C702 Review Questions with Verified Correct
Answers
An employee is attempting to wipe out data stored on a couple of compact discs (CDs)
and digital video discs (DVDs) by using a large magnet. You inform him that this
method will not be effective in wiping out the data because CDs and DVDs are
______________ media used to store large amounts of data and are not affected by the
magnet.
A. anti-magnetic
B. magnetic
C. logical
D. optical
D
You are working as computer forensics investigator and are called by the owner of an
accounting firm to investigate possible computer abuse by one of the firms employees.
You meet with the owner of the firm and discover that the company has never
published a policy stating that they reserve the right to inspect their computing assets at
will. What do you do?
A. inform the owner that conducting an investigation without a policy is a violation of
the 4th Amendment B. inform the owner that conducting an investigation without a
policy is not a problem because a policy is only necessary for government agencies
C. inform the owner that conducting an investigation without a policy is a violation of
the employees expectation of privacy
,D. inform the owner that conducting an investigation without a policy is not a problem
because the company is privately owned
C
You are working as a computer forensics investigator for a corporation on a computer
abuse case. You discover evidence that shows the subject of your investigation is also
embezzling money from the company. The company CEO and the corporate legal
counsel advise you to contact local law enforcement and provide them with the evidence
that you have found. The law enforcement officer that responds requests that you put a
network sniffer on your network and monitor all traffic to the subjects computer. You
inform the officer that you will not be able to comply with that request because doing so
would:
A. cause network congestion
B. write information to the subjects hard drive
C. violate your contract
D. make you an agent of law enforcement
D
The police believe that Mevin Matthew has been obtaining unauthorized access to
computers belonging to numerous computer software and computer operating systems
manufacturers, cellular telephone manufacturers, Internet Service Providers, and
educational institutions. They also suspect that he has been stealing, copying, and
misappropriating proprietary computer software belonging to the several victim
companies. What is preventing the police from breaking down the suspects door and
searching his home and seizing all of his computer equipment if they have not yet
,obtained a warrant?
A. the Federal Rules of Evidence
B. the Fourth Amendment
C. theUSA Patriot Act
D. the Good Samaritan Laws
B
You are assisting in the investigation of a possible Web Server hack. The company who
called you stated that customers reported to them that whenever they entered the web
address of the company in their browser, what they received was a pornographic web
site. The company checked the web server and nothing appears wrong. When you type
in the IP address of the web site in your browser everything appears normal. What is
the name of the attack that affects the DNS cache of the name resolution servers,
resulting in those servers directing users to the wrong web site?
A. ARP Poisoning
B. IP Spoofing
C. HTTP redirect attack
D. DNS Poisoning
D
When examining a file with a Hex Editor, what space does the file header occupy?
A. the first several bytes of the file
B. none, file headers are contained in the FAT
, C. one byte at the beginning of the file
D. the last several bytes of the file
A
You should make at least how many bit-stream copies of a suspect drive?
A. 3
B. 4
C. 2
D. 1
C
You have completed a forensic investigation case. You would like to destroy the data
contained in various hard disks at the forensics lab due to sensitivity of the case. How
would you permanently erase the data on the hard disks? (Recovery of data should be
impossible)
A. Run powerful magnets over the hard disk
B. Smash the hard disk with a hammer
C. Throw the hard disk into the fire
D. Overwrite the contents of the hard disk with junk data
E. Format the hard disk multiple times using a low level disk utility
C
When a file is deleted by Windows Explorer or through the MS-DOS Delete command,
the operating system inserts _______________ in the first letter position of the filename
in the FAT database.
Answers
An employee is attempting to wipe out data stored on a couple of compact discs (CDs)
and digital video discs (DVDs) by using a large magnet. You inform him that this
method will not be effective in wiping out the data because CDs and DVDs are
______________ media used to store large amounts of data and are not affected by the
magnet.
A. anti-magnetic
B. magnetic
C. logical
D. optical
D
You are working as computer forensics investigator and are called by the owner of an
accounting firm to investigate possible computer abuse by one of the firms employees.
You meet with the owner of the firm and discover that the company has never
published a policy stating that they reserve the right to inspect their computing assets at
will. What do you do?
A. inform the owner that conducting an investigation without a policy is a violation of
the 4th Amendment B. inform the owner that conducting an investigation without a
policy is not a problem because a policy is only necessary for government agencies
C. inform the owner that conducting an investigation without a policy is a violation of
the employees expectation of privacy
,D. inform the owner that conducting an investigation without a policy is not a problem
because the company is privately owned
C
You are working as a computer forensics investigator for a corporation on a computer
abuse case. You discover evidence that shows the subject of your investigation is also
embezzling money from the company. The company CEO and the corporate legal
counsel advise you to contact local law enforcement and provide them with the evidence
that you have found. The law enforcement officer that responds requests that you put a
network sniffer on your network and monitor all traffic to the subjects computer. You
inform the officer that you will not be able to comply with that request because doing so
would:
A. cause network congestion
B. write information to the subjects hard drive
C. violate your contract
D. make you an agent of law enforcement
D
The police believe that Mevin Matthew has been obtaining unauthorized access to
computers belonging to numerous computer software and computer operating systems
manufacturers, cellular telephone manufacturers, Internet Service Providers, and
educational institutions. They also suspect that he has been stealing, copying, and
misappropriating proprietary computer software belonging to the several victim
companies. What is preventing the police from breaking down the suspects door and
searching his home and seizing all of his computer equipment if they have not yet
,obtained a warrant?
A. the Federal Rules of Evidence
B. the Fourth Amendment
C. theUSA Patriot Act
D. the Good Samaritan Laws
B
You are assisting in the investigation of a possible Web Server hack. The company who
called you stated that customers reported to them that whenever they entered the web
address of the company in their browser, what they received was a pornographic web
site. The company checked the web server and nothing appears wrong. When you type
in the IP address of the web site in your browser everything appears normal. What is
the name of the attack that affects the DNS cache of the name resolution servers,
resulting in those servers directing users to the wrong web site?
A. ARP Poisoning
B. IP Spoofing
C. HTTP redirect attack
D. DNS Poisoning
D
When examining a file with a Hex Editor, what space does the file header occupy?
A. the first several bytes of the file
B. none, file headers are contained in the FAT
, C. one byte at the beginning of the file
D. the last several bytes of the file
A
You should make at least how many bit-stream copies of a suspect drive?
A. 3
B. 4
C. 2
D. 1
C
You have completed a forensic investigation case. You would like to destroy the data
contained in various hard disks at the forensics lab due to sensitivity of the case. How
would you permanently erase the data on the hard disks? (Recovery of data should be
impossible)
A. Run powerful magnets over the hard disk
B. Smash the hard disk with a hammer
C. Throw the hard disk into the fire
D. Overwrite the contents of the hard disk with junk data
E. Format the hard disk multiple times using a low level disk utility
C
When a file is deleted by Windows Explorer or through the MS-DOS Delete command,
the operating system inserts _______________ in the first letter position of the filename
in the FAT database.
