D431 Digital Forensics Questions And
Answers Latest Top Score
Which law requires both parties to consent to the recording of a conversation? - correct
answer. ECPA (Electronic Communications Privacy Act)
Which law is related to the disclosure of personally identifiable protected health
information (PHI)? - correct answer. Health Insurance Portability and Accountability
Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a misleading domain name with
the intent to deceive a minor into viewing harmful material? - correct answer. 18
U.S.C. 2252B
Which U.S. law protects journalists from turning over their work or sources to law
enforcement before the information is shared with the public? - correct answer. The
Privacy Protection Act (PPA)
Which law or guideline lists the four states a mobile device can be in when data is
extracted from it? - correct answer. NIST SP 800-72 Guidelines
Which law includes a provision permitting the wiretapping of VoIP calls? - correct
answer. Communications Assistance to Law Enforcement Act (CALEA)
Which policy is included in the CAN-SPAM Act? - correct answer. The email sender
must provide some mechanism whereby the receiver can opt out of future emails and
that method cannot require the receiver to pay in order to opt out.
Which United States law requires telecommunications equipment manufacturers to
provide built-in surveillance capabilities for federal agencies? - correct answer.
Communication Assistance to Law Enforcement Act (CALEA)
Which law requires a search warrant or one of the recognized exceptions to the search
warrant requirements for searching email messages on a computer? - correct answer.
The Fourth Amendment to the U.S. Constitution
, Where are local passwords stored for the Windows operating system? - correct answer.
SAM file in \Windows\System32\
Where on a Windows system is the config folder located that contains the SAM file? -
correct answer. C:\Windows\System32
A forensic examiner wants to try to extract passwords for wireless networks to which a
system was connected. Where should passwords for wireless networks be stored on a
Windows XP system? - correct answer. Registry
Which Windows password cracking tool uses rainbow tables? - correct answer.
Ophcrack
How does a rainbow table work to crack a password? - correct answer. It uses a table
of all possible keyboard combinations and their hash values, then searches for a match.
What should a forensic investigator use to gather the most reliable routing information
for tracking an email message? - correct answer. Email header
Which activity involves email tracing? - correct answer. Determining the ownership of
the source email server
A forensic examiner reviews a laptop running OS X which has been compromised. The
examiner wants to know if there were any mounted volumes created from USB drives.
Which digital evidence should be reviewed? - correct answer. /var/log
Which log or folder contains information about printed documents on a computer
running Mac OS X? - correct answer. /var/spool/cups
Which Windows event log should be checked for evidence of invalid logon attempts? -
correct answer. Security
A cyber security organization has issued a warning about a cybercriminal who is using a
known vulnerability to attack unpatched corporate Macintosh systems. A network
administrator decides to examine the software updates logs on a Macintosh system to
ensure the system has been patched. Which folder contains the software updates logs?
- correct answer. /Library/Receipts
A forensic investigator wants to image an older BlackBerry smartphone running OS 7.0.
Which tool should the investigator use? - correct answer. BlackBerry Desktop
Manager
An investigator wants to extract information from a mobile device by connecting it to a
computer. What should the investigator take great care to ensure? - correct answer.
That the mobile device does not synchronize with the computer
Answers Latest Top Score
Which law requires both parties to consent to the recording of a conversation? - correct
answer. ECPA (Electronic Communications Privacy Act)
Which law is related to the disclosure of personally identifiable protected health
information (PHI)? - correct answer. Health Insurance Portability and Accountability
Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a misleading domain name with
the intent to deceive a minor into viewing harmful material? - correct answer. 18
U.S.C. 2252B
Which U.S. law protects journalists from turning over their work or sources to law
enforcement before the information is shared with the public? - correct answer. The
Privacy Protection Act (PPA)
Which law or guideline lists the four states a mobile device can be in when data is
extracted from it? - correct answer. NIST SP 800-72 Guidelines
Which law includes a provision permitting the wiretapping of VoIP calls? - correct
answer. Communications Assistance to Law Enforcement Act (CALEA)
Which policy is included in the CAN-SPAM Act? - correct answer. The email sender
must provide some mechanism whereby the receiver can opt out of future emails and
that method cannot require the receiver to pay in order to opt out.
Which United States law requires telecommunications equipment manufacturers to
provide built-in surveillance capabilities for federal agencies? - correct answer.
Communication Assistance to Law Enforcement Act (CALEA)
Which law requires a search warrant or one of the recognized exceptions to the search
warrant requirements for searching email messages on a computer? - correct answer.
The Fourth Amendment to the U.S. Constitution
, Where are local passwords stored for the Windows operating system? - correct answer.
SAM file in \Windows\System32\
Where on a Windows system is the config folder located that contains the SAM file? -
correct answer. C:\Windows\System32
A forensic examiner wants to try to extract passwords for wireless networks to which a
system was connected. Where should passwords for wireless networks be stored on a
Windows XP system? - correct answer. Registry
Which Windows password cracking tool uses rainbow tables? - correct answer.
Ophcrack
How does a rainbow table work to crack a password? - correct answer. It uses a table
of all possible keyboard combinations and their hash values, then searches for a match.
What should a forensic investigator use to gather the most reliable routing information
for tracking an email message? - correct answer. Email header
Which activity involves email tracing? - correct answer. Determining the ownership of
the source email server
A forensic examiner reviews a laptop running OS X which has been compromised. The
examiner wants to know if there were any mounted volumes created from USB drives.
Which digital evidence should be reviewed? - correct answer. /var/log
Which log or folder contains information about printed documents on a computer
running Mac OS X? - correct answer. /var/spool/cups
Which Windows event log should be checked for evidence of invalid logon attempts? -
correct answer. Security
A cyber security organization has issued a warning about a cybercriminal who is using a
known vulnerability to attack unpatched corporate Macintosh systems. A network
administrator decides to examine the software updates logs on a Macintosh system to
ensure the system has been patched. Which folder contains the software updates logs?
- correct answer. /Library/Receipts
A forensic investigator wants to image an older BlackBerry smartphone running OS 7.0.
Which tool should the investigator use? - correct answer. BlackBerry Desktop
Manager
An investigator wants to extract information from a mobile device by connecting it to a
computer. What should the investigator take great care to ensure? - correct answer.
That the mobile device does not synchronize with the computer
