Free 312-49V9 Exam Dumps Preview

Computer forensics report provides detailed information on complete computer forensics investigation process. It should explain how the incident occurred, provide technical details of the incident and should be clear to understand.

Which of the following attributes of a forensics report can render it inadmissible in a court of law?

Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.

He runs the netstat command on the machine to see its current connections.
In the following screenshot, what do the 0.0.0.0 IP addresses signify?

When NTFS Is formatted, the format program assigns the __________ sectors to the boot sectors and to the bootstrap code

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

You have compromised a lower-level administrator account on an Active Directory network of a small company in Dallas, Texas. You discover Domain Controllers through enumeration. You connect to one of the Domain Controllers on port 389 using ldp.exe.

What are you trying to accomplish here?

Sectors in hard disks typically contain how many bytes?

What is a first sector ("sector zero") of a hard disk?

Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled.

Where could the investigator search to find the message tracking log file on the Exchange server?

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive.

Which of the following formats correctly specifies these sectors?

A steganographic file system is a method to store the files in a way that encrypts and hides the data without the knowledge of others

Law enforcement officers are conducting a legal search for which a valid warrant was obtained. While conducting the search, officers observe an item of evidence for an unrelated crime that was not included in the warrant. The item was clearly visible to the officers and immediately identified as evidence.

What is the term used to describe how this evidence is admissible?

Data acquisition system is a combination of tools or processes used to gather, analyze and record Information about some phenomenon. Different data acquisition system are used depends on the location, speed, cost. etc. Serial communication data acquisition system is used when the actual location of the data is at some distance from the computer.

Which of the following communication standard is used in serial communication data acquisition system?

You are conducting an investigation of fraudulent claims in an insurance company that involves complex text searches through large numbers of documents.

Which of the following tools would allow you to quickly and efficiently search for a string within a file on the bitmap image of the target computer?

Daryl, a computer forensics investigator, has just arrived at the house of an alleged computer hacker. Daryl takes pictures and tags all computer and peripheral equipment found in the house. Daryl packs all the items found in his van and takes them back to his lab for further examination. At his lab, Michael his assistant helps him with the investigation. Since Michael is still in training, Daryl supervises all of his work very carefully. Michael is not quite sure about the procedures to copy all the data off the computer and peripheral devices.

How many data acquisition tools should Michael use when creating copies of the evidence for the investigation?

Your company's network just finished going through a SAS 70 audit. This audit reported that overall, your network is secure, but there are some areas that needs improvement. The major area was SNMP security.
The audit company recommended turning off SNMP, but that is not an option since you have so many remote nodes to keep track of.

What step could you take to help secure SNMP on your network?

What document does the screenshot represent?

All Blackberry email is eventually sent and received through what proprietary RIM-operated mechanism?

The following is a log file screenshot from a default installation of IIS 6.0.

What time standard is used by IIS as seen in the screenshot?

What must be obtained before an investigation is carried out at a location?

Smith, as a part his forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He unsuccessfully tried three PIN numbers that blocked the SIM card.

What Jason can do in this scenario to reset the PIN and access SIM data?

When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to _________

P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom of the recipient's account file, which can be retrieved by the email client at any preferred time. Email client connects to the POP3 server at _______________by default to fetch emails.

File deletion is a way of removing a file from a computer's file system.

What happens when a file is deleted in windows7?

You are assisting in the investigation of a possible Web Server hack. The company who called you stated that customers reported to them that whenever they entered the web address of the company in their browser, what they received was a pornographic web site. The company checked the web server and nothing appears wrong. When you type in the IP address of the web site in your browser everything appears normal.

What is the name of the attack that affects the DNS cache of the name resolution servers, resulting in those servers directing users to the wrong web site?

A system with a simple logging mechanism has not been given much attention during development, this system is now being targeted by attackers, if the attacker wants to perform a new line injection attack, what will he/she inject into the log file?

Digital evidence validation involves using a hashing algorithm utility to create a binary or hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file.

Which of the following hash algorithms produces a message digest that is 128 bits long?

The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle
Bin.

Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

Web applications provide an Interface between end users and web servers through a set of web pages that are generated at the server-end or contain script code to be executed dynamically within the client
Web browser.

Simon is a former employee of Trinitron XML Inc. He feels he was wrongly terminated and wants to hack into his former company's network. Since Simon remembers some of the server names, he attempts to run the axfr and ixfr commands using DIG.

What is Simon trying to accomplish here?

A law enforcement officer may only search for and seize criminal evidence with _______________________, which are facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed, evidence of the specific crime exists and the evidence of the specific crime exists at the place to be searched.

How often must a company keep log files for them to be admissible in a court of law?

Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/ usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

When investigating a network that uses DHCP to assign IP addresses, where would you look to determine which system (MAC address) had a specific IP address at a specific time?

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media

Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away. Eventually the wireless signal shows back up, but drops intermittently.

What could be Tyler issue with his home wireless network?

Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

An Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers.

Which of the following statement is true for NTP Stratum Levels?

Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set.

What is Terri trying to accomplish by sending this IP packet?

Which of the following is not correct when documenting an electronic crime scene?

John is working on his company policies and guidelines. The section he is currently working on covers
company documents; how they shouldJohn is working on his company? policies and guidelines. The
section he is currently working on covers company documents; how they should be handled, stored, and
eventually destroyed. John is concerned about the process whereby outdated documents are destroyed.

What type of shredder should John write in the guidelines to be used when destroying documents?

The status of the network interface cards (NICs) connected to a system gives information about whether the system is connected to a wireless access point and what IP address is being used.

Which command displays the network configuration of the NICs on the system?

Which Intrusion Detection System (IDS) usually produces the most false alarms due to the unpredictable behaviors of users and networks?

When cataloging digital evidence, the primary goal is to

You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour.

Why were these passwords cracked so Quickly?

What should you do when approached by a reporter about a case that you are working on or have worked on?

During the course of a corporate investigation, you find that an employee is committing a federal crime.
Can the employer file a criminal complain with the police?

When investigating a potential e-mail crime, what is your first step in the investigation?

When you are running a vulnerability scan on a network and the IDS cuts off your connection, what type of IDS is being used?

Digital evidence is not fragile in nature.

An on-site incident response team is called to investigate an alleged case of computer tampering within their company. Before proceeding with the investigation, the CEO informs them that the incident will be classified as ow level? How long will the team have to respond to the incident?the investigation, the CEO informs them that the incident will be classified as ?ow level?

How long will the team have to respond to the incident?

TCP/IP (Transmission Control Protocol/Internet Protocol) is a communication protocol used to connect different hosts in the Internet. It contains four layers, namely the network interface layer. Internet layer, transport layer, and application layer.

Which of the following protocols works under the transport layer of TCP/IP?

How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

Mobile phone forensics is the science of recovering digital evidence from a mobile phone under forensically sound conditions.

Ever-changing advancement or mobile devices increases the complexity of mobile device examinations.

Which or the following is an appropriate action for the mobile forensic investigation?

The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.

What type of attack sends spoofed UDP packets (instead of ping packets) with a fake source address to the IP broadcast address of a large network?

Jason, a renowned forensic investigator, is investigating a network attack that resulted in the compromise of several systems in a reputed multinational's network. He started Wireshark to capture the network traffic. Upon investigation, he found that the DNS packets travelling across the network belonged to a non-company configured IP.

Which of the following attack Jason can infer from his findings?

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain drawbacks.

Which of the following would that be?

If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are normally allocated to this file?

Windows Security Event Log contains records of login/logout activity or other security-related events specified by the system's audit policy.

What does event ID 531 in Windows Security Event Log indicates?

One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document.

What can an investigator examine to verify that a file has the correct extension?

Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?computer fraud. What is the term used for Jacob?
testimony in this case?

Area density refers to:

When investigating a Windows System, it is important to view the contents of the page or swap file because:

Shortcuts are the files with the extension .Ink that are created and are accessed by the users. These files provide you with information about:

Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive.

Which of the following statements is correct while dealing with local archives?

Which of the following statements is not a part of securing and evaluating electronic crime scene checklist?

JPEG is a commonly used method of compressing photographic Images. It uses a compression algorithm to minimize the size of the natural image, without affecting the quality of the image. The JPEG lossy algorithm divides the image in separate blocks of____________.

What is the smallest physical storage unit on a hard drive?

Paul's company is in the process of undergoing a complete security audit including logical and physical
security testing. After all logical tests were performed; it is now time for the physical round to begin. None
of the employees are made aware of this round of testing. The security-auditing firm sends in a technician dressed as an electrician. He waits outside in the lobby for some employees to get to work and follows behind them when they access the restricted areas. After entering the main office, he is able to get into the server room telling the IT manager that there is a problem with the outlets in that room.

What type of attack has the technician performed?