Penn Test

After Samuel forensically imaged a hard drive from a company's server as part of an investigation into a suspected data breach, which of the following actions should he perform FIRST to ensure the evidence is properly handled?

• Encrypt the source drive to ensure an attacker cannot modify its contents

• Create a hash digest of the source drive and the image file to ensure they match

• Digitally sign the image file to provide non-repudiation of the collection

• Encrypt the image file to ensure it maintains data integrity

Answer explanation

Creating a hash digest of the source drive and the image file is the first step to ensure data integrity and verify they match, maintaining the evidence's integrity.

Imagine Luna is monitoring a web application for a school project and notices some unusual data patterns. Which of the following tools could Luna use to detect this unexpected output from the application being managed or monitored?

• Manual analysis

• A behavior-based analysis tool

• A signature-based detection tool

• A log analysis tool

Answer explanation

Luna should use a behavior-based analysis tool to detect unexpected output as it focuses on identifying abnormal patterns in the data.

Imagine your company, led by Lily and Grace, processes payment information and must adhere to PCI-DSS standards. Anika, the security lead, discovers a data breach. What type of disclosure is required during the incident response?

• Notification to federal law enforcement

• Notification to your credit card processor

• Notification to local law enforcement

• Notification to Visa and Mastercard

Answer explanation

During a data breach incident response, notification to your credit card processor is required to adhere to PCI-DSS standards.

During a forensic investigation of a high-profile data breach at a multinational corporation, what information should be recorded on a chain of custody form?

• Any individual who worked with evidence during the investigation, including IT specialists like Ava and forensic analysts like Avery

• The law enforcement agent, such as Detective Sophia, who was first on the scene

• The list of individuals who made contact with files leading to the investigation, including employees and external consultants

• The list of former owners/operators of the workstation involved in the investigation, including previous employees and contractors

Answer explanation

The chain of custody form should record any individual who worked with evidence during the investigation, including IT specialists like Ava and forensic analysts like Avery.

Barbara received a phone call from a colleague asking why she sent him an email with lewd and unusual content. Barbara doesn't remember sending the email to the colleague. What is Barbara MOST likely the victim of?

• Ransomware

• Spear phishing

• Hijacked email

• Phishing

Answer explanation

Barbara is most likely the victim of a hijacked email because she doesn't remember sending the lewd email, indicating someone else gained unauthorized access to her email account.

Michael is tasked with enhancing the security measures of his company's website and decides to analyze its DNS records to better understand its network setup. In his analysis, he opts to use nslookup in interactive mode. Which command should he use to specifically request records for the name servers?

• request type=ns

• locate type=ns

• transfer type=ns

• set type=ns

Answer explanation

Olivia should use the 'set type=ns' command in nslookup interactive mode to specifically request records for the name servers.

During a high-security clearance process at a research facility, Michael is asked to authenticate his identity through a system that matches patterns on the eye's surface using near-infrared imaging. Which biometric authentication factor is being used?

• Facial recognition

• Iris scan

• Pupil dilation

• Retinal scan

Answer explanation

The correct biometric authentication factor being used in the scenario described is an Iris scan, which matches patterns on the eye's surface using near-infrared imaging.

An attacker recently compromised an e-commerce website for a clothing store. Which of the following methods did the attacker use to harvest an account's cached credentials when the user logged into an SSO system?

• Lateral movement

• Pivoting

• Golden ticket

• Pass the hash

Answer explanation

The attacker used 'Pass the hash' method to harvest an account's cached credentials when the user logged into an SSO system.

At a university, students like Scarlett, Avery, and Elijah are trying to connect to the campus Wi-Fi but appear to be unable to authenticate to the captive portal. Which of the following is the MOST likely cause of the issue?

• SSL certificates

• RADIUS

• CSMA/CA

• WPA2 security key

Answer explanation

The most likely cause of the issue is RADIUS authentication failure, which is commonly used for captive portal authentication in universities.

Liam, William, and Kai are part of the IT department at Dion Training. The company has recently adopted a BYOD policy, allowing employees to connect their personal devices to the company's wireless network. To ensure network security, the IT team has been tasked with creating a separate network for corporate devices and another for employee-owned devices. Which technology is most suitable for segmenting the corporate network into an administrative network and an untrusted network?

• VPN

• WPA2

• VLAN

• MAC filtering

Answer explanation

VLAN is the most suitable technology for segmenting the corporate network into an administrative network and an untrusted network.