C840 forensics tools Questions with Verified Answers (Correct
Update)
Question 1: Where would you seek evidence that Ophcrack had been
used on a Windows Server 2008
machine?
Answer: In the logs of the server; look for the reboot of the system
Question 2: What is the starting point for in- T
vestigating denial-of-service attacks?
Answer: Tracing the packets
Question 3: Bob was asked to make a copy
of all the evidence from the
compromised system. Melanie
did a DOS copy of all the files on
the system. What would be the
primary reason for you to recommend for or against using a
disk-imaging tool?
Answer: A simple DOS copy will not include deleted files, file slack, and
other information.
Question 4: Once an intrusion into your
organization's information system has been detected, which
of the following actions should
be performed first?
Answer: Contain the intrusion.
Question 5: Is the cyber-equivalent of vandalism
Answer: DOS attacts
Question 6: Use of tools enables an investigator to reconstruct file fragments if files have been
deleted
or overwritten.
Answer: bit-level
d
Page 1
, Question 7: Windows 2000 and newer operating systems file systems utilize
Answer: NTFS
Question 8: Which denial of service (DoS)
attack generates a large number of ICMP echo request from
a single request, acting like an
amplifier and causing a traffic
jam in the target network?
Answer: smurf attack
Question 9: Which open-source alternative
to PC Anywhere allows program
users to legitimately log on to
a remote system and work just
like they ere sitting in front of
the desktop?
Answer: Timbuku
Question 10: A part of disaster recovery plan, h
provide continuous online
backup by using optical or tape
"jukeboxes"
Answer: ierarchical storage management (HSM)
Question 11: Is a free suite command line
tools and has ability to search
for fragments of deleted tools.
the graphical user interface
(GUI) for the suite called Autopsy.
Answer: The Sleuth kit
Question 12: Which forensic tool provider offers professional Forensic Examiner?
Answer: ComputerCop
Page 2
Update)
Question 1: Where would you seek evidence that Ophcrack had been
used on a Windows Server 2008
machine?
Answer: In the logs of the server; look for the reboot of the system
Question 2: What is the starting point for in- T
vestigating denial-of-service attacks?
Answer: Tracing the packets
Question 3: Bob was asked to make a copy
of all the evidence from the
compromised system. Melanie
did a DOS copy of all the files on
the system. What would be the
primary reason for you to recommend for or against using a
disk-imaging tool?
Answer: A simple DOS copy will not include deleted files, file slack, and
other information.
Question 4: Once an intrusion into your
organization's information system has been detected, which
of the following actions should
be performed first?
Answer: Contain the intrusion.
Question 5: Is the cyber-equivalent of vandalism
Answer: DOS attacts
Question 6: Use of tools enables an investigator to reconstruct file fragments if files have been
deleted
or overwritten.
Answer: bit-level
d
Page 1
, Question 7: Windows 2000 and newer operating systems file systems utilize
Answer: NTFS
Question 8: Which denial of service (DoS)
attack generates a large number of ICMP echo request from
a single request, acting like an
amplifier and causing a traffic
jam in the target network?
Answer: smurf attack
Question 9: Which open-source alternative
to PC Anywhere allows program
users to legitimately log on to
a remote system and work just
like they ere sitting in front of
the desktop?
Answer: Timbuku
Question 10: A part of disaster recovery plan, h
provide continuous online
backup by using optical or tape
"jukeboxes"
Answer: ierarchical storage management (HSM)
Question 11: Is a free suite command line
tools and has ability to search
for fragments of deleted tools.
the graphical user interface
(GUI) for the suite called Autopsy.
Answer: The Sleuth kit
Question 12: Which forensic tool provider offers professional Forensic Examiner?
Answer: ComputerCop
Page 2
