Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CHFI > Targeted > Flashcards

Targeted Flashcards

1
Q

What allows for a lawful search to be conducted without a warrant or probable cause?

A

Consent of person with authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When is warrantless seizure of evidence justified?

A

When destruction of evidence is imminent and there is probable cause that the seized item is evidence of criminal activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When can an investigator collect evidence without formal consent?

A

When properly worded banners are displayed on a computer screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a web app threat in which the application unintentionally reveals sensitive information to an unauthorized user?

A

Information Leakage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of information can be found in a common metadata field for a file?

A

Network name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which registry key can be analyzed to retrieve folder information?

A

BagMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which registry key tracks files that have been opened or saved within a Windows shell dialog box?

A

OpenSaveMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which registry key may shed light on a user’s activity in a system and can indicate execution of a program or script on a device?

A

RunMRU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which file format is being viewed if the first hex characters are 42 4D?

A

BMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which file format is being viewed if the first hex characters are 47 49 46 38?

A

GIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which file format is being viewed if the first hex characters are 89 50 4e 47?

A

PNG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which file format is being viewed if the first hex characters are ff d8 ff?

A

JPEG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which file format is being viewed if the first hex characters are 25 50 44 46?

A

PDF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which file format is being viewed if the first hex characters are d0 cf 11 e0 a1 b1 1a e1?

A

XLS, DOC, or PPT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which file format is being viewed if the first hex characters are 50 4b 03 04 14 00 06 00?

A

XLSX, DOCX, or PPTX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which file format is being viewed if the first hex characters are 4e 42 2a 00?

A

JNT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which file format is being viewed if the first hex characters are 50 4b 03 04?

A

ZIP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which file format is being viewed if the first hex characters are 52 61 72 21 1a 07?

A

RAR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which file format is being viewed if the first hex characters are 30 26 b2 75 8e 66 cf 11?

A

WMV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which file format is being viewed if the first hex characters are 52 49 46 46?

A

AVI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which file format is being viewed if the first hex characters are 49 44 33 03?

A

MP3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which file format is being viewed if the first hex characters are 49 20 49?

A

TIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which software tool is designed strictly for maintaining the integrity of evidence during data acquisition?

A

SAFE Block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the difference between the NIST SP 800-88 recommended types of sanitization, clear, purge, and destroy?

A

clear: sanitizes media but does not guarantee infeasible recover. allows media reuse.
purge: sanitizes media and guarantees infeasible recovery. allows media reuse.
destroy: destroys media and guarantees infeasible recovery. media not reusable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 3 types of data files MSSQL server stores data and logs in?

A

Primary data files (MDF)
secondary data files (NDF)
transaction log data files (LDF)

26
Q

Which MySQL utility program is used to dump single or multiple databases for backup purposes?

A

Mysqldump

27
Q

Which MySQL utility program is used to check the access privileges defined for a hostname or username?

A

Mysqlaccess

28
Q

Which MySQL utility program is used to process the MyISAM log file and perform recovery operation, display version information, etc?

A

myisamlog

29
Q

Which MySQL utility program is used to obtain the status of the MyISAM table, identify the corrupted tables, repair the corrupted tables, etc.?

A

Myisamchk

30
Q

Which MySQL utility program is used to display the content of bin logs (mysql-bin.nnnnnn) in text format?

A

Mysqlbinlog

31
Q

Which MySQL utility program is used to export metadata, data, or both from one or more databases?

A

mysqldbexport

32
Q

What python-based tool can be used to analyze suspect MS Office Documents?

A

oleid

33
Q

What are the different types of logon events?

A

2: Interactive (user logged on)
3: Network (logged on from network)
4: Batch
5: Service (service started by service control manager)
7: Unlock
8: NetworkCleartext (logged on from network, PW passed unhashed)
9: NewCredentials (cloned current token and specified new credentials for outbound connections
10: RemoteInteractive (User logged on remotely)
11: CachedInteractive (user logged on with cached network credentials

34
Q

What are the two components of an Apache Web Server?

A

Apache Core: basic functionalities such as allocation of requests and connection maintenance
Apache Modules: Add-ons used for extending core functionality

35
Q

What are the elements of the Apache core component?

A

http_protocol: responsible for managing routines
http_main: handles server startup and timeouts as well as main server loop
http_request: controls stepwise procedure followed among modules to complete client request as well as error handling
http_core: Includes a header file thaht is not required by the app module
Alloc.c: handles allocation of resource pools
http_config: reads and handles configuration files and arranges the modules

36
Q

What are the two types of Apache Web Server logs?

A

Access log: records all requests processed by server

error log: diagnostic information and errors the server faced during requests

37
Q

Which program may be used to convert a dd image into a bootable VM?

A

QEMU disk image utility

38
Q

What TSK command is used to odisplay general details of a file system?

A

fsstat

39
Q

What TSK command is used to display the details of a metadata structure?

A

istat

40
Q

What TSK command is used to display the file and directory names in a disk?

A

fls

41
Q

What TSK command is used to display the details of an image file?

A

img_stat

42
Q

What is Windows Event ID 4688?

A

A new process has been created

43
Q

What is Windows Event ID 5156?

A

Windows Filtering Platform has allowed connection (outbound network connection)

44
Q

What is Windows Event ID 7045?

A

Service was installed in the system

45
Q

What is Windows Event ID 4657?

A

Registry value was modified

46
Q

What is Windows Event ID 4660?

A

Object was deleted (such as account name, domain, process ID, etc.)

47
Q

What is Windows Event ID 4663?

A

An attempt was made to access an object

48
Q

What is Windows Event ID 7036?

A

Windows Protection Service has entered the stopped state

49
Q

What is Windows Event ID 7040?

A

The start of Windows Protection Service was changed from autostart to demand start/auto start disabled

50
Q

Which utility may be used to acquire Mozilla Thunderbird data?

A

SysTools MailPro+

51
Q

What is the minimum Linux kernel version to support ext4?

A

2.6.19

52
Q

What is file carving?

A

technique to recover files and fragments of files from a hard disk in the absence of file system metadata

53
Q

What application should be used for file carving in Windows?

A

R-Studio, Autopsy, Recover My Files, Ease US Data Recovery Wizard, WinUndelete, R-Undelete

54
Q

What application should be used for file carving in Linux?

A

R-Studio, Mondo Rescue, Scalpel, Autopsy, Foremost, PhotoRec

55
Q

What application should be used for file carving in macOS?

A

AppleXsoft File Recovery, 321Soft Data Recovery, Disk Doctors, Disk Drill, R-Studio, Data Rescue 4, Mac Data Recovery Guru

56
Q

What is RAID 0?

A

Striping only, no redundancy. Min 2 drives

57
Q

What is RAID 1?

A

Mirroring only. Requires even number of drives

58
Q

What is RAID 2?

A

Bit-level striping. Better data-integrity, but slower than RAID 0

59
Q

What is RAID 3?

A

Byte-level striping and dedicated parity disk. Requires at least 3 drives

60
Q

What is RAID 5?

A

Byte-level striping and distributed parity among drives. Data writing is slow. Min 3 drives

61
Q

What is RAID 6?

A

Double parity RAID. Data striped across multiple drives and uses dual parity for better redundancy than RAID 5. Min 4 drives.

62
Q

What is RAID 10?

A

Combo of 0 and 1. Min 4 drives. Includes fault tolerance of RAID 1 and includes redundancy through mirroring

CHFI (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions