WGU C702 FORENSICS AND NETWORK
INTRUSION PROFESSIONAL EXAM
REVIEW WITH TESTED QUESTIONS AND
EXPERT SOLUTIONS
◉ Chain of Custody:
Answer: A method for documenting the history and possession of
a sample from the time of collection, though analysis and data
reporting, to its final disposition
◉ Bit Stream copy:
Answer: A bit by bit copy of the original storage medium and or
evidence
◉ Ext3:
Answer: Ext3 or third extended file system, is a journaled file
system that is commonly used by the Linux kernel. It is the default
file system for many popular Linux distributions
◉ Logical block addressing [LBA]:
Answer: used for specifying the location of blocks of data stored
on computer storage devices such as hard disks. LBA is a
particularly simple linear addressing scheme, blocks are located
by an integer index, with the first block being LBA 0, the second
LBA 1, and so on in a sequential matter
,◉ Cluster:
Answer: Is the smallest logical unit on a hard drive
◉ Lost Cluster:
Answer: The operating system assigns a unique number to each
cluster and then keeps track of files according to which clusters
they use. Occasionally, the operating system marks a cluster as
being used even though it is not assigned to any file. This is called
a lost cluster
◉ Bad Cluster:
Answer: Is a sector on a computer's disk drive or flash memory
that is either inacessible or unwriteable due to permanent
damage, such as physical damage to the disk surface or failed flash
memory transistors
◉ Event Logs:
Answer: Windows event log is a record of a computer's alerts and
notifications. Microsoft defines an event as "any significant
occurrence in the OS or in a program that requires users to be
notified or an entry added to a log."
◉ Tracking user logon activity via Audit Event ID's:
Answer: 512 Start-up
513 Shutdown
, 528 Logon
531 Disabled Account
538 Logoff
◉ Audit Policy Event ID's:
Answer: Event ID 4904: An attempt was made to register a
security event source.
Event ID 4902: The Per-user audit policy table was created.
◉ E-mail Protocols
Answer: POP3: Port 110;
SMTP: Port 25;
IMAP: Port 143
◉ POP3:
Answer: A protocol for receiving e-mail by downloading it to your
computer from a mailbox on the server of an Internet service
provider
◉ SMTP:
Answer: A protocol for sending e-mail messages between servers
over the Internet use. The messages can then be retrieved with an
e-mail client using either POP3 or IMAP. SMTP is also generally
used to send messages from a mail client to a mail server.
INTRUSION PROFESSIONAL EXAM
REVIEW WITH TESTED QUESTIONS AND
EXPERT SOLUTIONS
◉ Chain of Custody:
Answer: A method for documenting the history and possession of
a sample from the time of collection, though analysis and data
reporting, to its final disposition
◉ Bit Stream copy:
Answer: A bit by bit copy of the original storage medium and or
evidence
◉ Ext3:
Answer: Ext3 or third extended file system, is a journaled file
system that is commonly used by the Linux kernel. It is the default
file system for many popular Linux distributions
◉ Logical block addressing [LBA]:
Answer: used for specifying the location of blocks of data stored
on computer storage devices such as hard disks. LBA is a
particularly simple linear addressing scheme, blocks are located
by an integer index, with the first block being LBA 0, the second
LBA 1, and so on in a sequential matter
,◉ Cluster:
Answer: Is the smallest logical unit on a hard drive
◉ Lost Cluster:
Answer: The operating system assigns a unique number to each
cluster and then keeps track of files according to which clusters
they use. Occasionally, the operating system marks a cluster as
being used even though it is not assigned to any file. This is called
a lost cluster
◉ Bad Cluster:
Answer: Is a sector on a computer's disk drive or flash memory
that is either inacessible or unwriteable due to permanent
damage, such as physical damage to the disk surface or failed flash
memory transistors
◉ Event Logs:
Answer: Windows event log is a record of a computer's alerts and
notifications. Microsoft defines an event as "any significant
occurrence in the OS or in a program that requires users to be
notified or an entry added to a log."
◉ Tracking user logon activity via Audit Event ID's:
Answer: 512 Start-up
513 Shutdown
, 528 Logon
531 Disabled Account
538 Logoff
◉ Audit Policy Event ID's:
Answer: Event ID 4904: An attempt was made to register a
security event source.
Event ID 4902: The Per-user audit policy table was created.
◉ E-mail Protocols
Answer: POP3: Port 110;
SMTP: Port 25;
IMAP: Port 143
◉ POP3:
Answer: A protocol for receiving e-mail by downloading it to your
computer from a mailbox on the server of an Internet service
provider
◉ SMTP:
Answer: A protocol for sending e-mail messages between servers
over the Internet use. The messages can then be retrieved with an
e-mail client using either POP3 or IMAP. SMTP is also generally
used to send messages from a mail client to a mail server.
