Question 1

Examination of digital evidence includes (but is not limited to) which of the following activities?

Accepted Answer

A)   Seizure, preservation, and documentation
B)   Recovery, harvesting, and reduction
C)   Experimentation, fusion, and correlation
D)   Arrest, interviewing, and trial B

Question 2

Preservation of digital evidence can involve which of the following?

Accepted Answer

A)   Collecting computer hardware
B)   Making a forensic image of storage media
C)   Copying the files that are needed from storage media
D)   All of the above D

Question 3

When a website is under investigation, before obtaining authorization to seize the systems it is necessary to:

Accepted Answer

A)   Determine where the web servers are located
B)   Inform personnel at the web server location that you'll be coming to seize the systems
C)   Conduct a reconnaissance probe of the target website
D)   None of the above A

Question 4

Occasionally, an intrusion detection system may trigger an alarm caused by an innocent packet that coincidentally contains intrusion class characteristics. This type of alert is called:

Accepted Answer

A)   False warning
B)   Failsafe
C)   DEF con
D)   False positive

Question 5

Although it was not designed with evidence collection in mind, can still be useful for examining network traffic.

Accepted Answer

A)   EnCase
B)   FTK
C)   Wireshark
D)   CHKDSK

Question 6

What are the limitations of the message digest of digital evidence?

Accepted Answer

The answer of What are the limitations of the message...

Question 7

If you are investigating a homicide and, while executing a search warrant, you find a computer in the suspect's home that appears to contain child pornography, what would you do?

Accepted Answer

The answer of If you are investigating a homicide and,...

Question 8

Different types of analysis include which of the following?

Accepted Answer

A)   Relational (e.g., link analysis)  and temporal (e.g., timeline analysis) 
B)   Cryptography
C)   Metadata hashing
D)   Digital photography

Question 9

No two files can have the same MD5 value.

Accepted Answer

A) True 
 B)False

Question 10

A forensic image of a drive preserves which of the following?

Accepted Answer

A)   Memory contents
B)   File slack and unallocated space
C)   System date and time
D)   Screen contents

Question 11

All forensic tools acquire digital evidence from storage media in the same way.

Accepted Answer

A) True 
 B)False

Question 12

Digital investigators should remember that evidence can reside in unexpected places, such as network routers.

Accepted Answer

A) True 
 B)False

Question 13

When drawing up an affidavit for a warrant, it is important to specifically mention all desired digital evidence.

Accepted Answer

A) True 
 B)False

Question 14

What does a digital signature tell you?

Accepted Answer

The answer of What does a digital signature tell you?...

Question 15

Chain of custody enables anyone to determine where a piece of evidence has been, who handled it when, and what was done to it since it was seized.

Accepted Answer

A) True 
 B)False

Question 16

Other than verifying the integrity of a file, how can the MD5 value of a file be useful?

Accepted Answer

The answer of Other than verifying the integrity of a...

Question 17

Issues to be aware of when connecting to a computer over a network and collecting information include:

Accepted Answer

A)   Creating and following a set of standard operating procedures
B)   Keeping a log of actions taken during the collection process
C)   Documenting which server actually contains the data that's being collected
D)   All of the above

Question 18

It is not necessary to sanitize/wipe a hard drive purchased directly from a manufacturer.

Accepted Answer

A) True 
 B)False

Question 19

When a computer contains digital evidence, it is always advisable to turn it off immediately.

Accepted Answer

A) True 
 B)False

Question 20

Which of the following are situations where a bitstream copy may not be viable?

Accepted Answer

A)   The hard drive is too large to copy.
B)   The system cannot be shut down.
C)   The digital investigator does not have authority to copy the entire drive.
D)   All of the above.

Exam 22: Applying Forensic Science to Networks

Examination of digital evidence includes (but is not limited to) which of the following activities?

Preservation of digital evidence can involve which of the following?

When a website is under investigation, before obtaining authorization to seize the systems it is necessary to:

Occasionally, an intrusion detection system may trigger an alarm caused by an innocent packet that coincidentally contains intrusion class characteristics. This type of alert is called:

Although it was not designed with evidence collection in mind, can still be useful for examining network traffic.

What are the limitations of the message digest of digital evidence?

If you are investigating a homicide and, while executing a search warrant, you find a computer in the suspect's home that appears to contain child pornography, what would you do?

Different types of analysis include which of the following?

No two files can have the same MD5 value.

A forensic image of a drive preserves which of the following?

All forensic tools acquire digital evidence from storage media in the same way.

Digital investigators should remember that evidence can reside in unexpected places, such as network routers.

When drawing up an affidavit for a warrant, it is important to specifically mention all desired digital evidence.

What does a digital signature tell you?

Chain of custody enables anyone to determine where a piece of evidence has been, who handled it when, and what was done to it since it was seized.

Other than verifying the integrity of a file, how can the MD5 value of a file be useful?

Issues to be aware of when connecting to a computer over a network and collecting information include:

It is not necessary to sanitize/wipe a hard drive purchased directly from a manufacturer.

When a computer contains digital evidence, it is always advisable to turn it off immediately.

Which of the following are situations where a bitstream copy may not be viable?