials. The attackers usually inject, delete or tamper the web application logs to engage in malicious activities or hide their identities Computer forensics refers to a set of methodological procedures and techniques to identify, gather, preserve, extract, interpret, document and present evidence from computing equipment that is acceptable in a court of Law Cybercrime is defined as any illegal act involving a computing device, network, its systems, or its applications. It is categorized into two types based on the line of attack: internal attacks and external attacks Computer crimes pose new challenges for investigators due to their speed, anonymity, volatile nature of evidence, global origin of the crimes and difference in laws, and limited legal understanding Approaches to manage cybercrime investigations include civil, criminal, and administrative approaches Digital evidence is "any information of probative value that is either stored or transmitted in a digital form". It is of two types: volatile (Power off its lost) and non-volatile (now difference if off) Forensic readiness refers to an organization's ability to optimally use digital evidence in a limited period of time and with minimal investigation costs. Helps maintain Business Continuity. Practice Drills. ' Plan: 1. Identify potential evidence required. 2. Determine Source 3. Define Policy 4. establish Policy 5. Identify if Full/formal investigation is required. 6. create process for documenting procedure 7. Legal advisory board 8. Keep Incident response team ready. includes technical and non-technical actions that maximize an organization’s competence to use digital evidence. Organizations often include computer forensics as part of their incident response plan to track and prosecute the perpetrators of an incident Which of the following is true regarding computer forensics? Computer forensics deals with the process of finding evidence related to a digital crime to find the culprits and initiate legal action against them. Which of the following is not an objective of computer forensics? Document vulnerabilities allowing further loss of intellectual property, finances, and reputation during an attack. What is not an impact of cybercrime? Huge financial gain Which of the following is true of cybercrimes? Investigators, with a warrant, have the authority to forcibly seize the computing devices. Which of the following is true of civil crimes? The initial reporting of the evidence is generally informal. Which of the following is a user-created source of potential evidence? Address book Which of the following is a computer-created source of potential evidence? Steganography Under which of the following conditions will duplicate evidence not suffice? When original evidence is in possession of the originator Rules Rule 101: Scope (in US) Rule 102: Purpose (truth & Just) Rule 103: Rulings on Evidence Rule 104: Preliminary Questions Rule 105: Limited Admissibility(proper scope) Rule 502: Attorney-Client Privilege and Work Product; Limitations on Waiver Rule 608: A Witness’s Character for Truthfulness or Untruthfulness Rule 609: Impeachment by Evidence of a Criminal Conviction Rule 614: Court’s Calling or Examining a Witness Rule 701: Opinion Testimony by Lay Witnesses Rule 705: Disclosing the Facts or Data Underlying an Expert’s Opinion Rule 801: Definitions That Apply to This Article; Exclusions from Hearsay Rule 803: Exceptions to the Rule Against Hearsay–Regardless of Whether the Declarant is Available as a Witness Rule 804: Exceptions to the Rule Against Hearsay–When the Declarant is Unavailable as a Witness Rule 901: Authenticating or Identifying Evidence Rule 1001: Definitions that apply to this article Rule 1002: Requirement of the Original Rule 1003. Admissibility of Duplicates Rule 1004. Admissibility of Other Evidence of Content Minimizing the tangible and intangible losses to the organization or an individual is considered an essential computer forensics use. True Cybercrimes can be classified into the following two types of attacks, based on the line of attack. Internal and external Espionage, theft of intellectual property, manipulation of records, and Trojan horse attacks are examples of what? Insider attacks or primary threats External attacks originate from outside of an organization or can be remote in nature. Such attacks occur when there are inadequate information-security policies and procedures. [Show Less]
- Exam
- $12.95
- 0
- 155
C702 Full Questions and Answers 2023
Which of the following is not an objective of computer forensics? A. Computer forensics deals with the process of finding evidence related to a digital ... [Show More] crime to find the victims and prevent legal action against them. B. Computer forensics deals with the process of finding evidence related to a crime to find the culprits and initiate legal action against them. C. Computer forensics deals with the process of finding evidence related to a digital crime to find the culprits and initiate legal action against them. D. Computer forensics deals with the process of finding evidence related to a digital crime to find the culprits and avoid legal action against them. C Which of the following is not an objective of computer forensics? A. Track and prosecute the perpetrators in a court of law. B. Identify, gather, and preserve the evidence of a cybercrime. C. Interpret, document, and present the evidence to be admissible during prosecution. D. Document vulnerabilities allowing further loss of intellectual property, finances, and reputation during an attack. D Which of the following is true regarding the enterprise theory of investigation (ETI) ? A. It adopts a holistic approach toward any criminal activity as a criminal operation rather than as a single criminal act. B. It adopts an approach toward criminal activity as a criminal act. C. It differs from traditional investigative methods, and it is less complex and less time-consuming. D. It encourages reactive action on the structure of the criminal enterprise. A Forensic readiness referrers to: A. having no impact on prospects of successful legal action B. replacing the need to meet all regulatory requirements C. the establishment of specific incident response procedures and designated trained personnel to prevent a breach D. an organization's ability to make optimal use of digital evidence in a limited time period and with minimal investigation costs D Which of the following is not an element of cybercrime? A. anonymity through masquerading B. fast-paced speed C. volatile evidence D. evidence smaller in size D Which of the following is true of cyber crimes? A. Investigators, with a warrant, have the authority to forcibly seize the computing devices. B. Investigators attempt to demonstrate information to the opposite party to support the claims and induce settlement. C. The searching of the devices is based on mutual understanding and provides a wider time frame to hide the evidence. D. The claimant is responsible for the collection and analysis of the evidence. A Which of the following is true of civil crimes? A. The initial reporting of the evidence is generally informal. B. A formal investigation report is required. C. Law enforcement agencies are responsible for collecting and analyzing evidence. D. The standards of proof need to be very high. A Which of the following is not a consideration during a cybercrimes investigation? A. collection of clues and forensic evidence B. analysis of digital evidence C. presentation of admissible evidence D. value or cost to the victim D Which of the following is a user-created source of potential evidence? A. address book B. printer spool C. cookies D. log files A Which of the following is a computer-created source of potential evidence? A. bookmarks B. spreadsheet C. swap file D. steganography C Which of the following is not where potential evidence may be located? A. digital camera B. smart card C. processor D. thumb drive C Under which of the following conditions will duplicate evidence not suffice? A. when original evidence is destroyed in the normal course of business B. when original evidence is in possession of the originator C. when original evidence is in possession of a third party D. when original evidence is destroyed due to fire or flood B Which of the following Federal Rules of Evidence governs proceedings in the courts of the United States? A. Rule 105 B. Rule 103 C. Rule 101 D. Rule 102 C Which of the following Federal Rules of Evidence ensures that the truth may be ascertained and the proceedings justly determined? A. Rule 105 B. Rule 102 C. Rule 101 D. Rule 103 B Which of the following Federal Rules of Evidence contains Rulings on Evidence? A. Rule 103 B. Rule 105 C. Rule 102 D. Rule 101 A Which of the following Federal Rules of Evidence states that the court shall restrict the evidence to its proper scope and instruct the jury accordingly? A. Rule 102 B. Rule 103 C. Rule 101 D. Rule 105 D Which of the following answers refers to a set of methodological procedures and techniques to identify, gather, preserve, extract, interpret, document, and present evidence from computing equipment in such a manner that the discovered evidence is acceptable during a legal and/or administrative proceeding in a court of law? A. disaster recovery B. incident handling C. computer forensics D. network analysis C Computer forensics deals with the process of finding _______ related to digital crime to find the culprits and initiate legal action against them. A. insider threats B. evidence C. fraud D. malware B Minimizing the tangible and intangible losses to the organization or an individual is considered an essential computer forensics use. A. True B. False A Cybercrimes can be classified into the following two types of attacks, based on the line of attack. A. Fraud and Spam B. Phishing and Malware C. Internal and External C Espionage, theft of intellectual property, manipulation of records, and Trojan horse attacks are examples of what? A. insider attacks or secondary threats B. insider attacks or primary threats C. outsider attacks or secondary threats D. outsider attacks or primary threats B External attacks occur when there are inadequate information-security policies and procedures. A. True B. False A Which type of cases involve disputes between two parties? A. civil B. investigative C. administrative D. criminal A A computer forensic examiner can investigate any crime as long as he or she takes detailed notes and follows appropriate processes. A. True B. False B _______ is the standard investigative model used by the FBI when conducting investigations against major criminal organizations. A. Enterprise Theory of Investigation (ETI) B. Both Enterprise Theory of Investigation (ETI) and Entrepreneur Theory of Investigation C. Entrepreneur Theory of Investigation A Digital devices store data about sessions such as user and type of connection. A. True B. False A Forensic readiness includes technical and non-technical actions that maximize an organization's competence to use digital evidence. A. True B. False A Which of the following is the process of developing a strategy to address the occurrence of any security breach in the system or network? A. best evidence rule B. incident response C. security policy D. forensic readiness planning B Codes of ethics are the principals stated to describe the expected behavior of an investigator while handling a case. Which of the following is not a principal that a computer forensic investigator must follow? A. Ensure integrity of the evidence throughout the investigation process. B. Act with utmost ethical and moral principles. C. Provide personal or prejudiced opinions. D. Act in accordance with federal statutes, state statutes, and local laws and policies. C What must an investigator do in order to offer a good report to a court of law and ease the prosecution? A. preserve the evidence B. prosecute the evidence C. obfuscate the evidence D. authorize the evidence A What is the role of an expert witness? A. to testify against the plaintiff B. to support the defense C. to evaluate the court's decisions D. to educate the public and court D Which of the following is NOT a legitimate authorizer of a search warrant? A. magistrate B. concerned authority C. first responder D. court of law C Under which of the following circumstances has a court of law allowed investigators to perform searches without a warrant? A. Delay in obtaining a warrant may lead to the preservation of evidence and expedite the investigation process. B. Delay in obtaining a warrant may lead to the destruction of evidence and hamper the investigation process. C. Expediting the process of obtaining a warrant may lead to a delay in prosecution of a perpetrator. D. Expediting the process of obtaining a warrant may lead to the timely prosecution of a perpetrator. B Which of the following should be considered before planning and evaluating the budget for the forensic investigation case? A. use of outdated, but trusted, technologies B. breakdown of costs into daily and annual expenditure C. past success rate as a measure of value D. current media coverage of high-profile computer crimes B Which of the following should be physical location and structural design considerations for forensics labs? A. Lightweight construction materials need to be used. B. Lab exteriors should have no windows. C. Room size should be compact with standard HVAC equipment. D. Computer systems should be visible from every angle. B Which of the following should be work area considerations for forensics labs? A. Multiple examiners should share workspace for efficiency. B. Additional equipment such as notepads, printers, etc. should be stored elsewhere. C. Examiner station has an area of about 50-63 square feet. D. Physical computer examinations should take place in a separate workspace. C Which of the following is NOT part of the Computer Forensics Investigation Methodology? A. testify as an expert witness B. data analysis C. testify as an expert defendant D. data acquisition C Which of the following is NOT part of the Computer Forensics Investigation Methodology? A. Secure the evidence. B. Assess the evidence. C. Destroy the evidence. D. Collect the evidence. C Investigators can immediately take action after receiving a report of a security incident. A. False B. True A In forensics laws, "authenticating or identifying evidences" comes under which rule? A. Rule 708 B. Rule 801 C. Rule 608 D. Rule 901 D Courts call knowledgeable persons to testify to the accuracy of the investigative process. These people who testify are known as the: A. judges B. character witnesses C. counselors D. expert witnesses D A chain of custody is a critical document in the computer forensics investigation process because the document provides legal validation of appropriate evidence handling. A. True B. False A Identify the following project which was launched by the National Institute of Standards and Technology (NIST), that establishes a "methodology for testing computer forensics software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware." A. Computer Forensic Tool Testing Project (CFTTP) B. Computer Forensic Hardware Project (CFHP) C. Enterprise Theory of Investigation (ETI) D. Computer Forensic Investigation Project (CFIP) A In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case? A. evidence procedures are not important unless you work for a law enforcement agency B. evidence must be handled in the same way regardless of the type of case C. evidence in a civil case must be secured more tightly than in a criminal case D. evidence in a criminal case must be secured more tightly than in a civil case B Which part of the Windows Registry contains the user's password file? A. HKEY_LOCAL_MACHINE B. HKEY_CURRENT_CONFIGURATION C. HKEY_USER D. HKEY_CURRENT_USER C If a suspect's computer is located in an area that may have toxic chemicals, you must: A. coordinate with the HAZMAT team B. do not enter alone C. assume the suspect machine is contaminated D. determine a way to obtain the suspect computer A Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their pervious activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident? A. The vulnerability exploited in the incident B. The manufacture of the system compromised C. The nature of the attack D. The logic, formatting and elegance of the code used in the attack D What information do you need to recover when searching a victims computer for a crime committed with specific e-mail message? A. Username and password B. Firewall log C. E-mail header D. Internet service provider information C The use of warning banners helps a company avoid litigation by overcoming an employees assumed ___________________ when connecting to the companys intranet, network, or virtual private network (VPN) and will allow the companys investigators to monitor, search, and retrieve information stored within the network. A. right of privacy B. right to Internet access C. right to work D. right of free speech A [Show Less]
- Exam
- $12.45
- 0
- 97
WGU C702 CHFI and OA Questions and Answers 2023
Which of the following is true regarding computer forensics? Computer forensics deals with the process of finding evidence related to a digital crime to f... [Show More] ind the culprits and initiate legal action against them. Which of the following is NOT a objective of computer forensics? Document vulnerabilities allowing further loss of intellectual property, finances, and reputation during an attack. Which of the following is true regarding Enterprise Theory of Investigation (ETI)? It adopts a holistic approach toward any criminal activity as a criminal operation rather as a single criminal act. Forensic readiness refers to: An organization's ability to make optimal use of digital evidence in a limited time period and with minimal investigation costs. Which of the following is NOT a element of cybercrime? Evidence smaller in size. Which of the following is true of cybercrimes? Investigators, with a warrant, have the authority to forcibly seize the computing devices. Which of the following is true of cybercrimes? The initial reporting of the evidence is usually informal. Which of the following is NOT a consideration during a cybercrime investigation? Value or cost to the victim. Which of the following is a user-created source of potential evidence? Address book. Which of the following is a computer-created source of potential evidence? Swap file. Which of the following is NOT where potential evidence may be located? Processor. Under which of the following conditions will duplicate evidence NOT suffice? When original evidence is in possession of the originator. Which of the following Federal Rules of Evidence governs proceedings in the courts of the United States? Rule 101. Which of the following Federal Rules of Evidence ensures that the truth may be ascertained and the proceedings justly determined? Rule 102. Which of the following Federal Rules of Evidence contains rulings on evidence? Rule 103 Which of the following Federal Rules of Evidence states that the court shall restrict the evidence to its proper scope and instruct the jury accordingly? Rule 105 Which of the following refers to a set of methodological procedures and techniques to identify, gather, preserve, extract, interpret, document, and present evidence from computing equipment in such a manner that the discovered evidence is acceptable during a legal and/or administrative proceeding in a court of law? Computer Forensics. Computer Forensics deals with the process of finding _____ related to a digital crime to find the culprits and initiate legal action against them. Evidence. Minimizing the tangible and intangible losses to the organization or an individual is considered an essential computer forensics use. True. Cybercrimes can be classified into the following two types of attacks, based on the line of attack. Internal and External. Espionage, theft of intellectual property, manipulation of records, and trojan horse attacks are examples of what? Insider attack or primary attacks. External attacks occur when there are inadequate information-security policies and procedures. True. Which type of cases involve disputes between two parties? Civil. A computer forensic examiner can investigate any crime as long as he or she takes detailed notes and follows the appropriate processes. False. ________ is the standard investigative model used by the FBI when conducting investigations against major criminal organizations. Enterprise Theory of Investigation (ETI). Forensic readiness includes technical and nontechnical actions that maximize an organization's competence to use digital evidence. True. Which of the following is the process of developing a strategy to address the occurrence of any security breach in the system or network? Incident Response. [Show Less]
- Exam
- $12.95
- 0
- 99
WGU C702 Questions and Answers 100% correct
A software company suspects that employees have set up automatic corporate email forwarding to their personal inboxes against company policy. The company h... [Show More] ires forensic investigators to identify the employees violating policy, with the intention of issuing warnings to them. Which type of cybercrime investigation approach is this company taking? Civil Criminal Administrative Punitive Administrative Which model or legislation applies a holistic approach toward any criminal activity as a criminal operation? Enterprise Theory of Investigation Racketeer Influenced and Corrupt Organizations Act Evidence Examination Law Enforcement Cyber Incident Reporting Enterprise Theory of Investigation What does a forensic investigator need to obtain before seizing a computing device in a criminal case? Court warrant Completed crime report Chain of custody document Plaintiff's permission Court warrant Which activity should be used to check whether an application has ever been installed on a computer? Penetration test Risk analysis Log review Security review Log review Which characteristic describes an organization's forensic readiness in the context of cybercrimes? It includes moral considerations. It includes cost considerations. It excludes nontechnical actions. It excludes technical actions. It includes cost considerations. A cybercrime investigator identifies a Universal Serial Bus (USB) memory stick containing emails as a primary piece of evidence. Who must sign the chain of custody document once the USB stick is in evidence? Those who obtain access to the device Anyone who has ever used the device Recipients of emails on the device Authors of emails on the device Those who obtain access to the device Which type of attack is a denial-of-service technique that sends a large amount of data to overwhelm system resources? Phishing Spamming Mail bombing Bluejacking Mail bombing Which computer crime forensics step requires an investigator to duplicate and image the collected digital information? Securing evidence Acquiring data Analyzing data Assessing evidence Acquiring data What is the last step of a criminal investigation that requires the involvement of a computer forensic investigator? Analyzing the data collected Testifying in court Assessing the evidence Performing search and seizure Testifying in court How can a forensic investigator verify an Android mobile device is on, without potentially changing the original evidence or interacting with the operating system? Check to see if it is plugged into a computer Tap the screen multiple times Look for flashing lights Hold down the power button Look for flashing lights What should a forensic investigator use to protect a mobile device if a Faraday bag is not available? Aluminum foil Sturdy container Cardboard box Bubble wrap Aluminum foil Which criterion determines whether a technology used by government to obtain information in a computer search is considered innovative and requires a search warrant? Availability to the general public Dependency on third-party software Implementation based on open source software Use of cloud-based machine learning Availability to the general public Which situation allows a law enforcement officer to seize a hard drive from a residence without obtaining a search warrant? The computer is left unattended. The front door is wide open. The occupant is acting suspicious. The evidence is in imminent danger. The evidence is in imminent danger. Which legal document contains a summary of findings and is used to prosecute? Investigation report Search warrant Search and seizure Chain of custody Investigation report What should an investigator use to prevent any signals from reaching a mobile phone? Faraday bag Dry bag Anti-static container Lock box Faraday bag A forensic investigator is called to the stand as a technical witness in an internet payment fraud case. Which behavior is considered ethical by this investigator while testifying? Providing and explaining facts found during the investigation Interpreting the findings and offering a clear opinion to the jury Helping the jury arrive at a conclusion based on the facts Assisting the attorney in compiling a list of essential questions Providing and explaining facts found during the investigation [Show Less]
- Exam
- $12.45
- 0
- 107
Purchase the bundle to get the full access instantly
- 3 Million+ Study Documents
- 100% Money Back Guarantee
- Immediate Download Access
Add To Cart
Reviews 0
Bundle Details
$28.45
- Trusted by 800,000+ Students
- 24/7 Money Back Guarantee
- Download is directly available
100
0
Seller Details
