C702 exam with correct answers
Which |documentation |should |a |forensic |examiner |prepare |prior |to |a |dynamic |analysis? |- |
ANSWERS✔✔ |The |full |path |and |location |of |the |file |being |investigated
What |allows |for |a |lawful |search |to |be |conducted |without |a |warrant |or |probable |cause? |- |
ANSWERS✔✔ |Consent |of |person |with |authority
A |forensic |investigator |is |tasked |with |retrieving |evidence |where |the |primary |server |has |been |
erased. |The |investigator |needs |to |rely |on |network |logs |and |backup |tapes |to |base |their |
conclusions |on |while |testifying |in |court. |Which |information |found |in |rules |of |evidence, |Rule |
1001, |helps |determine |if |this |testimony |is |acceptable |to |the |court? |- |ANSWERS✔✔ |Definition
|of |original |evidence
When |can |a |forensic |investigator |collect |evidence |without |formal |consent? |- |ANSWERS✔✔ |
When |properly |worded |banners |are |displayed |on |the |computer |screen
Who |determines |whether |a |forensic |investigation |should |take |place |if |a |situation |is |
undocumented |in |the |standard |operating |procedures? |- |ANSWERS✔✔ |Decision |maker
Which |situation |leads |to |a |civil |investigation? |- |ANSWERS✔✔ |Disputes |between |two |parties |
that |relate |to |a |contract |violation
Which |rule |does |a |forensic |investigator |need |to |follow? |- |ANSWERS✔✔ |Use |well-known |
standard |procedures
What |is |the |focus |of |Locard's |exchange |principle? |- |ANSWERS✔✔ |Anyone |entering |a |crime |
scene |takes |something |with |them |and |leaves |something |behind.
, What |is |the |focus |of |the |enterprise |theory |of |investigation |(ETI)? |- |ANSWERS✔✔ |Solving |one
|crime |can |tie |it |back |to |a |criminal |organization's |activities.
A |forensic |investigator |is |searching |a |Windows |XP |computer |image |for |information |about |a |
deleted |Word |document. |The |investigator |already |viewed |the |sixth |file |that |was |deleted |from |
the |computer. |Two |additional |files |were |deleted. |What |is |the |name |of |the |last |file |the |
investigator |opens? |- |ANSWERS✔✔ |$R7.doc
What |is |a |benefit |of |a |web |application |firewall |(WAF)? |- |ANSWERS✔✔ |Acts |as |a |reverse |
proxy |to |inspect |all |HTTP |traffic
How |does |a |hacker |bypass |a |web |application |firewall |(WAF) |with |the |toggle |case |technique? |-
|ANSWERS✔✔ |By |randomly |capitalizing |some |of |the |characters
During |a |recent |scan |of |a |network, |a |network |administrator |sent |ICMP |echo |8 |packets |to |each
|IP |address |being |used |in |the |network. |The |ICMP |echo |8 |packets |contained |an |invalid |media |
access |control |(MAC) |address. |Logs |showed |that |one |device |replied |with |ICMP |echo |0 |
packets. |What |does |the |reply |from |the |single |device |indicate? |- |ANSWERS✔✔ |The |machine |
is |in |promiscuous |mode.
What |is |the |goal |for |an |attacker |using |a |directory |traversal |attack? |- |ANSWERS✔✔ |To |access |
areas |in |the |system |in |which |the |attacker |should |not |have |access
A |forensic |investigator |is |performing |malware |analysis |on |a |Windows |computer. |The |
investigator |believes |malware |has |replaced |the |legitimate |drivers |with |fake |versions. |What |
should |the |investigator |look |at |to |confirm |these |suspicions? |- |ANSWERS✔✔ |The |digital |
signatures |on |the |drivers
Where |should |an |investigator |look |in |the |registry |to |find |artifacts |if |there |is |malware |on |a |
Windows |system? |- |ANSWERS✔✔ |HKLM\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
Which |documentation |should |a |forensic |examiner |prepare |prior |to |a |dynamic |analysis? |- |
ANSWERS✔✔ |The |full |path |and |location |of |the |file |being |investigated
What |allows |for |a |lawful |search |to |be |conducted |without |a |warrant |or |probable |cause? |- |
ANSWERS✔✔ |Consent |of |person |with |authority
A |forensic |investigator |is |tasked |with |retrieving |evidence |where |the |primary |server |has |been |
erased. |The |investigator |needs |to |rely |on |network |logs |and |backup |tapes |to |base |their |
conclusions |on |while |testifying |in |court. |Which |information |found |in |rules |of |evidence, |Rule |
1001, |helps |determine |if |this |testimony |is |acceptable |to |the |court? |- |ANSWERS✔✔ |Definition
|of |original |evidence
When |can |a |forensic |investigator |collect |evidence |without |formal |consent? |- |ANSWERS✔✔ |
When |properly |worded |banners |are |displayed |on |the |computer |screen
Who |determines |whether |a |forensic |investigation |should |take |place |if |a |situation |is |
undocumented |in |the |standard |operating |procedures? |- |ANSWERS✔✔ |Decision |maker
Which |situation |leads |to |a |civil |investigation? |- |ANSWERS✔✔ |Disputes |between |two |parties |
that |relate |to |a |contract |violation
Which |rule |does |a |forensic |investigator |need |to |follow? |- |ANSWERS✔✔ |Use |well-known |
standard |procedures
What |is |the |focus |of |Locard's |exchange |principle? |- |ANSWERS✔✔ |Anyone |entering |a |crime |
scene |takes |something |with |them |and |leaves |something |behind.
, What |is |the |focus |of |the |enterprise |theory |of |investigation |(ETI)? |- |ANSWERS✔✔ |Solving |one
|crime |can |tie |it |back |to |a |criminal |organization's |activities.
A |forensic |investigator |is |searching |a |Windows |XP |computer |image |for |information |about |a |
deleted |Word |document. |The |investigator |already |viewed |the |sixth |file |that |was |deleted |from |
the |computer. |Two |additional |files |were |deleted. |What |is |the |name |of |the |last |file |the |
investigator |opens? |- |ANSWERS✔✔ |$R7.doc
What |is |a |benefit |of |a |web |application |firewall |(WAF)? |- |ANSWERS✔✔ |Acts |as |a |reverse |
proxy |to |inspect |all |HTTP |traffic
How |does |a |hacker |bypass |a |web |application |firewall |(WAF) |with |the |toggle |case |technique? |-
|ANSWERS✔✔ |By |randomly |capitalizing |some |of |the |characters
During |a |recent |scan |of |a |network, |a |network |administrator |sent |ICMP |echo |8 |packets |to |each
|IP |address |being |used |in |the |network. |The |ICMP |echo |8 |packets |contained |an |invalid |media |
access |control |(MAC) |address. |Logs |showed |that |one |device |replied |with |ICMP |echo |0 |
packets. |What |does |the |reply |from |the |single |device |indicate? |- |ANSWERS✔✔ |The |machine |
is |in |promiscuous |mode.
What |is |the |goal |for |an |attacker |using |a |directory |traversal |attack? |- |ANSWERS✔✔ |To |access |
areas |in |the |system |in |which |the |attacker |should |not |have |access
A |forensic |investigator |is |performing |malware |analysis |on |a |Windows |computer. |The |
investigator |believes |malware |has |replaced |the |legitimate |drivers |with |fake |versions. |What |
should |the |investigator |look |at |to |confirm |these |suspicions? |- |ANSWERS✔✔ |The |digital |
signatures |on |the |drivers
Where |should |an |investigator |look |in |the |registry |to |find |artifacts |if |there |is |malware |on |a |
Windows |system? |- |ANSWERS✔✔ |HKLM\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run
