What's the main piece of information you look for in an e-mail message you're investigating?

Originating e-mail domain or IP address

Phishing does which of the following?

Lures users with false promises

Block-wise hashing has which of the following benefits for forensics examiners?

a method for hashing sectors of a good file, used to search data remanants

To trace an IP address in an e-mail header, what type of lookup service can you use?

A domain lookup service; www.arin.net, www.internic.com, or www.whois.net

Which of the following represents known files you can eliminate from an investigation?

Files associated with an application

____ hide the most valuable data at the innermost part of the network.

Layered network defense strategies

In steganalysis, cover-media is which of the following?

The content of a file used for a steganography message

Router logs can be used to verify what types of e-mail data?

Tracking flows through e-mail server ports

Rainbow tables serve what purpose for digital forensics examinations?

compute hashes of possible passwords that password-recovery programs use

studbud

Final Review: Part 1

100 termsStudBud Administration12 plays

Chapters 8-12 and 14-15

Flashcards100 cardsFPractice quizPHost liveL

Questions 100

Answers

1
In an e-mail address, everything after the ____ symbol represents the domain name.
@
.
#
-
2
Module 11
b: Username and password
c: Firewall log
Both a and c
a: E-mail header
3
____ is a data-hiding technique that uses host files to cover the contents of a secret message.
Graphie
Steganalysis
Steganos
Steganography
4
Which of the following is a mobile forensics method listed in NIST guidelines?
Physical extraction
All of the above
Logical extraction
Hex dumping
5
Which of the following relies on a central database that tracks account data, location data, and subscriber information?
MSC
None of the above
BSC
BTS
6
What's the main piece of information you look for in an e-mail message you're investigating?
Originating e-mail domain or IP address
Subject line content
Message number
Sender or receiver's e-mail address
7
Phishing does which of the following?
Uses DNS poisoning
Lures users with false promises
Takes people to fake Web sites
Uses DHCP
8
Block-wise hashing has which of the following benefits for forensics examiners?
Provides a faster way to shift bits in a block or sector of data
Allows validating sector comparisons between known files
a method for hashing sectors of a good file, used to search data remanants
Verifies the quality of OS files
9
To retrieve e-mail headers in Microsoft Outlook, double-click the e-mail message, and then click File, ____.
Details
Options
Message Source
Properties
10
What are the three modes of protection in the DiD strategy?
PCs, mobile devices, laptops
Computer, smartphones, tablets
People, technology, operations
People, PCs, mobile devices
11
In which case did the U.S. Supreme Court require using a search warrant to examine the contents of mobile devices?
Riley v. California
Smith v. Oregon
Miles v. North Dakota
Dearborn v. Ohio
12
After you shift a file's bits, the hash value remains the same.
True
False
13
To view e-mail headers on Yahoo! click the ____ list arrow, and click View Raw Message.
General Preferences
More
Message Properties
Advanced
14
Packet analyzers examine what layers of the OSI model?
All layers
Layers 2 and 3
Layers 4 through 7
Layers 2 and 4
15
According to SANS DFIR Forensics, which of the following tasks should you perform if a mobile device is on and unlocked?
Isolate the device from the network.
Disable the screen lock.
Remove the passcode.
All of the above
16
Some popular Web-based e-mail service providers are Gmail, ____, Outlook Online, and Yahoo!
Facebook
Twitter
Greatmail
Zoho
17
Most SIM cards allow ______ access attempts before locking you out.
Two
One
Four
Three
18
A common way of examining network traffic is by running the ____ program.
Coredump
Netdump
Tcpdump
Slackdump
19
To trace an IP address in an e-mail header, what type of lookup service can you use?
A domain lookup service; www.arin.net, www.internic.com, or www.whois.net
Verizon's http://superpages.com
Intelius Inc.'s AnyWho online directory
None of the above
20
According to SANS DFIR Forensics, which of the following tasks should you perform if a mobile device is on and unlocked?
Remove the passcode.
Isolate the device from the network.
All of the above
Disable the screen lock.
21
Which case did the U.S. Supreme Court require using a search warrant to examine the contents of mobile devices?
Riley v. California
Dearborn v. Ohio
Smith v. Oregon
Miles v. North Dakota
22
You can view e-mail headers in Notepad with all popular e-mail clients.
False
True
23
Which of the following is a clue that a virtual machine has been installed on a host system?
Virtualization software
Virtual network adapter
Network logs
USB drive
24
The uppercase letter ____ has a hexadecimal value 41.
C
A
G
Z
25
Which Registry key contains associations for file extensions?
HKEY_CLASSES_ROOT
HFILE_EXTENSIONS
HFILE_CLASSES_ROOT
HKEY_CLASSES_FILE
26
Under copyright laws, computer programs may be registered as ____.
architectural works
audiovisual works
motion pictures
literary works
27
Which of the following represents known files you can eliminate from an investigation?
Any files pertaining to the company
Any graphics files
Files associated with an application
All of the above
28
In VirtualBox, a(n) __________ file contains settings for virtual hard drives.
.vbox-prev
.log
.vbox
.ovf
29
Which forensic image file format creates or incorporates a validation hash value in the image file?
All of the above
SMART
Expert Witness
AFF
30
____ is a way to verify the names of domains a message is flowing through.
www.juno.com
www.google.com
www.dkim.org
www.whatis.com
31
____ contains configuration information for Sendmail, helping the investigator to determine where the log files reside.
/etc/var/log/maillog
/etc/sendmail.cf
/var/log/maillog
/etc/syslog.conf
32
Email headers, copy and paste them into a text document so that you can read them with a text editor, such as Windows __
vim
Nano
Notepad+
TextEdit
33
____ hide the most valuable data at the innermost part of the network.
Layered network defense strategies
Protocols
NAT
Firewalls
34
Module 9
Nothing; this is what you'd expect to see.
There's a hidden partition.
The drive is formatted incorrectly.
The disk is corrupted.
35
The image format XIF is derived from the more common ____ file format.
TIF
JPEG
BMP
GIF
36
A mobile device should be connected to a laptop or tablet to observe synchronization as it takes place at a crime scene
True
False
37
E-mail accessed with a Web browser leaves files in temporary folders.
True
False
38
E-mail headers contain which of the following information?
All of the above
The sender and receiver e-mail addresses
An ESMTP number or reference number
The e-mail servers the message traveled through to reach its destination
39
In steganalysis, cover-media is which of the following?
The content of a file used for a steganography message
A specific type of graphics used only for hashing steganographic files
The type of steganographic method used to conceal a message
The file a steganography tool uses to host a hidden message; JPEG of MP3
40
What information is not in an e-mail header?
Blind copy (bcc) addresses
Internet addresses
All of the above
Domain name
41
Which of the following file extensions are associated with VMware virtual machines?
.vmx, .r0, and .xml-prev
.vmx, .log, and .nvram
.vbox, .vdi, and .log
.vdi, .ova, and .r0
42
On a UNIX-like system, which file specifies where to save different types of e-mail log files?
syslog.conf
maillog
/var/spool/log
log
43
Router logs can be used to verify what types of e-mail data?
Finding blind copies
Content of attached files
Message content
Tracking flows through e-mail server ports
44
A forensic linguist can determine an author's gender by analyzing chat logs and social media communications.
True
False
45
What's the most commonly used cellular network worldwide?
GSM
EDGE
TDMA
CDMA
46
SIM card readers can alter evidence by showing that a message has been read when you view it.
False
True
47
A forensic image of a VM includes all snapshots.
True
False
48
A layered network defense strategy puts the most valuable data where?
None of the above
In the innermost layer
In the outermost layer
In the DMZ
49
Module 11
True
False
50
Rainbow tables serve what purpose for digital forensics examinations?
Rainbow tables provide a scoring system for probable search terms.
enhance the search capability of many digital forensics examination tools.
Rainbow tables are a supplement to the NIST NSRL library of hash tables.
compute hashes of possible passwords that password-recovery programs use
51
The number of VMs that can be supported per host by a type 1 hypervisor is generally determined by the amount of _and_.
RAM, storage
RAM, network speed
RAM, GPU
Storage, processing power
52
To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server's internal operations.
True
False
53
Which of the following categories of information is stored on a SIM card?
None of the above
b: Service-related data
a: Call data
Both a and b
54
Scope creep happens when an investigation goes beyond the bounds of its original description.
False
True
55
Commercial encryption programs often rely on key escrow technology to recover files if a password or passphrase is lost.
False
True
56
In Microsoft Outlook, e-mails are typically stored in which of the following?
res1.log and res2.log files
PU020102.db file
.pst and .ost files
.evolution file
57
Is collecting evidence for an email harassment case easier for and internal corporate or criminal investigation?
IC; corporate investigators typically have ready access to company records
CI; law enforcement agencies have more resources at their disposal
IC; ISPs almost always turn over e-mail and access logs when requested
CI; ubpoenas can be issued to acquire any needed evidence quickly
58
____ steganography replaces bits of the host file with other bits of data.
Append
Substitution
Insertion
Replacement
59
You can view e-mail headers in Notepad with all popular e-mail clients.
True
False
60
The National Software Reference Library provides what type of resource for digital forensics examiners?
A repository for software vendors to register developed applications
Reference books and materials for digital forensics
a list of MD5 and SHA1 hash values for all known OSs and applications
A list of digital forensics tools that make examinations easier
61
Mobile device information might be stored on the internal memory or the SIM card.
False
True
62
Module 11
Check the current database files for an existing copy of the e-mail.
Nothing, after the file has been deleted, it can no longer be recovered
Search available log files for any forwarded messages.
Restore the e-mail server from a backup.
63
Sendmail uses which file for instructions on processing an e-mail message?
syslogd.conf
mese.ese
sendmail.cf
mapi.log
64
Remote wiping of a mobile device can result in which of the following?
Removing account information
All of the above
Returning the phone to the original factory settings
Deleting contacts
65
____ hypervisors are typically, but not exclusively, loaded on servers or workstations with a lot of RAM and storage.
Type 2
Type 4
Type 3
Type 1
66
When you access your e-mail, what type of computer architecture are you using?
Domain
Client/server
None of the above
Mainframe and minicomputers
67
To find network adapters, you use the __________ command in Windows and the __________ command in Linux.
ipconfig, ifconfig
more, netstat
top, nd
tcpdump, netstat
68
The process of converting raw picture data to another format is referred to as ____.
Demosaicing
Rendering
Rastering
JEIDA
69
The likelihood that a brute-force attack can succeed in cracking a password depends heavily on the password length.
False
True
70
GSM divides a mobile station into ______ and ______.
RAM and SIM
SIM card and ME
SIM card and EEPROM
RAM and ME
71
For which of the following reasons should you wipe a target drive?
b: To make sure unwanted data isn't retained on the drive
Neither of the above
Both a and b
a: To ensure the quality of digital evidence you acquire
72
Most packet analyzers operate on layer 2 or ____ of the OSI model.
7
3
1
5
73
Tcpslice can be used to retrieve specific timeframes of packet captures.
False
True
74
____ is a layered network defense strategy developed by the National Security Agency (NSA).
Anti-Rootkit
Order of volatility
PsShutdown
Defense in Depth
75
Placing it in paint cans and using Faraday bags are two ways you can isolate a mobile device from incoming signals.
True
False
76
Hexadecimal 49 49 2A and has an offset of four bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 58 74 65 6E 64 65 64 20 03.
What type of header is this?
GIF
TIFF
XIF
77
What concerns should a forensics examiner have when attempting to recover passwords in an application that uses salting?
Salting can make password recovery extremely difficult and time consuming
Salting applies only to OS startup passwords, so no serious concerns
No concerns because salting doesn't affect password-recovery tools
The effect on the computer's CMOS clock could alter files' date and time
78
Virtual Machine Extensions (VMX) are part of which of the following?
Intel Virtualized Technology
Type 2 hypervisors
AMD Virtualized Technology
Type 1 hypervisors
79
SIM card readers can alter evidence by showing that a message has been read when you view it.
True
False
80
____ determines how long a piece of information lasts on a system.
Longevity
Order of volatility
Continuity level
Liveness
81
The Known File Filter (KFF) can be used for which of the following purposes?
c: Compare hash values of known files with evidence files.
Both a and c
b: Calculate hash values of image files.
a: Filter known program files from view.
82
When do zero day attacks occur?
c: Before the vendor is aware of the vulnerability
a: On the day the application or OS is released
b: Before a patch is available
Both a and c
83
IETF is the organization setting standards for 5G devices.
False
True
84
Recovering fragments of a file is called ____.
Saving
Rebuilding
Carving
Slacking
85
Typically, you need a search warrant to retrieve information from a service provider.
True
False
86
____ has been used to protect copyrighted material by inserting digital watermarks into a file.
Steganography
Compression
Encryption
Archiving
87
Logging options on e-mail servers can be which of the following?
a: Disabled by users
c: Configured to a specified size before being overwritten
Both b and c
b: Set up in a circular logging configuration
88
Steganography is used for which of the following purposes?
Hiding data
Accessing remote computers
Validating data
Creating strong passwords
89
Which of the following types of files can provide useful information when you're examining an e-mail server?
.dbf files
.slf files
.emx files
.log files
90
The uRLLC 5G category focuses on communications in smart cities.
True
False
91
The term TDMA refers to which of the following?
Both a and c
A proprietary protocol developed by Motorola
A technique dividing radio frequency so that multiple users share a channel
A specific cellular network standard
92
Typically, you need a search warrant to retrieve information from a service provider.
True
False
93
You can expect to find a type 2 hypervisor on what type of device?
Smartphone
Desktop
Tablet
All of the above
94
SD cards have a capacity up to which of the following?
4 MB
500 MB
64 GB
100 MB
95
____ is a good tool for extracting information from large Libpcap files.
tcpslice
memfetch
john
oinkmaster
96
Password recovery is included in all forensics tools.
False
True
97
TheInternetofThings includes radio frequency identification (RFID) sensors as well as wired,wireless, and mobile devices
False
True
98
Remote wiping of a mobile device can result in which of the following?
Deleting contacts
Returning the phone to the original factory settings
Removing account information
All of the above
99
The JFIF ____ format has a hexadecimal value of FFD8 FFE0 in the first four bytes.
BMP
GIF
JPEG
EPS
100
Which of the following is a current formatting standard for e-mail?
MIME
SMTP
Outlook
HTML

Final Review: Part 1 Flashcards | StudBud