Forensics and Network Intrusion – C702 Exam | 2026/2027
Latest Edition | Verified Questions with Correct Answers |
Graded A+
What is a common technique used to distribute malware on the web by mimicking
legitimate institutions in an attempt to steal passwords, credit cards, and bank
account data? - CORRECT ANSWER=Spearphishing
How large is the partition table structure that stores information about the partitions
present on the hard disk? - CORRECT ANSWER=64 bytes
On Macintosh computers, which architecture utilizes EFI to initialize the hardware
interfaces after the BootROM performs POST? - CORRECT
ANSWER=Intelbased Macintosh Computers
:What component of a typical FAT32 file system occupies the largest part of a
partition and stores the actual files and directories? - CORRECT ANSWER=Data
Area
What is a technology that uses multiple smaller disks simultaneously that function
as a single large volume? - CORRECT ANSWER=RAID
What is the maximum file system size in ext3? - CORRECT ANSWER=32 TB
What is the maximum file system size in ext4? - CORRECT ANSWER=1 EiB
:What layer of web application architecture is responsible for the core functioning
of the system and includes logic and applications, such as .NET, used by
,developers to build websites according to client requirements? - CORRECT
ANSWER=business layer
What stage of the Linux boot process includes the task of loading the virtual root
file system created by the initrd image and executes the Linuxrc program? -
CORRECT ANSWER=Kernel Stage
What UFS file system part comprises a collection, including a header with statistics
and free lists, a number of inodes containing file attributes, and a number of data
blocks? - CORRECT ANSWER=cylinder group
Which attribute ID does NTFS set as a flag after encrypting a file where the Data
Decryption Field (DDF) and Data Recovery Field (DRF) is stored? - CORRECT
ANSWER=0x100
Which cmdlet can investigators use in Windows PowerShell to analyze the GUID
Partition Table data structure of the hard disk? - CORRECT ANSWER=Get-GPT
Which cmdlet can investigators use in Windows PowerShell to analyze the GUID
Partition Table to find the exact type of boot sector and display the partition
object? - CORRECT ANSWER=Get-PartitionTable
Which field type refers to the volume descriptor as a supplementary? - CORRECT
ANSWER=Number 2
Which HFS volume structure is the starting block of the volume bitmap? -
CORRECT ANSWER=Logical Block 3
,Which inode field determines what the inode describes and the permissions that
users have to it? - CORRECT ANSWER=Mode
Which inode field enables the file system to correctly allow the right sort of
access? - CORRECT ANSWER=Owner Information
Which item describes the following UEFI boot process phase?The phase of EFI
consisting of clearing the UEFI program from memory, transferring the UEFI
program to the OS, and updating the OS calls for the run time service using a small
part of the memory. - CORRECT ANSWER=Run Time Phase
:Which of the following basic partitioning tools displays details about GPT
partition tables in Linux OS? - CORRECT ANSWER=GNU Parted
Which of the following basic partitioning tools displays details about GPT partition
tables in Macintosh OS? - CORRECT ANSWER=Disk Utility
:What is a lossless image format that is intended to replace older formats and is
copyright- and license-free? - CORRECT ANSWER=PNG
What is a machine-readable language used in major digital operations, such as
sending and receiving emails? - CORRECT ANSWER=ASCII
What sits between the two parts of the Linux file system architecture and provides
the system call interface that connects the two parts? - CORRECT
ANSWER=GNUC Library (glibc)
, What is the RAID level that uses byte level data striping across multiple drives and
distributes the parity information among all member drives? - CORRECT
ANSWER=RAID 5
What was developed by Remy Card as an extensible file system for Linux and is
the basis for all currently shipping Linux distributions? - CORRECT
ANSWER=EXT2
What was the first file system developed for Linux? - CORRECT
ANSWER=Minix
Which command from The Sleuth Kit (TSK) displays general details of a file
system? - CORRECT ANSWER=fsstat
Which component of the NTFS architecture is the processing mode that permits the
executable code to have direct access to all the system components? -
CORRECT ANSWER=Kernel Mode
Which field is the standard identifier set to CD001 for a CD-ROM compliant to the
ISO 9660 standard? - CORRECT ANSWER=second field
Which field type refers to the volume descriptor as a partition descriptor? -
CORRECT ANSWER=number 3
:Which file system for Linux transfers all tracks and boot images on a CD as
normal files? - CORRECT ANSWER=CD File System (CDFS)
Which item describes the following UEFI boot process phase? The phase of EFI
consisting of interpreting the boot configuration data, selecting the Boot Policy for
Latest Edition | Verified Questions with Correct Answers |
Graded A+
What is a common technique used to distribute malware on the web by mimicking
legitimate institutions in an attempt to steal passwords, credit cards, and bank
account data? - CORRECT ANSWER=Spearphishing
How large is the partition table structure that stores information about the partitions
present on the hard disk? - CORRECT ANSWER=64 bytes
On Macintosh computers, which architecture utilizes EFI to initialize the hardware
interfaces after the BootROM performs POST? - CORRECT
ANSWER=Intelbased Macintosh Computers
:What component of a typical FAT32 file system occupies the largest part of a
partition and stores the actual files and directories? - CORRECT ANSWER=Data
Area
What is a technology that uses multiple smaller disks simultaneously that function
as a single large volume? - CORRECT ANSWER=RAID
What is the maximum file system size in ext3? - CORRECT ANSWER=32 TB
What is the maximum file system size in ext4? - CORRECT ANSWER=1 EiB
:What layer of web application architecture is responsible for the core functioning
of the system and includes logic and applications, such as .NET, used by
,developers to build websites according to client requirements? - CORRECT
ANSWER=business layer
What stage of the Linux boot process includes the task of loading the virtual root
file system created by the initrd image and executes the Linuxrc program? -
CORRECT ANSWER=Kernel Stage
What UFS file system part comprises a collection, including a header with statistics
and free lists, a number of inodes containing file attributes, and a number of data
blocks? - CORRECT ANSWER=cylinder group
Which attribute ID does NTFS set as a flag after encrypting a file where the Data
Decryption Field (DDF) and Data Recovery Field (DRF) is stored? - CORRECT
ANSWER=0x100
Which cmdlet can investigators use in Windows PowerShell to analyze the GUID
Partition Table data structure of the hard disk? - CORRECT ANSWER=Get-GPT
Which cmdlet can investigators use in Windows PowerShell to analyze the GUID
Partition Table to find the exact type of boot sector and display the partition
object? - CORRECT ANSWER=Get-PartitionTable
Which field type refers to the volume descriptor as a supplementary? - CORRECT
ANSWER=Number 2
Which HFS volume structure is the starting block of the volume bitmap? -
CORRECT ANSWER=Logical Block 3
,Which inode field determines what the inode describes and the permissions that
users have to it? - CORRECT ANSWER=Mode
Which inode field enables the file system to correctly allow the right sort of
access? - CORRECT ANSWER=Owner Information
Which item describes the following UEFI boot process phase?The phase of EFI
consisting of clearing the UEFI program from memory, transferring the UEFI
program to the OS, and updating the OS calls for the run time service using a small
part of the memory. - CORRECT ANSWER=Run Time Phase
:Which of the following basic partitioning tools displays details about GPT
partition tables in Linux OS? - CORRECT ANSWER=GNU Parted
Which of the following basic partitioning tools displays details about GPT partition
tables in Macintosh OS? - CORRECT ANSWER=Disk Utility
:What is a lossless image format that is intended to replace older formats and is
copyright- and license-free? - CORRECT ANSWER=PNG
What is a machine-readable language used in major digital operations, such as
sending and receiving emails? - CORRECT ANSWER=ASCII
What sits between the two parts of the Linux file system architecture and provides
the system call interface that connects the two parts? - CORRECT
ANSWER=GNUC Library (glibc)
, What is the RAID level that uses byte level data striping across multiple drives and
distributes the parity information among all member drives? - CORRECT
ANSWER=RAID 5
What was developed by Remy Card as an extensible file system for Linux and is
the basis for all currently shipping Linux distributions? - CORRECT
ANSWER=EXT2
What was the first file system developed for Linux? - CORRECT
ANSWER=Minix
Which command from The Sleuth Kit (TSK) displays general details of a file
system? - CORRECT ANSWER=fsstat
Which component of the NTFS architecture is the processing mode that permits the
executable code to have direct access to all the system components? -
CORRECT ANSWER=Kernel Mode
Which field is the standard identifier set to CD001 for a CD-ROM compliant to the
ISO 9660 standard? - CORRECT ANSWER=second field
Which field type refers to the volume descriptor as a partition descriptor? -
CORRECT ANSWER=number 3
:Which file system for Linux transfers all tracks and boot images on a CD as
normal files? - CORRECT ANSWER=CD File System (CDFS)
Which item describes the following UEFI boot process phase? The phase of EFI
consisting of interpreting the boot configuration data, selecting the Boot Policy for
