What concerns should a forensics examiner have when attempting to recover passwords in an application that uses salting?

Salting can make password recovery extremely difficult and time consuming

Logging options on e-mail servers can be which of the following?

c: Configured to a specified size before being overwritten

Restore the e-mail server from a backup.

Block-wise hashing has which of the following benefits for forensics examiners?

a method for hashing sectors of a good file, used to search data remanants

Is collecting evidence for an email harassment case easier for and internal corporate or criminal investigation?

IC; corporate investigators typically have ready access to company records

In steganalysis, cover-media is which of the following?

The content of a file used for a steganography message

____ hide the most valuable data at the innermost part of the network.

Layered network defense strategies

Router logs can be used to verify what types of e-mail data?

Tracking flows through e-mail server ports

studbud

Final Review: Part 1

100 termsStudBud Administration12 plays

Chapters 8-12 and 14-15

Flashcards100 cardsFPractice quizPHost liveL

Questions 100

Answers

1
What concerns should a forensics examiner have when attempting to recover passwords in an application that uses salting?
Salting applies only to OS startup passwords, so no serious concerns
No concerns because salting doesn't affect password-recovery tools
Salting can make password recovery extremely difficult and time consuming
The effect on the computer's CMOS clock could alter files' date and time
2
Which of the following types of files can provide useful information when you're examining an e-mail server?
.slf files
.log files
.emx files
.dbf files
3
Module 11
False
True
4
Remote wiping of a mobile device can result in which of the following?
Removing account information
All of the above
Deleting contacts
Returning the phone to the original factory settings
5
Logging options on e-mail servers can be which of the following?
c: Configured to a specified size before being overwritten
b: Set up in a circular logging configuration
a: Disabled by users
Both b and c
6
A forensic image of a VM includes all snapshots.
False
True
7
The JFIF ____ format has a hexadecimal value of FFD8 FFE0 in the first four bytes.
GIF
JPEG
EPS
BMP
8
Commercial encryption programs often rely on key escrow technology to recover files if a password or passphrase is lost.
False
True
9
Tcpslice can be used to retrieve specific timeframes of packet captures.
True
False
10
A forensic linguist can determine an author's gender by analyzing chat logs and social media communications.
False
True
11
Module 11
Restore the e-mail server from a backup.
Search available log files for any forwarded messages.
Nothing, after the file has been deleted, it can no longer be recovered
Check the current database files for an existing copy of the e-mail.
12
The Known File Filter (KFF) can be used for which of the following purposes?
b: Calculate hash values of image files.
Both a and c
a: Filter known program files from view.
c: Compare hash values of known files with evidence files.
13
Most SIM cards allow ______ access attempts before locking you out.
Two
Three
One
Four
14
Email headers, copy and paste them into a text document so that you can read them with a text editor, such as Windows __
Nano
Notepad+
TextEdit
vim
15
____ has been used to protect copyrighted material by inserting digital watermarks into a file.
Steganography
Encryption
Archiving
Compression
16
A common way of examining network traffic is by running the ____ program.
Netdump
Slackdump
Coredump
Tcpdump
17
What's the most commonly used cellular network worldwide?
EDGE
CDMA
TDMA
GSM
18
IETF is the organization setting standards for 5G devices.
True
False
19
Block-wise hashing has which of the following benefits for forensics examiners?
Verifies the quality of OS files
a method for hashing sectors of a good file, used to search data remanants
Allows validating sector comparisons between known files
Provides a faster way to shift bits in a block or sector of data
20
Sendmail uses which file for instructions on processing an e-mail message?
mapi.log
mese.ese
syslogd.conf
sendmail.cf
21
Steganography is used for which of the following purposes?
Creating strong passwords
Hiding data
Accessing remote computers
Validating data
22
To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server's internal operations.
True
False
23
In which case did the U.S. Supreme Court require using a search warrant to examine the contents of mobile devices?
Riley v. California
Dearborn v. Ohio
Miles v. North Dakota
Smith v. Oregon
24
Is collecting evidence for an email harassment case easier for and internal corporate or criminal investigation?
CI; ubpoenas can be issued to acquire any needed evidence quickly
IC; ISPs almost always turn over e-mail and access logs when requested
CI; law enforcement agencies have more resources at their disposal
IC; corporate investigators typically have ready access to company records
25
The likelihood that a brute-force attack can succeed in cracking a password depends heavily on the password length.
False
True
26
Which of the following is a mobile forensics method listed in NIST guidelines?
Physical extraction
Hex dumping
All of the above
Logical extraction
27
You can view e-mail headers in Notepad with all popular e-mail clients.
False
True
28
You can expect to find a type 2 hypervisor on what type of device?
Tablet
Desktop
All of the above
Smartphone
29
Module 9
The disk is corrupted.
Nothing; this is what you'd expect to see.
The drive is formatted incorrectly.
There's a hidden partition.
30
According to SANS DFIR Forensics, which of the following tasks should you perform if a mobile device is on and unlocked?
Disable the screen lock.
All of the above
Remove the passcode.
Isolate the device from the network.
31
SD cards have a capacity up to which of the following?
4 MB
100 MB
500 MB
64 GB
32
To view e-mail headers on Yahoo! click the ____ list arrow, and click View Raw Message.
General Preferences
More
Message Properties
Advanced
33
____ is a way to verify the names of domains a message is flowing through.
www.google.com
www.dkim.org
www.juno.com
www.whatis.com
34
Remote wiping of a mobile device can result in which of the following?
Removing account information
Deleting contacts
Returning the phone to the original factory settings
All of the above
35
Mobile device information might be stored on the internal memory or the SIM card.
False
True
36
Packet analyzers examine what layers of the OSI model?
Layers 2 and 4
Layers 4 through 7
All layers
Layers 2 and 3
37
In steganalysis, cover-media is which of the following?
The type of steganographic method used to conceal a message
The file a steganography tool uses to host a hidden message; JPEG of MP3
A specific type of graphics used only for hashing steganographic files
The content of a file used for a steganography message
38
You can view e-mail headers in Notepad with all popular e-mail clients.
False
True
39
Under copyright laws, computer programs may be registered as ____.
literary works
motion pictures
audiovisual works
architectural works
40
____ hide the most valuable data at the innermost part of the network.
Firewalls
Layered network defense strategies
Protocols
NAT
41
GSM divides a mobile station into ______ and ______.
RAM and SIM
SIM card and EEPROM
SIM card and ME
RAM and ME
42
Module 11
b: Username and password
a: E-mail header
Both a and c
c: Firewall log
43
E-mail headers contain which of the following information?
An ESMTP number or reference number
All of the above
The e-mail servers the message traveled through to reach its destination
The sender and receiver e-mail addresses
44
____ contains configuration information for Sendmail, helping the investigator to determine where the log files reside.
/var/log/maillog
/etc/var/log/maillog
/etc/sendmail.cf
/etc/syslog.conf
45
____ is a data-hiding technique that uses host files to cover the contents of a secret message.
Steganography
Graphie
Steganos
Steganalysis
46
What are the three modes of protection in the DiD strategy?
People, technology, operations
People, PCs, mobile devices
Computer, smartphones, tablets
PCs, mobile devices, laptops
47
Placing it in paint cans and using Faraday bags are two ways you can isolate a mobile device from incoming signals.
True
False
48
In an e-mail address, everything after the ____ symbol represents the domain name.
#
.
-
@
49
A mobile device should be connected to a laptop or tablet to observe synchronization as it takes place at a crime scene
False
True
50
Router logs can be used to verify what types of e-mail data?
Message content
Tracking flows through e-mail server ports
Content of attached files
Finding blind copies
51
Which case did the U.S. Supreme Court require using a search warrant to examine the contents of mobile devices?
Smith v. Oregon
Dearborn v. Ohio
Miles v. North Dakota
Riley v. California
52
The term TDMA refers to which of the following?
Both a and c
A specific cellular network standard
A technique dividing radio frequency so that multiple users share a channel
A proprietary protocol developed by Motorola
53
The uRLLC 5G category focuses on communications in smart cities.
True
False
54
Virtual Machine Extensions (VMX) are part of which of the following?
Type 1 hypervisors
AMD Virtualized Technology
Intel Virtualized Technology
Type 2 hypervisors
55
Which of the following categories of information is stored on a SIM card?
b: Service-related data
None of the above
Both a and b
a: Call data
56
Password recovery is included in all forensics tools.
True
False
57
SIM card readers can alter evidence by showing that a message has been read when you view it.
False
True
58
Which of the following is a current formatting standard for e-mail?
HTML
SMTP
Outlook
MIME
59
According to SANS DFIR Forensics, which of the following tasks should you perform if a mobile device is on and unlocked?
All of the above
Disable the screen lock.
Isolate the device from the network.
Remove the passcode.
60
Typically, you need a search warrant to retrieve information from a service provider.
False
True
61
To retrieve e-mail headers in Microsoft Outlook, double-click the e-mail message, and then click File, ____.
Options
Details
Properties
Message Source
62
Which Registry key contains associations for file extensions?
HFILE_EXTENSIONS
HFILE_CLASSES_ROOT
HKEY_CLASSES_FILE
HKEY_CLASSES_ROOT
63
The process of converting raw picture data to another format is referred to as ____.
JEIDA
Demosaicing
Rastering
Rendering
64
To find network adapters, you use the __________ command in Windows and the __________ command in Linux.
more, netstat
top, nd
ipconfig, ifconfig
tcpdump, netstat
65
What's the main piece of information you look for in an e-mail message you're investigating?
Originating e-mail domain or IP address
Message number
Subject line content
Sender or receiver's e-mail address
66
Most packet analyzers operate on layer 2 or ____ of the OSI model.
1
5
7
3
67
TheInternetofThings includes radio frequency identification (RFID) sensors as well as wired,wireless, and mobile devices
False
True
68
SIM card readers can alter evidence by showing that a message has been read when you view it.
True
False
69
In Microsoft Outlook, e-mails are typically stored in which of the following?
res1.log and res2.log files
PU020102.db file
.evolution file
.pst and .ost files
70
Recovering fragments of a file is called ____.
Slacking
Saving
Carving
Rebuilding
71
After you shift a file's bits, the hash value remains the same.
True
False
72
Scope creep happens when an investigation goes beyond the bounds of its original description.
True
False
73
To trace an IP address in an e-mail header, what type of lookup service can you use?
Verizon's http://superpages.com
A domain lookup service; www.arin.net, www.internic.com, or www.whois.net
Intelius Inc.'s AnyWho online directory
None of the above
74
Some popular Web-based e-mail service providers are Gmail, ____, Outlook Online, and Yahoo!
Greatmail
Twitter
Zoho
Facebook
75
When you access your e-mail, what type of computer architecture are you using?
Mainframe and minicomputers
None of the above
Domain
Client/server
76
The image format XIF is derived from the more common ____ file format.
GIF
JPEG
BMP
TIF
77
____ is a layered network defense strategy developed by the National Security Agency (NSA).
Order of volatility
Defense in Depth
PsShutdown
Anti-Rootkit
78
Typically, you need a search warrant to retrieve information from a service provider.
False
True
79
Which of the following file extensions are associated with VMware virtual machines?
.vbox, .vdi, and .log
.vmx, .log, and .nvram
.vmx, .r0, and .xml-prev
.vdi, .ova, and .r0
80
____ determines how long a piece of information lasts on a system.
Order of volatility
Longevity
Continuity level
Liveness
81
E-mail accessed with a Web browser leaves files in temporary folders.
False
True
82
Which of the following relies on a central database that tracks account data, location data, and subscriber information?
BTS
MSC
None of the above
BSC
83
When do zero day attacks occur?
a: On the day the application or OS is released
b: Before a patch is available
c: Before the vendor is aware of the vulnerability
Both a and c
84
On a UNIX-like system, which file specifies where to save different types of e-mail log files?
/var/spool/log
syslog.conf
maillog
log
85
Rainbow tables serve what purpose for digital forensics examinations?
Rainbow tables provide a scoring system for probable search terms.
compute hashes of possible passwords that password-recovery programs use
Rainbow tables are a supplement to the NIST NSRL library of hash tables.
enhance the search capability of many digital forensics examination tools.
86
A layered network defense strategy puts the most valuable data where?
In the outermost layer
In the innermost layer
None of the above
In the DMZ
87
For which of the following reasons should you wipe a target drive?
Both a and b
b: To make sure unwanted data isn't retained on the drive
Neither of the above
a: To ensure the quality of digital evidence you acquire
88
What information is not in an e-mail header?
Domain name
Internet addresses
Blind copy (bcc) addresses
All of the above
89
Phishing does which of the following?
Lures users with false promises
Uses DHCP
Takes people to fake Web sites
Uses DNS poisoning
90
____ hypervisors are typically, but not exclusively, loaded on servers or workstations with a lot of RAM and storage.
Type 3
Type 1
Type 2
Type 4
91
Which of the following represents known files you can eliminate from an investigation?
Any files pertaining to the company
Any graphics files
All of the above
Files associated with an application
92
____ is a good tool for extracting information from large Libpcap files.
oinkmaster
tcpslice
memfetch
john
93
In VirtualBox, a(n) __________ file contains settings for virtual hard drives.
.log
.ovf
.vbox-prev
.vbox
94
Hexadecimal 49 49 2A and has an offset of four bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 58 74 65 6E 64 65 64 20 03.
XIF
TIFF
GIF
What type of header is this?
95
____ steganography replaces bits of the host file with other bits of data.
Substitution
Replacement
Insertion
Append
96
Which of the following is a clue that a virtual machine has been installed on a host system?
Virtualization software
Network logs
Virtual network adapter
USB drive
97
The uppercase letter ____ has a hexadecimal value 41.
C
Z
G
A
98
The number of VMs that can be supported per host by a type 1 hypervisor is generally determined by the amount of _and_.
RAM, GPU
RAM, network speed
Storage, processing power
RAM, storage
99
Which forensic image file format creates or incorporates a validation hash value in the image file?
Expert Witness
SMART
AFF
All of the above
100
The National Software Reference Library provides what type of resource for digital forensics examiners?
Reference books and materials for digital forensics
A list of digital forensics tools that make examinations easier
A repository for software vendors to register developed applications
a list of MD5 and SHA1 hash values for all known OSs and applications

Final Review: Part 1 Flashcards | StudBud