FI Quiz 1

Consider a scenario where a forensic investigator is performing malware analysis on a memory dump acquired from a victim’s computer. The investigator uses Volatility Framework to analyze RAM contents; which plugin helps investigator to identify hidden processes or injected code/DLL in the memory dump?

• Mallist

• Malfind

• Pslist

• Malscan

Chloe is a forensic examiner who is currently cracking hashed passwords for a crucial mission and hopefully solve the case. She is using a lookup table used for recovering a plain text password from cipher text; it contains word list and brute-force list along with their computed hash values. Chloe is also using a graphical generator that supports SHA1. What password technique is being used?

• Rainbow Tables / Winrtgen

• Brute-force / MScache

• Dictionary attack / Cisco PIX

•   Cain & Able / Rten

Which of the following statements is true regarding SMTP Server?

• SMTP server breaks the recipient's address into recipient's name and his/her designation before passing it to the DNS server

• SMTP server breaks the recipient's address into recipient's name and domain name before passing it to the DNS server

• SMTP server breaks the recipient's address into recipient's name and recipient's address before passing it to the DNS server

• SMTP server breaks the recipient's address into recipient's name and his/her initial before passing it to the DNS server

Storage location of Recycle Bin for NTFS file systems (Windows Vista and later) is located at:

• Drive:\$Recycle.Bin

• Drive:\RECYCLER

• Drive:\REYCLED

• Drive:\RECYCLE.BIN

"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court.” Which ACPO principle states this?

• Principle 2

• Principle 3

• Principle 1

• Principle 4

Which among the following acts has been passed by the U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?

• Federal Information Security Management act of 2002

• Gramm-Leach-Bliley act

• Health Insurance Probability and Accountability act of 1996

• Sarbanes-Oxley act of 2002

Cybercriminals sometimes use compromised computers to commit other crimes, which may involve using computers or networks to spread malware or illegal information. Which type of cybercrime stops users from using a device or network, or prevents a company from providing a software service to its customers?

• Ransomware attack

• Malware attack

• Denial-of-Service (DoS) attack

• Phishing

Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to instructions written in assembly language. Which tool should he use for this purpose?

• Ollydbg

• HashCalc

• BinText

• Oledump

Which Federal Rule of Evidence speaks about the Hearsay exception where the availability of the declarant is immaterial and certain characteristics of the declarant such as present sense impression, excited utterance, and recorded recollection are also observed while giving their testimony?

• Rule 803

• Rule 801

• Rule 802

• Rule 804

Brian has the job of analyzing malware for a software security company. Brian has setup a virtual environment that includes virtual machines running various versions of OSes. Additionally, Brian has setup separated virtual networks within this environment. The virtual environment does not connect to the company’s intranet nor does it connect to the external Internet. With everything setup, Brian now received an executable file from client that has undergone a cyberattack. Brian ran the executable file in the virtual environment to see what it would do. What type of analysis did Brian perform?

• Dynamic malware analysis

• Status malware analysis

• Static OS analysis

• Static malware analysis