Day 5 C702 EXAM [LATEST
2025-26] QUESTIONS AND
VERIFIED ANSWER 100%
GUARANTEED PASS
What type of file is represented by a colon (:) with a name following it in the Master File Table
(MFT) of an NTFS disk?
A. a reserved file
B. a compressed file
C. a data streamfile
D. an encrypted file - correct answer C
From the following spam mail header, identify the host IP that sent this spam?
From Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk
(8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com
(pcd249020. netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)
with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >
From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail Priority:
Normal
,Reply-To: "china hotel web"
A. 137.189.96.52
B. 203.218.39.50
C. 8.12.1.0
D. 203.218.39.20 - correct answer D
An expert witness may give an opinion if:
A. the opinion, inferences, or conclusions depend on special knowledge, skill, or training not
within the ordinary experience of lay jurors
B. to deter the witness from expanding the scope of his or her investigation beyond the
requirements of the case
C. to stimulate discussion between the consulting expert and the expert witness
D. to define the issues of the case for determination by the finder of fact - correct answer A
What does the acronym POST mean as it relates to a PC?
A. PowerOn Self Test
B. Pre Operational Situation Test
C. Primary Operating System Test
D. Primary Operations Short Test - correct answer A
When obtaining a warrant it is important to:
A. generallydescribe the place to be searched and particularly describe the items to be seizedB.
particularlydescribe the place to be searched and particularly describe the items to be seizedC.
, generallydescribe the place to be searched and generally describe the items to be seizedD.
particularlydescribe the place to be searched and generally describe the items to be seized -
correct answer B
A state department site was recently attacked and all the servers had their hard disks erased.
The incident response team sealed the area and commenced investigation. During evidence
collection, they came across a zip disk that did not have the standard labeling on it. The incident
team ran the disk on an isolated system and found that the system disk was accidentally erased.
They decided to call in the FBI for further investigation. Meanwhile, they short listed possible
suspects including three summer interns. Where did the incident team go wrong?
A. They examined the actual evidence on an unrelated system
B. They tampered with the evidence by using it
C. They attempted to implicate personnel without proof
D. They called in the FBI without correlating with the fingerprint data - correct answer B
You have been asked to investigate the possibility of computer fraud in the finance department
of a company. It is suspected that a staff member has been committing finance fraud by printing
cheques that have not been authorized. You have exhaustively searched all data files on a
bitmap image of the target computer, but have found no evidence. You suspect the files may
not have been saved. What should you examine next in this
case?
A. The recycle bin
B. The metadata
C. Theswapfile
D. The registry - correct answer C
One technique for hiding information is to change the file extension from the correct one to one
that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc
2025-26] QUESTIONS AND
VERIFIED ANSWER 100%
GUARANTEED PASS
What type of file is represented by a colon (:) with a name following it in the Master File Table
(MFT) of an NTFS disk?
A. a reserved file
B. a compressed file
C. a data streamfile
D. an encrypted file - correct answer C
From the following spam mail header, identify the host IP that sent this spam?
From Tue Nov 27 17:27:11 2001
Received: from viruswall.ie.cuhk.edu.hk (viruswall [137.189.96.52]) by eng.ie.cuhk.edu.hk
(8.11.6/8.11.6) with ESMTP id
fAR9RAP23061 for ; Tue, 27 Nov 2001 17:27:10 +0800 (HKT) Received: from mydomain.com
(pcd249020. netvigator.com [203.218.39.20]) by viruswall.ie.cuhk.edu.hk (8.12.1/8.12.1)
with SMTP id fAR9QXwZ018431 for ; Tue, 27 Nov 2001 17:26:36 +0800 (HKT)
Message-Id: >
From: "china hotel web"
To: "Shlam"
Subject: SHANGHAI (HILTON HOTEL) PACKAGE
Date: Tue, 27 Nov 2001 17:25:58 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail Priority:
Normal
,Reply-To: "china hotel web"
A. 137.189.96.52
B. 203.218.39.50
C. 8.12.1.0
D. 203.218.39.20 - correct answer D
An expert witness may give an opinion if:
A. the opinion, inferences, or conclusions depend on special knowledge, skill, or training not
within the ordinary experience of lay jurors
B. to deter the witness from expanding the scope of his or her investigation beyond the
requirements of the case
C. to stimulate discussion between the consulting expert and the expert witness
D. to define the issues of the case for determination by the finder of fact - correct answer A
What does the acronym POST mean as it relates to a PC?
A. PowerOn Self Test
B. Pre Operational Situation Test
C. Primary Operating System Test
D. Primary Operations Short Test - correct answer A
When obtaining a warrant it is important to:
A. generallydescribe the place to be searched and particularly describe the items to be seizedB.
particularlydescribe the place to be searched and particularly describe the items to be seizedC.
, generallydescribe the place to be searched and generally describe the items to be seizedD.
particularlydescribe the place to be searched and generally describe the items to be seized -
correct answer B
A state department site was recently attacked and all the servers had their hard disks erased.
The incident response team sealed the area and commenced investigation. During evidence
collection, they came across a zip disk that did not have the standard labeling on it. The incident
team ran the disk on an isolated system and found that the system disk was accidentally erased.
They decided to call in the FBI for further investigation. Meanwhile, they short listed possible
suspects including three summer interns. Where did the incident team go wrong?
A. They examined the actual evidence on an unrelated system
B. They tampered with the evidence by using it
C. They attempted to implicate personnel without proof
D. They called in the FBI without correlating with the fingerprint data - correct answer B
You have been asked to investigate the possibility of computer fraud in the finance department
of a company. It is suspected that a staff member has been committing finance fraud by printing
cheques that have not been authorized. You have exhaustively searched all data files on a
bitmap image of the target computer, but have found no evidence. You suspect the files may
not have been saved. What should you examine next in this
case?
A. The recycle bin
B. The metadata
C. Theswapfile
D. The registry - correct answer C
One technique for hiding information is to change the file extension from the correct one to one
that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc
