WGU C840 DIGITAL FORENSICS IN
CYBERSECURITY TEST PAPER SOLVED
◉ How does a rainbow table work to crack a password?
A It starts with a hashed password and then decrypts each
individual character.
B It searches for passwords stored in RAM and startup files and then
matches them to the predefined table.
C It uses a table to store hash value for every character in the
alphabet, then assembles them to create a match.
D It uses a table of all possible keyboard combinations and their
hash values, then searches for a match.. Answer: D
◉ What should a forensic investigator use to gather the most
reliable routing information for tracking an email message?
A Tracert
B Netstat
C Email header
D Email address. Answer: C
,◉ Which activity involves email tracing?
A Performing nslookup on the recipient of the message
B Determining the ownership of the source email server
C Removing email header information
D Making bit-by-bit copies of each of the email servers involved.
Answer: B
◉ A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives.
Which digital evidence should be reviewed?
A /var/vm
B /Users/<user>/Library/Preferences
C /var/log
D /Users/<user>/.bash_history. Answer: C
◉ Which log or folder contains information about printed
documents on a computer running Mac OS X?
,A /var/log/lpr.log
B /var/spool/cups
C /var/vm
D /var/log. Answer: B
◉ Which Windows event log should be checked for evidence of
invalid logon attempts?
A Application
B Security
C ForwardedEvents
D System. Answer: B
◉ A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh system
to ensure the system has been patched.
Which folder contains the software updates logs?
A /var/spool/cups
B /var/log
, C /proc
D /Library/Receipts. Answer: D
◉ A forensic investigator wants to image an older BlackBerry
smartphone running OS 7.0.
Which tool should the investigator use?
A CopyQM Plus
B BlackBerry Extractor
C The Sleuth Kit
D BlackBerry Desktop Manager. Answer: D
◉ An investigator wants to extract information from a mobile device
by connecting it to a computer.
What should the investigator take great care to ensure?
A That proper step information is written to the mobile device
B That the mobile device is updated with the latest operating system
C That current time stamps of forensics activities are written to the
device
CYBERSECURITY TEST PAPER SOLVED
◉ How does a rainbow table work to crack a password?
A It starts with a hashed password and then decrypts each
individual character.
B It searches for passwords stored in RAM and startup files and then
matches them to the predefined table.
C It uses a table to store hash value for every character in the
alphabet, then assembles them to create a match.
D It uses a table of all possible keyboard combinations and their
hash values, then searches for a match.. Answer: D
◉ What should a forensic investigator use to gather the most
reliable routing information for tracking an email message?
A Tracert
B Netstat
C Email header
D Email address. Answer: C
,◉ Which activity involves email tracing?
A Performing nslookup on the recipient of the message
B Determining the ownership of the source email server
C Removing email header information
D Making bit-by-bit copies of each of the email servers involved.
Answer: B
◉ A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives.
Which digital evidence should be reviewed?
A /var/vm
B /Users/<user>/Library/Preferences
C /var/log
D /Users/<user>/.bash_history. Answer: C
◉ Which log or folder contains information about printed
documents on a computer running Mac OS X?
,A /var/log/lpr.log
B /var/spool/cups
C /var/vm
D /var/log. Answer: B
◉ Which Windows event log should be checked for evidence of
invalid logon attempts?
A Application
B Security
C ForwardedEvents
D System. Answer: B
◉ A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh system
to ensure the system has been patched.
Which folder contains the software updates logs?
A /var/spool/cups
B /var/log
, C /proc
D /Library/Receipts. Answer: D
◉ A forensic investigator wants to image an older BlackBerry
smartphone running OS 7.0.
Which tool should the investigator use?
A CopyQM Plus
B BlackBerry Extractor
C The Sleuth Kit
D BlackBerry Desktop Manager. Answer: D
◉ An investigator wants to extract information from a mobile device
by connecting it to a computer.
What should the investigator take great care to ensure?
A That proper step information is written to the mobile device
B That the mobile device is updated with the latest operating system
C That current time stamps of forensics activities are written to the
device
