IS4670 CHAPTER 1 System Forensics Fundamentals

Question 1

1. To which domains of a typical IT infrastructure does system forensics apply?
A. User Domain 
B. Workstation Domain 
C. LAN Domain 
D. WAN Domain 
E. Remote Access Domain 
F. All of the above

Answer 1

All are correct

Question 2

2. A computer can play one of three roles in a computer crime: It can be the target of the crime, it can be the instrument of the crime, or it can serve as an evidence repository that stores valuable information about the crime.
   A. True
   B. False

Answer 2

True

Question 3

3. When people try to destroy incriminating evidence contained on a computer, they leave behind vital ________ .

Answer 3

Clues

Question 4

4. System forensics is the same as data recovery.
   A. True
   B. False

Answer 4

False

Question 5

5. A system forensics professional should be able to successfully perform complex evidence recovery procedures. Which of the following tasks should such a specialist be able to perform? (Select three.)
A. Expert witness services 
B. Data recovery 
C. Data dump 
D. Document searches

Answer 5

Expert witness services

Data recovery

Document searches

Question 6

6. Which of the following is not an important characteristic of a forensic specialist?
   A. A sound knowledge of computing
   B. Careful methodology of approach
   C. Law degree
   D. Access to and skill in the use of appropriate utilities

Answer 6

Law degree

Question 7

7. Which of the following refers to anything that changes or destroys digital evidence between the time the evidence is created and when the case goes to court?
A. Disk forensics 
B. Evidence dynamics 
C. Spoliation 
D. Live system forensics

Answer 7

Evidence dynamics

Question 8

8. Which of the following is not a broad test that should be applied to forensic evidence?
   A. Fairness
   B. Authenticity
   C. Reliability
   D. Completeness
   E. Freedom from interference and contamination

Answer 8

Fairness

Question 9

9. The system forensics specialty that involves acquiring and analyzing data stored on physical storage media, such as computer hard drives and removable media is called ________.

Answer 9

Disk forensics

Question 10

10. ________ is an area of system forensics that is used to search memory in real time, typically for working with compromised hosts or to identify system abuse.

Answer 10

Live system forensics

Question 11

11. ________ is an area of system forensics that is most often used to examine malicious code.

Answer 11

Software forensics