DIGITAL FORENSICS IN CYBERSECURITY II
COMPREHENSIVE STUDY SHEET 2026
QUESTIONS WITH SOLUTIONS GRADED A+
◉ Physical damage. Answer: Damage to actual hard drive parts; for
example, a damaged platter or spindle.
◉ Physical imaging. Answer: Making a physical copy of a disk.
◉ Post Office Protocol version 3 (POP3). Answer: A protocol used to
receive email that works on port 110.
◉ Power-on self-test (POST). Answer: A brief hardware test the BIOS
performs upon boot-up.
◉ Probative value. Answer: The value of evidence in helping
determine the facts in a case.
◉ Protected computer. Answer: Any computer at a financial
institution of any kind or a government agency.
,◉ Rainbow table. Answer: Type of password crackers that work
with precalculated hashes off all passwords available within a
certain character space.
◉ Real evidence. Answer: Physical objects that can be touched, held,
or directly observed, such as a laptop with a suspect's fingerprints
on it or a handwritten note.
◉ Recover time objective (RTO). Answer: The time that the system is
expected to be back up. This must be less than MTD.
◉ Recovery point objective (RPO). Answer: The amount of work that
might need to be redone, or data lost.
◉ Routing table. Answer: A table used with routers to track what IP
addresses are connected to ports on the router.
◉ Rules of evidence. Answer: Rules that govern whether, when, how,
and why proof of a legal case can be placed before a judge or jury.
◉ Scrubber. Answer: Software that cleans unallocated space. Also
called a sweeper.
, ◉ Simple Mail Transfer Protocol (SMTP). Answer: A protocol used to
send email that works on port 25.
◉ Slack space. Answer: The unused space between the logical end of
file and the physical end of file. It is also called file slack.
◉ Slurred image. Answer: The result of acquiring a file as it is being
updated.
◉ Sniffer. Answer: Computer software or hardware that can
intercept and log traffic passing over a digital network.
◉ Social engineering. Answer: Nontechnical means of obtaining
information you would not normally have access to.
◉ Software forensics. Answer: The process of examining malicious
computer code.
◉ Spoofing. Answer: The act of making an email message appear to
come from someone or someplace other than the real sender or
location.
◉ Stack (S). Answer: Memory is allocated based on the last-in, first-
out (LIFO) principle.
COMPREHENSIVE STUDY SHEET 2026
QUESTIONS WITH SOLUTIONS GRADED A+
◉ Physical damage. Answer: Damage to actual hard drive parts; for
example, a damaged platter or spindle.
◉ Physical imaging. Answer: Making a physical copy of a disk.
◉ Post Office Protocol version 3 (POP3). Answer: A protocol used to
receive email that works on port 110.
◉ Power-on self-test (POST). Answer: A brief hardware test the BIOS
performs upon boot-up.
◉ Probative value. Answer: The value of evidence in helping
determine the facts in a case.
◉ Protected computer. Answer: Any computer at a financial
institution of any kind or a government agency.
,◉ Rainbow table. Answer: Type of password crackers that work
with precalculated hashes off all passwords available within a
certain character space.
◉ Real evidence. Answer: Physical objects that can be touched, held,
or directly observed, such as a laptop with a suspect's fingerprints
on it or a handwritten note.
◉ Recover time objective (RTO). Answer: The time that the system is
expected to be back up. This must be less than MTD.
◉ Recovery point objective (RPO). Answer: The amount of work that
might need to be redone, or data lost.
◉ Routing table. Answer: A table used with routers to track what IP
addresses are connected to ports on the router.
◉ Rules of evidence. Answer: Rules that govern whether, when, how,
and why proof of a legal case can be placed before a judge or jury.
◉ Scrubber. Answer: Software that cleans unallocated space. Also
called a sweeper.
, ◉ Simple Mail Transfer Protocol (SMTP). Answer: A protocol used to
send email that works on port 25.
◉ Slack space. Answer: The unused space between the logical end of
file and the physical end of file. It is also called file slack.
◉ Slurred image. Answer: The result of acquiring a file as it is being
updated.
◉ Sniffer. Answer: Computer software or hardware that can
intercept and log traffic passing over a digital network.
◉ Social engineering. Answer: Nontechnical means of obtaining
information you would not normally have access to.
◉ Software forensics. Answer: The process of examining malicious
computer code.
◉ Spoofing. Answer: The act of making an email message appear to
come from someone or someplace other than the real sender or
location.
◉ Stack (S). Answer: Memory is allocated based on the last-in, first-
out (LIFO) principle.
