WGU C840 OA DIGITAL FORENSICS
COMPLETE STUDY GUIDE WITH SOLVED
QUESTIONS
◉ A forensic examiner wants to try to extract passwords for wireless
networks to which a system was connected.
Where should passwords for wireless networks be stored on a
Windows XP system?
A Program Files
B BIOS
C Bash
D Registry.
Answer: D
◉ Which Windows password cracking tool uses rainbow tables?
A Sleuth Kit
B Ophcrack
C Digital Intelligence
,D ComputerCOP.
Answer: B
◉ How does a rainbow table work to crack a password?
A It starts with a hashed password and then decrypts each
individual character.
B It searches for passwords stored in RAM and startup files and then
matches them to the predefined table.
C It uses a table to store hash value for every character in the
alphabet, then assembles them to create a match.
D It uses a table of all possible keyboard combinations and their
hash values, then searches for a match..
Answer: D
◉ What should a forensic investigator use to gather the most
reliable routing information for tracking an email message?
A Tracert
B Netstat
C Email header
D Email address.
Answer: C
,◉ Which activity involves email tracing?
A Performing nslookup on the recipient of the message
B Determining the ownership of the source email server
C Removing email header information
D Making bit-by-bit copies of each of the email servers involved.
Answer: B
◉ A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives.
Which digital evidence should be reviewed?
A /var/vm
B /Users/<user>/Library/Preferences
C /var/log
D /Users/<user>/.bash_history.
Answer: C
, ◉ Which log or folder contains information about printed
documents on a computer running Mac OS X?
A /var/log/lpr.log
B /var/spool/cups
C /var/vm
D /var/log.
Answer: B
◉ Which Windows event log should be checked for evidence of
invalid logon attempts?
A Application
B Security
C ForwardedEvents
D System.
Answer: B
◉ A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh system
to ensure the system has been patched.
COMPLETE STUDY GUIDE WITH SOLVED
QUESTIONS
◉ A forensic examiner wants to try to extract passwords for wireless
networks to which a system was connected.
Where should passwords for wireless networks be stored on a
Windows XP system?
A Program Files
B BIOS
C Bash
D Registry.
Answer: D
◉ Which Windows password cracking tool uses rainbow tables?
A Sleuth Kit
B Ophcrack
C Digital Intelligence
,D ComputerCOP.
Answer: B
◉ How does a rainbow table work to crack a password?
A It starts with a hashed password and then decrypts each
individual character.
B It searches for passwords stored in RAM and startup files and then
matches them to the predefined table.
C It uses a table to store hash value for every character in the
alphabet, then assembles them to create a match.
D It uses a table of all possible keyboard combinations and their
hash values, then searches for a match..
Answer: D
◉ What should a forensic investigator use to gather the most
reliable routing information for tracking an email message?
A Tracert
B Netstat
C Email header
D Email address.
Answer: C
,◉ Which activity involves email tracing?
A Performing nslookup on the recipient of the message
B Determining the ownership of the source email server
C Removing email header information
D Making bit-by-bit copies of each of the email servers involved.
Answer: B
◉ A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives.
Which digital evidence should be reviewed?
A /var/vm
B /Users/<user>/Library/Preferences
C /var/log
D /Users/<user>/.bash_history.
Answer: C
, ◉ Which log or folder contains information about printed
documents on a computer running Mac OS X?
A /var/log/lpr.log
B /var/spool/cups
C /var/vm
D /var/log.
Answer: B
◉ Which Windows event log should be checked for evidence of
invalid logon attempts?
A Application
B Security
C ForwardedEvents
D System.
Answer: B
◉ A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh system
to ensure the system has been patched.
