CHFI TEST PREP QUESTIONS AND ANSWERS
Consistency in the investigative report is more important than the exact formula in the
report to eliminate uncertainty and confusion - Answers - TRUE
The Electronic Serial Number (ESN) is a unique ____ recorded on a secure chip in a
mobile phone by the manufacturer. - Answers - 32-bit Identifier
Event correlation is a procedure that is assigned with a new meaning for a set of events
that occur in a predefined interval of time. Which type of correlation will you use if your
organization wants to use different OS and network hardware platforms throughout the
network? - Answers - Cross-Platform Correlation
The Recycle Bin is located on the Windows desktop. When you delete an item from the
hard disk, Windows sends that deleted item in the Recycle Bin and the icon changes to
full from empty, but item deleted from the removable media, such as floppy disk or
network drive are stored in the Recycle Bin. What is the size limit of the Recycle Bin in
Vista and later version of Windows? - Answers - No Size limit
The need for computer forensics is highlighted by the an exponential increase in the
number of cybercrime and litigations where large organizations were involved.
Computer forensics plays an important role in tracking cyber criminals. The main role of
computer forensics is to? - Answers - Extract, process, and interpret the factual
evidence so that it proves the attacker's actions in the court
First responder is the person who arrives first at the crime scene and assesses the
victim's computer system after the incident. He or She is responsible for protecting,
integrating, and preserving the evidence obtained from the crime scene. What is the
role of the First Responder - Answers - 1. Identify and analyze the crime scene
2. Protect and secure the crime scene
3. Package and transport the electronic evidence to forensics lab
Smith, an employee of a reputed forensic investigation firm, has been hired by a private
organization to investigate a laptop that is suspected to be involved in the hacking of the
organization's DC server. Smith wants to find all of the values typed into the Run box in
the Start menu. Which of the following Registry Keys will Smith check to find the
information? - Answers - RunMRU Key
What is the represented document? - Answers - Chain of Custody Form
Which of the following commands shows you all of the network services running on
Windows-based servers? - Answers - Net start
Data compression involves encoding the data to take up less storage space and less
bandwidth for transmission. It helps in saving cost and high data manipulation in many
, business applications. Which data compression technique maintains data integrity? -
Answers - Lossless Compression
T or F: At the time of the seizing process, you need to shut down the computer
immediately. - Answers - False
T or F: Centralized logging is defined as gathering the computer system logs for a group
of systems in a centralized location. It is used to efficiently monitor computer system
logs with the frequency required to detect security violations and unusual activity. -
Answers - True
What approaches checks and compares all the fields systematically and intentionally for
positive and negative correlation with each other to determine the correlation across
one or multiple fields? - Answers - Automated Field Correlation Approach
What command shows you each NetBIOS name table? - Answers - nbtstat -n
What is a bit stream copy? - Answers - Bit-Stream Copy is a bit-by-bit copy of the
original storage medium and exact copy of the original disk
What are the disk imaging tool requirements? - Answers - 1. The tool should not change
the original content
2. The tool should log I/O errors in an accessible and readable format, including the
type and location of the error
3. The tool must have the ability to be held up to scientific and peer review
Tracks numbering on a hard disk begins at 0 from the outer edge and moves toward the
center typically reaching a value of what? - Answers - 1023
What is the goal of forensic science? - Answers - To determine the evidential value of
the crime scene and related evidence
Attackers can manipulate variables that reference files with "dot-dot-slash (../)"
sequences and the variations such as
http://www.juggyDoy.corn/GET/process.php./././././././././etc/passwd. What kind of attack
is this? - Answers - Directory Traversal
What is a Linux journaling file system? - Answers - Ext3
What log injection attack uses white space padding to create unusual log entries? -
Answers - Word wrap abuse attack
Subscriber Identity Module is a removable component the contains essential information
about the subscriber. Its main function entails authenticating the user of the cell phone
to the network to gain access to subscribed services. SIM contains a 20-digit Integrated
Consistency in the investigative report is more important than the exact formula in the
report to eliminate uncertainty and confusion - Answers - TRUE
The Electronic Serial Number (ESN) is a unique ____ recorded on a secure chip in a
mobile phone by the manufacturer. - Answers - 32-bit Identifier
Event correlation is a procedure that is assigned with a new meaning for a set of events
that occur in a predefined interval of time. Which type of correlation will you use if your
organization wants to use different OS and network hardware platforms throughout the
network? - Answers - Cross-Platform Correlation
The Recycle Bin is located on the Windows desktop. When you delete an item from the
hard disk, Windows sends that deleted item in the Recycle Bin and the icon changes to
full from empty, but item deleted from the removable media, such as floppy disk or
network drive are stored in the Recycle Bin. What is the size limit of the Recycle Bin in
Vista and later version of Windows? - Answers - No Size limit
The need for computer forensics is highlighted by the an exponential increase in the
number of cybercrime and litigations where large organizations were involved.
Computer forensics plays an important role in tracking cyber criminals. The main role of
computer forensics is to? - Answers - Extract, process, and interpret the factual
evidence so that it proves the attacker's actions in the court
First responder is the person who arrives first at the crime scene and assesses the
victim's computer system after the incident. He or She is responsible for protecting,
integrating, and preserving the evidence obtained from the crime scene. What is the
role of the First Responder - Answers - 1. Identify and analyze the crime scene
2. Protect and secure the crime scene
3. Package and transport the electronic evidence to forensics lab
Smith, an employee of a reputed forensic investigation firm, has been hired by a private
organization to investigate a laptop that is suspected to be involved in the hacking of the
organization's DC server. Smith wants to find all of the values typed into the Run box in
the Start menu. Which of the following Registry Keys will Smith check to find the
information? - Answers - RunMRU Key
What is the represented document? - Answers - Chain of Custody Form
Which of the following commands shows you all of the network services running on
Windows-based servers? - Answers - Net start
Data compression involves encoding the data to take up less storage space and less
bandwidth for transmission. It helps in saving cost and high data manipulation in many
, business applications. Which data compression technique maintains data integrity? -
Answers - Lossless Compression
T or F: At the time of the seizing process, you need to shut down the computer
immediately. - Answers - False
T or F: Centralized logging is defined as gathering the computer system logs for a group
of systems in a centralized location. It is used to efficiently monitor computer system
logs with the frequency required to detect security violations and unusual activity. -
Answers - True
What approaches checks and compares all the fields systematically and intentionally for
positive and negative correlation with each other to determine the correlation across
one or multiple fields? - Answers - Automated Field Correlation Approach
What command shows you each NetBIOS name table? - Answers - nbtstat -n
What is a bit stream copy? - Answers - Bit-Stream Copy is a bit-by-bit copy of the
original storage medium and exact copy of the original disk
What are the disk imaging tool requirements? - Answers - 1. The tool should not change
the original content
2. The tool should log I/O errors in an accessible and readable format, including the
type and location of the error
3. The tool must have the ability to be held up to scientific and peer review
Tracks numbering on a hard disk begins at 0 from the outer edge and moves toward the
center typically reaching a value of what? - Answers - 1023
What is the goal of forensic science? - Answers - To determine the evidential value of
the crime scene and related evidence
Attackers can manipulate variables that reference files with "dot-dot-slash (../)"
sequences and the variations such as
http://www.juggyDoy.corn/GET/process.php./././././././././etc/passwd. What kind of attack
is this? - Answers - Directory Traversal
What is a Linux journaling file system? - Answers - Ext3
What log injection attack uses white space padding to create unusual log entries? -
Answers - Word wrap abuse attack
Subscriber Identity Module is a removable component the contains essential information
about the subscriber. Its main function entails authenticating the user of the cell phone
to the network to gain access to subscribed services. SIM contains a 20-digit Integrated
