CSIA 135 FINAL FREQUENTLY TESTED ACTUAL EXAM
QUESTIONS WITH CORRECT ANSWERS
Question 1.
Before signing on to a system, what does a user usually read that describes the user's
responsibilities while using the system?
ANSWER
Warning banner
Question 2.
In a forensic investigation, what documents the evidence-gathering process and includes the history
and possession of a sample from the time of its collection to its final disposition?
ANSWER
Chain of custody
Question 3.
What command displays the mappings between different layers of the network architecture?
ANSWER
arp
Question 4.
What disk-forensic tool creates direct disk-to-disk forensic duplicates and can copy a range of
sectors within or between drives?
ANSWER
DriveSpy
Question 5.
What is a written order issued by a judge that directs a law enforcement officer to search for a
particular piece of evidence at a particular location?
ANSWER
Search warrant
,Question 6.
What process can contribute to associating events that occurred on a computer with a particular
individual?
ANSWER
Time-frame analysis
Question 7.
What represents the space that exists between the end of the file and the end of the last cluster
used by that file?
ANSWER
Slack space
Question 8.
What term defines an event that threatens the security of a computer system or network in an
organization?
ANSWER
Incident
Question 9.
What term defines is defined as an empirically proven set of methods for performing a task in the
best and most efficient way?
ANSWER
Best practices
Question 10.
Which of the following refers to a bit-by-bit copy of the original storage medium?
ANSWER
Bit-stream copy
, Question 11.
A chain of custody document contains the following information about the obtained evidence:
ANSWER
Location where obtained
Question 12.
How should electronic devices gathered at a crime scene be treated?
ANSWER
as potential evidence
Question 13.
What is the term that measures of how perishable electronically stored data is?
ANSWER
Volatility
Question 14.
What procedure requires evidence to be marked using the format aaa/ddmmyy/nnnn/zz?
ANSWER
exhibit numbering
Question 15.
What should a first responder do immediately after arriving at a crime scene?
ANSWER
identify the scene
Question 16.
Which of the following is NOT a potential source for electronic evidence?
ANSWER
File cabinet
QUESTIONS WITH CORRECT ANSWERS
Question 1.
Before signing on to a system, what does a user usually read that describes the user's
responsibilities while using the system?
ANSWER
Warning banner
Question 2.
In a forensic investigation, what documents the evidence-gathering process and includes the history
and possession of a sample from the time of its collection to its final disposition?
ANSWER
Chain of custody
Question 3.
What command displays the mappings between different layers of the network architecture?
ANSWER
arp
Question 4.
What disk-forensic tool creates direct disk-to-disk forensic duplicates and can copy a range of
sectors within or between drives?
ANSWER
DriveSpy
Question 5.
What is a written order issued by a judge that directs a law enforcement officer to search for a
particular piece of evidence at a particular location?
ANSWER
Search warrant
,Question 6.
What process can contribute to associating events that occurred on a computer with a particular
individual?
ANSWER
Time-frame analysis
Question 7.
What represents the space that exists between the end of the file and the end of the last cluster
used by that file?
ANSWER
Slack space
Question 8.
What term defines an event that threatens the security of a computer system or network in an
organization?
ANSWER
Incident
Question 9.
What term defines is defined as an empirically proven set of methods for performing a task in the
best and most efficient way?
ANSWER
Best practices
Question 10.
Which of the following refers to a bit-by-bit copy of the original storage medium?
ANSWER
Bit-stream copy
, Question 11.
A chain of custody document contains the following information about the obtained evidence:
ANSWER
Location where obtained
Question 12.
How should electronic devices gathered at a crime scene be treated?
ANSWER
as potential evidence
Question 13.
What is the term that measures of how perishable electronically stored data is?
ANSWER
Volatility
Question 14.
What procedure requires evidence to be marked using the format aaa/ddmmyy/nnnn/zz?
ANSWER
exhibit numbering
Question 15.
What should a first responder do immediately after arriving at a crime scene?
ANSWER
identify the scene
Question 16.
Which of the following is NOT a potential source for electronic evidence?
ANSWER
File cabinet
