CHFI

A. #*06*# B. *#06# C. #06r D. *1MEI# - b Who is responsible for the following tasks? - Secure the scene and ensure that it is maintained In a secure state until the Forensic Team advises - Make notes about the scene that will eventually be handed over to the Forensic Team A. Non-Laboratory Staff B. System administrators C. Local managers or other non-forensic staff D. Lawyers - a A system with a simple logging mechanism has not been given much attention during development, this system is now being targeted by attackers, if the attacker wants to perform a new line injection attack, what will he/she inject into the log file? A. Plaintext B. Single pipe character C. Multiple pipe characters D. HTML tags - a During the seizure of digital evidence, the suspect can be allowed touch the computer system A. True B. False - b Which of the following password cracking techniques works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password? A. Brute forcing attack B. Hybrid attack C. Syllable attack D. Rule-based attack - b Consistency in the investigative report is more important than the exact format in the report to eliminate uncertainty and confusion A. True B. False - a When dealing with the powered-off computers at the crime scene, if the computer is switched off, turn it on A. True B. False - b MAC filtering is a security access control methodology, where a ___________ is assigned to each network card to determine access to the network A. 16-bit address B. 24-bit address C. 32-bit address D. 48-bit address - d You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as R or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor? A. HKEY_USERS B. HKEY_LOCAL_ADMIN C. HKEY_CLASSES_ADMIN D. HKEY_CLASSES_SYSTEM - a You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at which sessions the machine has opened with other systems? A. Net sessions B. Net use C. Net config D. Net share - b What is a SCSI (Small Computer System Interface)? A. A set of ANSI standard electronic interfaces that allow personal computers to communicate with peripheral hardware such as disk drives, tape drives. CD-ROM drives, printers, and scanners B. A standard electronic interface used between a computer motherboard's data paths or bus and the computer's disk storage devices C. A "plug-and-play" interface, which allows a device to be added without an adapter card and without rebooting the computer D. A point-to-point serial bi-directional interface for transmitting data between computer devices at data rates of up to 4 Gbps - a The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used. Which command displays the network configuration of the NICs on the system? A. ipconfig /all B. netstat C. net session D. tasklist - a Which Is a Linux journaling file system? A. Ext3 B. HFS C. FAT D. BFS - a Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader? A. Open code steganography B. Visual semagrams steganography C. Text semagrams steganography D. Technical steganography - a Web applications provide an Interface between end users and web servers through a set of web pages that are generated at the server-end or contain script code to be executed dynamically within the client Web browser. A. True B. False - a Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP. Which of the following attack Jason can infer from his findings? A. DNS Poisoning B. Cookie Poisoning Attack C. DNS Redirection D. Session poisoning - a Which table is used to convert huge word lists (i .e. dictionary files and brute-force lists) into password hashes? A. Rainbow tables B. Hash tables C. Master file tables D. Database tables - a Data acquisition system is a combination of tools or processes used to gather, analyze and record Information about some phenomenon. Different data acquisition system are used depends on the location, speed, cost. etc. Serial communication data acquisition system is used when the actual location of the data is at some distance from the computer. Which of the following communication standard is used in serial communication data acquisition system? A. RS422 B. RS423 C. RS232 D. RS231 - c Which of the following statements is incorrect when preserving digital evidence? A. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals B. Verily if the monitor is in on, off, or in sleep mode C. Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode D. Turn on the computer and extract Windows event viewer log files - d Which of the following would you consider an aspect of organizational security, especially focusing on IT security? A. Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals B. Verily if the monitor is in on, off, or in sleep mode C. Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode D. Turn on the computer and extract Windows event viewer log files - c Which of the following approaches checks and compares all the fields systematically and intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields? A. Graph-based approach B. Neural network-based approach C. Rule-based approach D. Automated field correlation approach - d Log management includes all the processes and techniques used to collect, aggregate, and analyze computer-generated log messages. It consists of the hardware, software, network and media used to generate, transmit, store, analyze, and dispose of log data A. True B. False - a Data files from original evidence should be used for forensics analysis A. True B. False - b Attackers can manipulate variables that reference files with "dot-dot-slash (./)" sequences and their variations such as D Identify the attack referred