2024 WGU - C702 FORENSICS AND
NETWORK INTRUSION EXAM WITH
CORRECT ANSWERS
Aspects of Organizational Security - CORRECT-ANSWERSIT Security;
Physical Security;
Financial Security;
Legal Security;
IT Security - CORRECT-ANSWERSConsists of:
Application security;
Computing security:
Data security:
Information security;
Network security;
Wireless Standards: - CORRECT-ANSWERS802.11a: 5 GHz and up to 54 Mbits
per second;
802.11g: 2.4 GHz and up to 54 Mbits per second;
802.11b: 2.4 GHz and up to 11 Mbits per second;
802.11n: 2. GHz and up to Mbits per second;
Wireless Active Scan: - CORRECT-ANSWERSThe client radio transmits or
broadcasts a probe request and listens for a probe response from an Access
Point
Wireless Passive Scan: - CORRECT-ANSWERSThe client radio listens on each
channel for beacons sent periodically by an Access Point. A passive scan
generally takes more time, since the client must listen and wait for a beacon
WPA2: - CORRECT-ANSWERSIs more secured then WPA and uses AES-CCMP
encryption algorithm
WPA: - CORRECT-ANSWERSWi-Fi Protected Access [WPA] is a security
standard for users of computers equipped with Wi-Fi wireless connection. It
changes its TKIP [Temporal Key Integrity Protocol] keys every 10,000 packets
MAC Filtering: - CORRECT-ANSWERSIn computer networking, MAC Filtering
[or GUI filtering, or layer 2 address filtering] refers to a security access
,control method whereby the 48-bit address assigned to each network card is
used to determine access to the network
Client mis-association: - CORRECT-ANSWERSClient Mis-association can be
accidental, deliberate [for example, done to bypass corporate firewall] or it
can result from deliberate attempts on wireless clients to lure them into
connecting to attacker's Access Point
Steganography Techniques - CORRECT-ANSWERSCover Generation
Technique;
Substitution Technique;
Transform Domain Technique;
Spread Spectrum Technique;
Cover Generation Technique: - CORRECT-ANSWERSA cover generation
method actually creates a cover for the sole purpose of hiding information
Substitution Technique: - CORRECT-ANSWERSReplaces redundant or
unneeded bits of a cover with the bits from the secret message
Transform Domain Technique: - CORRECT-ANSWERSHides the message data
in the transform space of a signal. Can be commonly used in JPEG's photos
Spread Spectrum Technique: - CORRECT-ANSWERSThere are two types of
spread spectrum techniques, direct sequence and frequency hopping.
direct sequence [Spread Spectrum Technique] - CORRECT-ANSWERSthe
stream information to be transmitted is divided in small pieces, each of
which is allocated to a frequency channel spread across the spectrum.
Frequency hopping [Spread Spectrum Technique] - CORRECT-ANSWERSis
when a broad slice of the bandwidth spectrum is divided into many possible
broadcast frequencies
ASCLD [American Society of Crime Laboratory Directors]: - CORRECT-
ANSWERSTo promote the effectiveness of crime laboratory leaders
throughout the world by facilitating communication among members,
sharing critical information, providing relevant training, promoting crime
laboratory accreditation/certification, and encouraging scientific and
managerial excellence in the global forensic community
Chain of Custody: - CORRECT-ANSWERSChain of custody [CoC], in legal
contexts, refers to the chronological documentation or paper trail, showing
the seizure, custody, control, transfer between sender and receiver, analysis,
and disposition of physical or electronic evidence
, Daubert Standard: - CORRECT-ANSWERSThe Daubert standard provides a
rule of evidence regarding the admissibility of expert witnesses' testimony
during United States federal legal proceedings
Frye Standard: - CORRECT-ANSWERSFrye standard, Frye test, or general
acceptance test is used to determine the admissibility of scientific evidence
and examinations. It provides that expert opinion based on a scientific
technique is admissible only where the technique is generally accepted as
reliable in the relevant scientific community
Task List Commands: - CORRECT-ANSWERStasklist /u;
tasklist /p;
tasklist /s;
tasklist /v;
tasklist /u: - CORRECT-ANSWERSRuns the command with the account
permissions of the user specified by User or Domain\User. The default is the
permissions of the current logged on user on the computer issuing the
command;
tasklist /p: - CORRECT-ANSWERSSpecifies the password of the user account
that is specified in the /u parameter.
tasklist /s: - CORRECT-ANSWERSSpecifies the name or IP address of a remote
computer. The default is the local computer.
tasklist /v: - CORRECT-ANSWERSSpecifies that verbose task information be
displayed in the output. Also list all process id's for application and services
Syslog: - CORRECT-ANSWERSA protocol for transmitting event messages and
alerts across an IP network that uses TCP to communicate and log messages
are sent in clear text
Host-Based intrusion detection: - CORRECT-ANSWERSHost based intrusion
detection [HIDS] refers to intrusion detection that takes place on a single
host system
Network-Based intrusion detection: - CORRECT-ANSWERSA network-based ID
system monitors the traffic on its network segment as a data source
Router Cache: - CORRECT-ANSWERSThe database of addresses and
forwarding information of network traffic stored in a router. It can also
provide information about attacks
NETWORK INTRUSION EXAM WITH
CORRECT ANSWERS
Aspects of Organizational Security - CORRECT-ANSWERSIT Security;
Physical Security;
Financial Security;
Legal Security;
IT Security - CORRECT-ANSWERSConsists of:
Application security;
Computing security:
Data security:
Information security;
Network security;
Wireless Standards: - CORRECT-ANSWERS802.11a: 5 GHz and up to 54 Mbits
per second;
802.11g: 2.4 GHz and up to 54 Mbits per second;
802.11b: 2.4 GHz and up to 11 Mbits per second;
802.11n: 2. GHz and up to Mbits per second;
Wireless Active Scan: - CORRECT-ANSWERSThe client radio transmits or
broadcasts a probe request and listens for a probe response from an Access
Point
Wireless Passive Scan: - CORRECT-ANSWERSThe client radio listens on each
channel for beacons sent periodically by an Access Point. A passive scan
generally takes more time, since the client must listen and wait for a beacon
WPA2: - CORRECT-ANSWERSIs more secured then WPA and uses AES-CCMP
encryption algorithm
WPA: - CORRECT-ANSWERSWi-Fi Protected Access [WPA] is a security
standard for users of computers equipped with Wi-Fi wireless connection. It
changes its TKIP [Temporal Key Integrity Protocol] keys every 10,000 packets
MAC Filtering: - CORRECT-ANSWERSIn computer networking, MAC Filtering
[or GUI filtering, or layer 2 address filtering] refers to a security access
,control method whereby the 48-bit address assigned to each network card is
used to determine access to the network
Client mis-association: - CORRECT-ANSWERSClient Mis-association can be
accidental, deliberate [for example, done to bypass corporate firewall] or it
can result from deliberate attempts on wireless clients to lure them into
connecting to attacker's Access Point
Steganography Techniques - CORRECT-ANSWERSCover Generation
Technique;
Substitution Technique;
Transform Domain Technique;
Spread Spectrum Technique;
Cover Generation Technique: - CORRECT-ANSWERSA cover generation
method actually creates a cover for the sole purpose of hiding information
Substitution Technique: - CORRECT-ANSWERSReplaces redundant or
unneeded bits of a cover with the bits from the secret message
Transform Domain Technique: - CORRECT-ANSWERSHides the message data
in the transform space of a signal. Can be commonly used in JPEG's photos
Spread Spectrum Technique: - CORRECT-ANSWERSThere are two types of
spread spectrum techniques, direct sequence and frequency hopping.
direct sequence [Spread Spectrum Technique] - CORRECT-ANSWERSthe
stream information to be transmitted is divided in small pieces, each of
which is allocated to a frequency channel spread across the spectrum.
Frequency hopping [Spread Spectrum Technique] - CORRECT-ANSWERSis
when a broad slice of the bandwidth spectrum is divided into many possible
broadcast frequencies
ASCLD [American Society of Crime Laboratory Directors]: - CORRECT-
ANSWERSTo promote the effectiveness of crime laboratory leaders
throughout the world by facilitating communication among members,
sharing critical information, providing relevant training, promoting crime
laboratory accreditation/certification, and encouraging scientific and
managerial excellence in the global forensic community
Chain of Custody: - CORRECT-ANSWERSChain of custody [CoC], in legal
contexts, refers to the chronological documentation or paper trail, showing
the seizure, custody, control, transfer between sender and receiver, analysis,
and disposition of physical or electronic evidence
, Daubert Standard: - CORRECT-ANSWERSThe Daubert standard provides a
rule of evidence regarding the admissibility of expert witnesses' testimony
during United States federal legal proceedings
Frye Standard: - CORRECT-ANSWERSFrye standard, Frye test, or general
acceptance test is used to determine the admissibility of scientific evidence
and examinations. It provides that expert opinion based on a scientific
technique is admissible only where the technique is generally accepted as
reliable in the relevant scientific community
Task List Commands: - CORRECT-ANSWERStasklist /u;
tasklist /p;
tasklist /s;
tasklist /v;
tasklist /u: - CORRECT-ANSWERSRuns the command with the account
permissions of the user specified by User or Domain\User. The default is the
permissions of the current logged on user on the computer issuing the
command;
tasklist /p: - CORRECT-ANSWERSSpecifies the password of the user account
that is specified in the /u parameter.
tasklist /s: - CORRECT-ANSWERSSpecifies the name or IP address of a remote
computer. The default is the local computer.
tasklist /v: - CORRECT-ANSWERSSpecifies that verbose task information be
displayed in the output. Also list all process id's for application and services
Syslog: - CORRECT-ANSWERSA protocol for transmitting event messages and
alerts across an IP network that uses TCP to communicate and log messages
are sent in clear text
Host-Based intrusion detection: - CORRECT-ANSWERSHost based intrusion
detection [HIDS] refers to intrusion detection that takes place on a single
host system
Network-Based intrusion detection: - CORRECT-ANSWERSA network-based ID
system monitors the traffic on its network segment as a data source
Router Cache: - CORRECT-ANSWERSThe database of addresses and
forwarding information of network traffic stored in a router. It can also
provide information about attacks
