CNIT 420 - Exam 2 Questions With Correct Answers.

CNIT 420 - Exam 2 Questions With Correct
Answers

How |to |identify |unknown |file |formats |- |CORRECT |ANSWER✔✔-Looking |at |the |unique |header |
value



Explain |copyright |issues |with |graphics |- |CORRECT |ANSWER✔✔-Copyright |laws |for |Internet |are |
not |clear, |no |international |copyright |law/ |each |country |has |their |own



False |hits |are |also |known |as |___ |- |CORRECT |ANSWER✔✔-false |positives



(T/F) |Some |viewer |programs |can |read |every |file |format |- |CORRECT |ANSWER✔✔-F



Two |major |forms |of |steganography |- |CORRECT |ANSWER✔✔-insertion |and |substitution



Hidden |data |is |not |displayed |when |viewing |host |file |in |its |associated |program |- |CORRECT |
ANSWER✔✔-insertion



replacing |bits |of |the |host |file |with |other |bits |of |data |(usually |change |the |last |two |LSBs) |- |
CORRECT |ANSWER✔✔-substitution



Clues |to |look |for |when |inspecting |evidence |of |steganography |- |CORRECT |ANSWER✔✔-
Duplicate |files |w/ |different |hash |values, |steganography |programs |installed |on |suspect's |drive



(T/F) |When |applied |correctly, |you |cannot |detect |hidden |data |in |most |cases |- |CORRECT |
ANSWER✔✔-T

, (T/F) |Steg |cannot |be |applied |to |audio |and |video |files |- |CORRECT |ANSWER✔✔-F



Steg |has |been |used |to |protect |copyrighted |material |by |inserting |_____ |into |a |file |- |CORRECT |
ANSWER✔✔-digital |watermarks



When |an |investigation |expands |beyond |the |original |description |- |CORRECT |ANSWER✔✔-Scope
|creep




Advanced |hex |editors |offer |features |not |available |in |digital |forensics |tools, |such |as: |- |CORRECT |
ANSWER✔✔-Hashing |specific |files |or |sectors



WinHex |and |HxD |provides |_____ |hashing |algorithms |- |CORRECT |ANSWER✔✔-MD5 |and |SHA-1



A |process |that |builds |a |data |set |of |hashes |of |sectors |from |the |original |file |- |CORRECT |
ANSWER✔✔-Block-wise |hashin



Program |that |filters |files |from |view |and |contains |hash |values |of |known |illegal |files |- |CORRECT |
ANSWER✔✔-Known |File |Filter |(KFF)



Changing |or |manipulating |a |file |to |conceal |information |- |CORRECT |ANSWER✔✔-Data |hiding



One |of |the |first |techniques |to |hide |data |- |CORRECT |ANSWER✔✔-Changing |file |extensions



How |to |make |OS |consider |a |cluster |unusable |in |FAT |- |CORRECT |ANSWER✔✔-Marking |good |
clusters |as |bad |clusters |in |the |FAT |table



Changes |data |from |readable |code |to |data |that |looks |like |binary |executable |code |- |CORRECT |
ANSWER✔✔-Bit |shifting