Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

C702 Forensics and Network Intrusion > CHFI Online Study Notes > Flashcards

CHFI Online Study Notes Flashcards

1
Q

What are the essential Windows system files?

A

Ntoskrnl.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is NOT a disk editor tool to help view file headers and important information about a file?

Win Edit
Hex Workshop
Disk Edit
WinHex

A

Win Edit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which LBA contains the GPT header?

A

LBA 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following items is used to describe the characteristics of the file system information present on a given CD-ROM?

POSIX attribute
Track header
Boot sector
Volume descriptor

A

Volume descriptor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
Which of the following is NOT an advantage of SSDs over HDDs?
Higher reliability
Non-volatile memory
Faster data access
Less power usage
A

Non-volatile memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which field type refers to the volume descriptor as a supplementary?

A

Number 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a hard disk’s first sector that specifies the location of an operating system for the system to load into the main storage?

A

Master Boot Record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which field type refers to the volume descriptor as a set terminator?

A

Number 255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following should be work area considerations for forensic labs?

A

Examiner station has an area of about 50–63 square feet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which of the following is a computer-created source of potential evidence?

A

Swap File

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Forensic readiness refers to:

A

An organization’s ability to make optimal use of digital evidence in a limited period and with minimal investigation costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following Windows operating systems powers on and starts up using only the traditional BIOS-MBR method?

A

Windows Vista

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which of the following is a consideration of HDDs but not SSDs?

A

RPM Speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which item describes the following UEFI boot process phase? (The phase of EFI consisting of interpreting the boot configuration data, selecting the Boot Policy for later implementation, working with the prior phase to check if the device drivers require signature verification, loading either MBR boot code into memory for Legacy BIOS Boot or the Bootloader program from the EFI partition for UEFI Boot, and providing an option for the user to choose EFI Shell or an UEFI application as the Boot Device from the Setup.)

A

BDS (Boot Device Selection) Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q 
Which of the following is NOT a common computer file system?
EXT2
NTFS
EFX3
FAT32
A

EFX3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the role of an expert witness?

A

To educate the public and court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following Federal Rules of Evidence ensures that the truth may be ascertained and the proceedings justly determined?

A

Rule 102

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following is one of the five UEFI boot process phases?

BSD Phase
RT Phase
PAI Phase
PIE Phase

A

RT Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of the following describes when the user restarts the system via the operating system?

A

Warm Booting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What do GPTs use instead of the addressing used in modern MBRs?

A

LBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following is a 128-bit unique number, generated by the Windows OS for identifying a specific device, document, database entry, or user?

A

Globally Unique Identifier (GUID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The UEFI assigns how many bytes for the Partition Entry Array?

A

16,384

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following is a user-created source of potential evidence?

A

Address Book

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which of the following should be physical location and structural design considerations for forensics labs?

A

Lab exteriors should have no windows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which item describes the following UEFI boot process phase? (The phase of EFI consisting of initializing the CPU, temporary memory, and boot firmware volume (BFV); locating and executing the chapters to initialize all the found hardware in the system; and creating a Hand-Off Block List with all found resources interface descriptors.)

A

PEI (Pre-EFI Initialization) Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which file system for Linux transfers all tracks and boot images on a CD as normal files?

A

CDFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

On Macintosh computers, which architecture utilizes Open Firmware to initialize the hardware interfaces after the BootROM performs POST?

A

PowerPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What replaces legacy BIOS firmware interfaces and uses a partition interfacing system to overcome the limitations of the MBR partitioning scheme?

A

UEFI (Unified Extensible Firmware Interface)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which of the following is an advantage of the GPT disk layout?

A

GPT allows users to partition disks larger than 2 terabytes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which of the following is NOT part of the Computer Forensics Investigation Methodology?

A

Testify as an expert defendant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following file systems are used for adding more descriptors to a CD-ROM’s file system sequence?

A

Joliet and UDF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which of the following is TRUE of cybercrimes?

A

Investigators, with a warrant, have the authority to forcibly seize the computing devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which commands help create MBR in Windows and DOS operating systems?

A

FDISK/MBR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which of the following is a small piece of instruction in computer language, which the system loads into the BIOS and executes to initiate the system’s boot process?

A

Master Boot Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which logical drive holds the information regarding the data and files that are stored in the disk?

A

Extended Partition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which cmdlet can investigators use in Windows PowerShell to analyze the GUID Partition Table to find the exact type of boot sector and display the partition object?

A

Get-PartitionTable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following basic partitioning tools displays details about GPT partition tables in Macintosh OS?

A

Disk Utility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How many tracks are typically contained on a platter of a 3.5″ HDD?

A

1,000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Under which of the following conditions will duplicate evidence NOT suffice?

A

When original evidence is in possession of the originator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which field type in a volume descriptor refers to a boot record?

A

Number 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which of the following is NOT an objective of computer forensics?

A

Mitigate vulnerabilities to prevent further loss of intellectual property, finances, and reputation during an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How many bytes is each partition entry in GPT?

A

128 Bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which partition type designates the protective MBR from legacy MBR?

A

0xEE

44
Q

Which cmdlet can investigators use in Windows PowerShell to analyze the GUID Partition Table data structure of the hard disk?

A

Get-GPT

45
Q

How many bits are used by the MBR partition scheme for storing LBAs (Logical Block Addresses) and the size information on a 512-byte sector?

A

32

46
Q

Under which of the following circumstances has a court of law allowed investigators to perform searches without a warrant?

A

Delay in obtaining a warrant may lead to the destruction of evidence and hamper the investigation process.

47
Q

Which of the following Windows operating systems powers on and starts up using either the traditional BIOS-MBR method or the newer UEFI-GPT method?

A

Windows 8

48
Q

Which of the following Federal Rules of Evidence states that the court shall restrict the evidence to its proper scope and instruct the jury accordingly?

A

Rule 105

49
Q

What file format is used by Windows Vista and later versions to store event logs as simple text files in XML format?

A

EVTX

50
Q

Which is NOT a valid type of digital evidence?

A

DNA Sample

51
Q

What is a common technique used to distribute malware on the web by mimicking legitimate institutions in an attempt to steal passwords, credit cards, and bank account data?

A

Spear phishing sites

52
Q

What is the primary information required for starting an email investigation?

A

The unique IP address

53
Q

What is a common technique used to distribute malware on the web by injecting malware into legitimate-looking websites to trick users into selecting them?

A

Click-jacking

54
Q

What is NOT a command used to determine logged-on users?

A

LoggedSessions

55
Q

What is NOT one of the three tiers a log management infrastructure typically comprises?

A

Log Rotation

56
Q

Where are deleted items stored on Windows Vista and later versions of Windows?

A

Drive:$Recycle.Bin

57
Q

Which web application threat occurs when attackers bypass the client’s ID security mechanisms, gain access privileges, and inject malicious scripts into specific fields in web pages?

A

Cross-site scripting

58
Q

What is a common technique used to distribute malware on the web when an attacker exploits flaws in browser software to install malware just by visiting a website?

A

Drive-by downloads

59
Q

Which of the following stakeholders is responsible for making sure all the forensic activities are within the jurisdiction and not violating any regulations or agreements?

A

Law Advisors

60
Q

Which web application threat occurs when an authenticated user is forced to perform certain tasks on the web application chosen by an attacker?

A

Cross-site request forgery

61
Q

What prefetch does value 1 from the registry entry, EnablePrefetcher, tell the system to use?

A

Application prefetching is enabled.

62
Q

Which of the three different files storing data and logs in SQL servers is optional?

A

NDF

63
Q

What layer of web application architecture contains components that parse the request (HTTP Request Parser) coming in and forwards the response back?

A

Web server layer

64
Q

Which is a threat to web applications?

A

Cookie poisoning

65
Q

What layer of web application architecture is composed of cloud services which hold all commercial transactions and a server that supplies an organization’s production data in a structured form?

A

Database Layer

66
Q

What is a proprietary information security standard for organizations that handle cardholder information for major debit, credit, prepaid, e-purse, ATM, and POS cards?

A

PCI DSS

67
Q

Which is a violation of the Controlling the Assault of Non-Solicited Pornography and Marketing Act?

A

Retransmitting spam messages through a computer to mislead others about the origin of the message

68
Q

Where can congressional security standards and guidelines be found, with an emphasis for federal agencies, for the development, documentation, and implementation of organization-wide programs for information security?

A

FISMA

69
Q

Which is NOT an indication of a web attack?

A

Logs found to have no known anomalies

70
Q

What must an investigator do in order to offer a good report to a court of law and ease the prosecution?

A

Preserve the evidence

71
Q

Which of the following is NOT a digital data storage type?

A

Quantum storage devices

72
Q

Which of the following is an internal network vulnerability?

A

Bottleneck

73
Q

Which tool helps collect information about network connections operative in a Windows system?

A

NETSTAT

74
Q

What is NOT true of email crimes?

A

Email crime is not limited by the email organization.

75
Q

What cloud service offers application software to subscribers on demand or over the internet and is charged for by the provider on a pay-per-use basis, by subscription, by advertising, or by sharing among multiple users?

A

SaaS

76
Q

Which is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples?

A

Volatility Framework

77
Q

Which architectural layer of mobile device environments provides telephony services related to the mobile carrier operator such as making calls, receiving calls, and SMS?

A

Phone API

78
Q

Which web application threat is a method intended to terminate website or server operations by making resources unavailable to clients?

A

Denial-of-service

79
Q

Which is NOT a log management system function?

A

Log generation

80
Q

What operating system was Android based on?

A

Linux

81
Q

Which web application threat refers to a drawback in a web application where it unintentionally reveals sensitive data to an unauthorized user?

A

Information leakage

82
Q

What is NOT a command used to determine open files?

A

Open files

Not to be confused with Openfiles

83
Q

Which architectural layer of mobile device environments simplifies the process of interacting with web services and other applications such as email, the internet, and SMS?

A

Communication API

84
Q

What cloud service enables subscribers to use fundamental IT resources, such as computing power, virtualization, data storage, network, etc., on demand?

A

IaaS

85
Q

What is a cloud environment composed of two or more clouds that remain unique entities but are bound together to offer the benefits of multiple deployment models?

A

Hybrid cloud

86
Q

Which web application threat refers to the modification of a website’s remnant data for bypassing security measures or gaining unauthorized information?

A

Cookie poisoning

87
Q

What prefetch does value 3 from the registry entry, EnablePrefetcher, tell the system to use?

A

Both application and boot prefetching are enabled.

88
Q

Which of the following includes security standards for health information?

A

HIPAA

89
Q

What is NOT one of the three major concerns regarding log management?

A

Log viewing

90
Q

What tool enables you to retrieve information about event logs and publishers in Windows 10?

A

Wevutil

91
Q

Which cloud environment allows the provider to make services—such as applications, servers, and data storage—available to the public over the internet?

A

Public Cloud

92
Q

Which architectural layer of mobile device environments contains items that are responsible for mobile operations such as a display device, a keypad, RAM, flash, an embedded processor, and a media processor?

A

Hardware

93
Q

Which is a type of network-based attack?

A

Eavesdropping

94
Q

Which web application threat occurs when attackers insert commands via input data and are able to tamper with the data?

A

SQL injection

95
Q

Which of the following best describes flash memory?

A

Flash memory is a non-volatile, electronically erasable and reprogrammable storage medium.

96
Q

Which of the following stakeholders is responsible for conducting forensic examinations against allegations made regarding wrongdoings, found vulnerabilities, and attacks over the cloud?

A

Investigators

97
Q

Which web application threat refers to vulnerable management functions, including user updates, recovery of passwords, or resetting passwords?

A

Broken account management

98
Q

What type of analysis do investigators perform to detect something that has already occurred in a network/device and determine what it is?

A

Postmortem

99
Q

Smith, as a part of his forensic investigation assignment, seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data in the mobile device. Smith found that the SIM was protected by a Personal Identification Number (PIN) code, but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He made three unsuccessful attempts, which blocked the SIM card. What can Smith do in this scenario to reset the PIN and access SIM data?

A

He should ask the Network Operator for Personal Unlock Number (PUK) to gain access to the SIM

100
Q

Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute to determining the addresses of data?

A

Interface

101
Q

Which of the following standard represents a legal precedent set in 1993 by the Supreme Court of the United States regarding the admissibility of expert witnesses’ testimony during federal legal proceedings?

A

Daubert

102
Q

Which of the following examinations refers to the process of the witness being questioned by the attorney who called the latter to the stand?

A

Direct-Examination

103
Q

Who is responsible for the following tasks?
• Secure the scene
• Ensure that it is maintained in a secure state until the Forensic Team arrives
• Make notes about the scene that will eventually be handed over to the Forensic Team

A

Non-forensics staff

104
Q

Which of the following tool is used to locate IP addresses?

A

SmartWhois

105
Q

Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is:

A

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList

106
Q

Which US law does the interstate or international transportation and receiving of child pornography fall under?

A

18 U.S. Code § 2252

107
Q

ata is striped at a byte level across multiple drives, and parity information is distributed among all member drives. What RAID level is represented here?

A

RAID Level 5

C702 Forensics and Network Intrusion (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions