Exam SET D Flashcards
One important tool of computer forensics is the disk image backup. The disk image backup is:
A. Copying the system files
B. Conducting a bit-level copy, sector by sector
C. Copying and authenticating the system files
D. Copying the disk directory
Answer: B
Explanation: Copying sector by sector at the bit level provides the capability to examine slack space, undeleted clusters and possibly, deleted files. With answer a, only the system files are copied and the other information recovered in answer b would not be captured.
Answer “Copying the disk directory” does not capture the data on the disk, and answer “Copying and authenticating the system files “ has the same problem as answer “Copying the system files”. Actually, authenticating the system files is another step in the computer forensics process wherein a message digest is generated for all system directories and files to be able to validate the integrity of the information at a later time. This authentication should be conducted using a backup copy of the disk and not the original to avoid modifying information on the original. For review purposes, computer forensics is the collecting of information from and about computer systems that is admissible in a court of law.
In the U.S. Federal Rules of Evidence, Rule 803 (6) permits an exception to the Hearsay Rule regarding business records and computer records.
Which one of the following is NOT a requirement for business or computer records exception under Rule 803 (6)?
A. Relied upon in the regular course of business
B. Made by a person with information transmitted by a person with knowledge
C. Made only by a person with knowledge of the records
D. Made during the regular conduct of business and authenticated by witnesses familiar with their use
Answer: C
Explanation: The business or computer records may be made by a person with information transmitted by a person with knowledge, also. The other answers are requirements for exceptions to the Hearsay Rule.
How many times should a diskette be formatted to comply with TCSEC Orange Book object reuse recommendations? A. Five B. Nine C. Three D. Seven
Answer: D
Explanation: The correct answer is 7. Most computer certification and accreditation standards recommend that diskettes be formatted seven times to prevent any possibility of data remanence .
Individual privacy rights as defined in the HIPAAPrivacy Rule include consent and authorization by the patient for the release of PHI. The difference between consent and authorization as used in the Privacy Rule is:
A. Consent grants general permission to use or disclose PHI, and authorization limits permission to the purposes and the parties specified in the authorization.
B. Consent grants general permission to use or disclose PHI, and authorization limits permission to the purposes specified in the authorization.
C. Authorization grants general permission to use or disclose PHI, and consent limits permission to the purposes and the parties specified in the consent.
D. Consent grants general permission to use or disclose PHI, and authorization limits permission to the parties specified in the authorization.
Answer: A
Explanation: Answer b is therefore incorrect. Answer c is incorrect since the limits to authorization do not include the parties concerneD . Answer d is incorrect since the limits to authorization do not include the specified purposes. The other individual privacy rights listed in the HIPAA Privacy Rule are: Notice (of the covered entities privacy practices) Right to request restriction Right of access Right to amend Right to an accounting In August of 2002, the U.S. Department of Health and Human Services (HHS) modified the Privacy Rule to ease the requirements of consent and allow the covered entities to use noticE . The changes are summarized as follows: Covered entities must provide patients with notice of the patients privacy rights and the privacy practices of the covered entity. Direct treatment providers must make a good faith effort to obtain patients written acknowledgement of the notice of privacy rights and practices. (The Rule does not prescribe a form of written acknowledgement; the patient may sign a separate sheet or initial a cover sheet of the notice.) Mandatory consent requirements are removed that would inhibit patient access to health care while providing covered entities with the option of developing a consent process that works for that entity. If the provider cannot obtain a written acknowledgement, it must document its good faith efforts to obtain one and the reason for its inability to obtain the acknowledgement. Consent requirements already in place may continue.
Which type of fire detectors sends an alarm when the temperature of the room rises dramatically? A. Odor-sensing B. Heat-sensing C. Smoke-actuated D. Flame-actuated
Answer: B
Explanation: A rate-of-rise detector triggers an alarm when the ambient temperature of a room increases rapidly. Another type of heat-sensing detector, a fixed temperature device, sends an alarm when the temperature passes a predetermined level.
Which of the following is NOT one of the European Union (EU) privacy principles?
A. Individuals have the right to correct errors contained in their personal data.
B. Information collected about an individual can be disclosed to other organizations or individuals unless specifically prohibited by the individual.
C. Individuals are entitled to receive a report on the information that is held about them.
D. Data transmission of personal information to locations where equivalent personal data protection cannot be assured is prohibited.
Answer: B
Explanation: This principle is stated as an opt-out principle in which the individual has to take action to prevent information from being circulated to other organizations. The correct corresponding European Union principle states that information collected about an individual cannot be disclosed to other organizations or individuals unless authorized by law or by consent of the individual. Thus, the individual would have to take an active role or opt-in to authorize the disclosure of information to other organizations. The other principles are valid EU privacy principles.
Which of the following more closely describes the combustibles in a Class B-rated fire? A. Gas B. Paper C. Liquid D. Electrical
Answer: C Explanation: The correct answer is C. Paper is described as a common combustible and is therefore rated a class A fire. An electrical fire is rated Class C. Gas is not defined as a combustible.
Which of the following is NOT a form of data erasure? A. Remanence B. Purging C. Clearing D. Destruction
Answer: A
Explanation: Clearing refers to the overwriting of data media intended to be reused in same organization. Purging refers to degaussing or overwriting media intended to be removed from the organization. Destruction refers to completely destroying the media.
During the investigation of a computer crime, audit trails can be very useful. To ensure that the audit information can be used as evidence, certain procedures must be followed. Which of the following is NOT one of these procedures?
A. Mechanisms should be in place to protect the integrity of the audit trail information.
B. The audit trail information must be used during the normal course of business.
C. There must be a valid organizational security policy in place and in use that defines the use of the audit information.
D. Audit trails should be viewed prior to the image backup.
Answer: D
Explanation: The image backup should be done first in order not to modify any information on the hard disk. For example, the authentication process applied to a hard disk can change the time of last access information on files. Thus, authentication should be applied to a disk image copy.
What does an audit trail or access log usually NOT record?
A. How often a diskette was formatted
B. Whether the attempt was successful
C. The date and time of the access attempt
D. Who attempted access
Answer: A
Explanation: The correct answer is how often a diskette was formatted. The other three answers are common elements of an access log or audit trail.
Under Civil Law, the victim is NOT entitled to which of the following types of damages? A. Compensatory B. Punitive C. Statutory D. Imprisonment of the offender
Answer: D
Explanation: Imprisonment or probation is not a type of punishment available for conviction of a civil crime. Answer a refers to awards set by law. Answer b, punitive damages, are usually determined by the jury and are intended to punish the offender. Compensatory awards are used to provide restitution and compensate the victim for such items as costs of investigations and attorneys fees.
Which of the following is NOT the proper suppression medium for a Class B fire? A. Halon B. Water C. Soda Acid D. CO2
Answer: B Explanation: The correct answer is Water. Water is not a proper suppression medium for a class B fire. The other three are commonly used.
A surge can be defined as a(n): A. Momentary power loss B. Steady interfering disturbance C. Prolonged high voltage D. Initial surge of power at start
Answer: C
Explanation: The correct answer is “Prolonged high voltage”. Answer “initial surge of power at start” or power on, is called an inrush. Momentary power loss is a fault. A steady interfering disturbance, is called noise.
In order for evidence to be admissible in a court of law, it must be relevant, legally permissible, reliable, properly identified, and properly preserved. Reliability of evidence means that:
A. It must tend to prove a material fact; the evidence is related to the crime in that it shows that the crime has been committed, can provide information describing the crime, can provide information as to the perpetrators motives, can verify what had occurred, and so on.
B. The evidence is identified without changing or damaging the evidence.
C. The evidence is not subject to damage or destruction.
D. The evidence has not been tampered with or modified.
Answer: D
Explanation: This requirement is a critical issue with computer evidence since computer data may be easily modified without having an indication that a change has taken place. Answer a defines the relevancy of evidence, answer b describes the identification of evidence, and answer d describes the preservation of evidence.
Because of the nature of information that is stored on the computer, the investigation and prosecution of computer criminal cases have specific characteristics, one of which is:
A. The information is intangible.
B. The investigation does not usually interfere with the normal conduct of the business of an organization.
C. Evidence is usually easy to gather.
D. Investigators and prosecutors have a longer time frame for the investigation.
Answer: A
Explanation: The information is stored in memory on the computer and is intangible as opposed to a physical object. Answer a is incorrect since investigators and prosecutors are under time pressure to gather evidence and proceed to prosecution. If the suspect is alerted, he or she may do damage to the system or destroy important evidencE . Search warrants may have to be obtained by law enforcement to search the suspects home and workplace and seize computers and disks. Answer c is incorrect since an investigation will interfere with the normal conduct of business. Some of the ways in which an investigation may affect an organization are: The organization will have to provide experts to work with law enforcement. Information key to the criminal investigation may be co-resident on the same computer system as information critical to the dayto - day operation of the organization. Proprietary data may be subject to disclosure. Management may be exposed if they have not exercised Due Care to protect information resources. There may be negative publicity that will be harmful to the organization. Answer d is incorrect. Evidence is difficult to gather since it is intangible and easily subject to modification or destruction.
It is estimated that the Asia/Pacific region accounts for about $4 billion worth of loss of income to software publishers due to software piracy. As with the Internet, cross-jurisdictional law enforcement issues make
investigating and prosecuting such crime difficult. Which of the following items is NOT an issue in stopping overseas software piracy?
A. Lack of a central, nongovernmental organization to address the issue of software piracy.
B. Obtaining the cooperation of foreign law enforcement agencies and foreign governments.
C. The producers of the illegal copies of software are dealing in larger and larger quantities, resulting in faster deliveries of illicit software.
D. The quality of the illegal copies of the software is improving, making it more difficult for purchasers to differentiate between legal and illegal products.
Answer: A Explanation: The Business Software Alliance (BSA) is a nongovernmental antisoftware piracy organization (www.bsa.org). The mission statement of the BSA is: The Business Software Alliance is an international organization representing leading software and e-commerce developers in 65 countries around the worlD . Established in 1988, BSA has offices in the United States , Europe , and Asia . . . . Our efforts include educating computer users about software copyrights; advocating public policy that fosters innovation and expands trade opportunities; and fighting software piracy.
The proposed HIPAA Security Rule mandates the protection of the
confidentiality, integrity, and availability of protected health
information (PHI) through three of the following activities. Which of the activities is NOT included under the proposed HIPAA Security Rule?
A. Technical services and mechanisms
B. Physical safeguards
C. Administrative procedures
D. Appointment of a Privacy Officer
Answer: D
Explanation: HIPAA separates the activities of Security and Privacy. HIPAA Security is mandated under the main categories listed in answers a, b, and C. The proposed HIPAA Security Rule mandates the appointment of a Security Officer. The HIPAA Privacy Rule mandates the appointment of a Privacy Officer. HIPAA Privacy covers individually identifiable health care information transmitted, stored in electronic or paper or oral form. PHI may not be disclosed except for the following reasons: Disclosure is approved by the individual Permitted by the legislation For treatment Payment Health care operations As required by law Protected Health Information (PHI) is individually identifiable health information that is: Transmitted by electronic media Maintained in any medium described in the definition of electronic media [under HIPAA] Transmitted or maintained in any other form or medium
Which is NOT considered a physical intrusion detection method? A. Wave pattern motion detector B. Audio motion detector C. Photoelectric sensor D. Line supervision
Answer: D
Explanation: Line supervision is the monitoring of the alarm signaling transmission medium to detect tampering. Audio detectors monitor a room for any abnormal sound wave generation.
Photoelectric sensors receive a beam of light from a light-emitting device. Wave pattern motion detectors generate a wave pattern and send an alarm if the pattern is disturbed.
The definition A mark used in the sale or advertising of services to identify the services of one person and distinguish them from the services of others refers to a: A. Trade name B. Trademark C. Service mark D. Copyright
Answer: C
Explanation: For answer “a trademark” is a distinctive mark of authenticity, through which the products of particular manufacturers or the vendible commodities of particular merchants may be distinguished from those of others. Answer “a trade name” is any designation which is adopted and used by a person to denominate goods which he markets, or services which he renders or business which he conducts. A trade name is descriptive of a manufacturer or dealer and applies to business and goodwill. A trademark is applicable only to vendible commodities. In answer “a copyright “is an intangible, incorporeal right granted by statute to the author or originator of certain literary or artistic productions, whereby he is invested, for a statutorily prescribed period, with the sole and exclusive privilege of multiplying copies of the same and publishing and selling them. (These definitions were also taken from Blacks Law Dictionary, Abridged Fifth Edition, West Publishing Company, St. Paul Minnesota , 1983.)
In the context of legal proceedings and trial practice, discovery refers to:
A. The process in which the prosecution presents information it has uncovered to the defense, including potential witnesses, reports resulting from the investigation, evidence, and so on
B. The process undertaken by the investigators to acquire evidence needed for prosecution of a case
C. The process of obtaining information on potential and existing employees using background checks
D. A step in the computer forensic process
Answer: A
Explanation: The key words are legal proceedings and trial practice. Information and property obtained in the investigation by law enforcement officials must be turned over to the defense. For some information that is proprietary to an organization, restrictions can be placed on who has access to the data. The other answers are forms of the investigative process. During an investigation, answers “The process undertaken by the investigators to acquire evidence needed for prosecution of a case” and “A step in the computer forensic process” are appropriate definitions of discovery.
Which of the following is NOT a goal of the Kennedy-Kassebaum Health Insurance Portability and Accountability Act (HIPAA) of 1996?
A. Provide for restricted access by the patient to personal healthcare information
B. Enable the portability of health insurance
C. Establish strong penalties for healthcare fraud D. Administrative simplification
Answer: A
Explanation: HIPAA is designed to provide for greater access by the patient to personal healthcare information. In answer b, administrative simplification, the goal is to improve the efficiency and effectiveness of the healthcare system by: Standardizing the exchange of administrative and financial data Protecting the security and privacy of individually identifiable health information Answers c and d are self-explanatory.
Which medium below is the most sensitive to damage from temperature? A. Computer hardware B. Sheet rock C. Floppy diskettes D. Paper products
Answer: C
Explanation: Of the four choices, magnetic media is the most sensitive to damage from heat, smoke, water, and humidity
Which of the following is an example of a smart card? A. A bank ATM card B. A library card C. An employee photo ID D. A drivers license
Answer: A
Explanation: The correct answer is “A bank ATM card”. The other three cards are dumb cards because it is assumed that they contain no electronics, magnetic stripes, or integrated circuits.
Which is NOT an element of two-factor authentication? A. Something you are B. Something you have C. Something you know D. Something you ate
Answer: D
Explanation:
