WGU C702 FORENSICS AND NETWORK INTRUSION
ACTUAL FINAL PAPER QUESTIONS AND ANSWERS RATED
A+
✔✔Chain of Custody: - ✔✔A method for documenting the history and possession of a
sample from the time of collection, though analysis and data reporting, to its final
disposition
✔✔Bit Stream copy: - ✔✔A bit by bit copy of the original storage medium and or
evidence
✔✔Ext3: - ✔✔Ext3 or third extended file system, is a journaled file system that is
commonly used by the Linux kernel. It is the default file system for many popular Linux
distributions
✔✔Logical block addressing [LBA]: - ✔✔used for specifying the location of blocks of
data stored on computer storage devices such as hard disks. LBA is a particularly
simple linear addressing scheme, blocks are located by an integer index, with the first
block being LBA 0, the second LBA 1, and so on in a sequential matter
✔✔Cluster: - ✔✔Is the smallest logical unit on a hard drive
✔✔Lost Cluster: - ✔✔The operating system assigns a unique number to each cluster
and then keeps track of files according to which clusters they use. Occasionally, the
operating system marks a cluster as being used even though it is not assigned to any
file. This is called a lost cluster
✔✔Bad Cluster: - ✔✔Is a sector on a computer's disk drive or flash memory that is
either inacessible or unwriteable due to permanent damage, such as physical damage
to the disk surface or failed flash memory transistors
✔✔Event Logs: - ✔✔Windows event log is a record of a computer's alerts and
notifications. Microsoft defines an event as "any significant occurrence in the OS or in a
program that requires users to be notified or an entry added to a log."
✔✔Tracking user logon activity via Audit Event ID's: - ✔✔512 Start-up
513 Shutdown
528 Logon
531 Disabled Account
538 Logoff
✔✔Audit Policy Event ID's: - ✔✔Event ID 4904: An attempt was made to register a
security event source.
Event ID 4902: The Per-user audit policy table was created.
, ✔✔E-mail Protocols - ✔✔POP3: Port 110;
SMTP: Port 25;
IMAP: Port 143
✔✔POP3: - ✔✔A protocol for receiving e-mail by downloading it to your computer from
a mailbox on the server of an Internet service provider
✔✔SMTP: - ✔✔A protocol for sending e-mail messages between servers over the
Internet use. The messages can then be retrieved with an e-mail client using either
POP3 or IMAP. SMTP is also generally used to send messages from a mail client to a
mail server.
✔✔Net Commands - ✔✔Net Config;
Net file;
Net Use;
Net View;
Net Name;
Net start;
Net sessions;
✔✔Net Config: - ✔✔Use the net config command to show information about the
configuration of the Server or Workstation service
✔✔Net File: - ✔✔Displays the names of all open shared files on a server and the
number of file locks, if any, on each file
✔✔Net Use: - ✔✔The net use command is used to display information about shared
resources on the network that you're currently connected to, as well as open sessions
on other systems
✔✔Net View: - ✔✔Net view is used to show a list of computers and network devices on
the network
✔✔Net Name: - ✔✔Net name is used to add or delete a messaging alias at a computer
✔✔Net Start: - ✔✔The net start command is used to start a network service or list
running network services
✔✔Net Sessions: - ✔✔The net session command is used to list or disconnect sessions
between the computer and others on the network
✔✔Slack Space: - ✔✔The unused space in a disk cluster. The DOS and Windows file
systems use fixed-size clusters. Even if the actual data being stored requires less
ACTUAL FINAL PAPER QUESTIONS AND ANSWERS RATED
A+
✔✔Chain of Custody: - ✔✔A method for documenting the history and possession of a
sample from the time of collection, though analysis and data reporting, to its final
disposition
✔✔Bit Stream copy: - ✔✔A bit by bit copy of the original storage medium and or
evidence
✔✔Ext3: - ✔✔Ext3 or third extended file system, is a journaled file system that is
commonly used by the Linux kernel. It is the default file system for many popular Linux
distributions
✔✔Logical block addressing [LBA]: - ✔✔used for specifying the location of blocks of
data stored on computer storage devices such as hard disks. LBA is a particularly
simple linear addressing scheme, blocks are located by an integer index, with the first
block being LBA 0, the second LBA 1, and so on in a sequential matter
✔✔Cluster: - ✔✔Is the smallest logical unit on a hard drive
✔✔Lost Cluster: - ✔✔The operating system assigns a unique number to each cluster
and then keeps track of files according to which clusters they use. Occasionally, the
operating system marks a cluster as being used even though it is not assigned to any
file. This is called a lost cluster
✔✔Bad Cluster: - ✔✔Is a sector on a computer's disk drive or flash memory that is
either inacessible or unwriteable due to permanent damage, such as physical damage
to the disk surface or failed flash memory transistors
✔✔Event Logs: - ✔✔Windows event log is a record of a computer's alerts and
notifications. Microsoft defines an event as "any significant occurrence in the OS or in a
program that requires users to be notified or an entry added to a log."
✔✔Tracking user logon activity via Audit Event ID's: - ✔✔512 Start-up
513 Shutdown
528 Logon
531 Disabled Account
538 Logoff
✔✔Audit Policy Event ID's: - ✔✔Event ID 4904: An attempt was made to register a
security event source.
Event ID 4902: The Per-user audit policy table was created.
, ✔✔E-mail Protocols - ✔✔POP3: Port 110;
SMTP: Port 25;
IMAP: Port 143
✔✔POP3: - ✔✔A protocol for receiving e-mail by downloading it to your computer from
a mailbox on the server of an Internet service provider
✔✔SMTP: - ✔✔A protocol for sending e-mail messages between servers over the
Internet use. The messages can then be retrieved with an e-mail client using either
POP3 or IMAP. SMTP is also generally used to send messages from a mail client to a
mail server.
✔✔Net Commands - ✔✔Net Config;
Net file;
Net Use;
Net View;
Net Name;
Net start;
Net sessions;
✔✔Net Config: - ✔✔Use the net config command to show information about the
configuration of the Server or Workstation service
✔✔Net File: - ✔✔Displays the names of all open shared files on a server and the
number of file locks, if any, on each file
✔✔Net Use: - ✔✔The net use command is used to display information about shared
resources on the network that you're currently connected to, as well as open sessions
on other systems
✔✔Net View: - ✔✔Net view is used to show a list of computers and network devices on
the network
✔✔Net Name: - ✔✔Net name is used to add or delete a messaging alias at a computer
✔✔Net Start: - ✔✔The net start command is used to start a network service or list
running network services
✔✔Net Sessions: - ✔✔The net session command is used to list or disconnect sessions
between the computer and others on the network
✔✔Slack Space: - ✔✔The unused space in a disk cluster. The DOS and Windows file
systems use fixed-size clusters. Even if the actual data being stored requires less
