Sniffers that place NICs in prpmiscuous mode work at what layer of the OSI model?

• Session
• Network
• Transport
• Physical

Which list contains the most recent actions performed by a Windows User?

• Windows Error Log
• Activity
• MRU
• Recents

Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?

• Eudora
• Microsoft Outlook Express
• Microsoft Outlook
• Mozilla Thunderbird

A small law firm located in the Midwest has possibly been breached by a computer hacker who was looking to obtain information on their clientele. The law firm does not have any on-site IT employees but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

• Searching for evidence themselves would not have any ill effects
• Searching create cache files that would hinder the investigation
• Searching could possibly crash the machine or device
• Searching can change date/time stamps

The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

• INFO1
• INFO2
• LOGINFO2
• LOGINFO1

Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF El. What is the file type of the image?

• Gif
• Bmp
• Png
• Jpeg

Which rule requires an original to be provided to prove the content of a recording?

• 1003
• 1004
• 1005
• 1002

What technique is used by JPEGs for compression?

• TCD
• DCT
• ZIP
• TIFF-8

Which password cracking technique uses details such as length of the password, character sets used to construct the password, etc.?

• Brute force attack
• Man in the middle attack
• Rule-based attack
• Dictionary attack

Which of the following setups should a tester choose to analyze malware behavior?

• A virtual system network simulation for internet connection

• A normal system with connection

• A virtual system with internet connection

• A normal system without internet connection