CF Quiz 4

Data is striped at a byte level across multiple drives, and parity information is distributed among all member drives. What RAID level is represented here?

• RAID Level 0

• RAID Level 1

• RAID Level 5

• RAID Level 3

An investigator is checking a Cisco firewall log that reads as follows: Aug 21 2019 09:16:44: %ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on interface outside. What does %ASA-1-106021 denote?

• Type of request

• Mnemonic message

• Firewall action

• Type of traffic

A forensic examiner encounters a computer with a failed OS installation and the master boot record (MBR) or partition sector damaged. Which of the following tools can find and restore files and information in the disk?

• Wireshark

• Helix

• R-Studio

• NetCat

"To ensure that the digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effective quality system" is a principle established by:

• NCIS

• EC-Council

• NIST

• SWGDE

Jacob, a cybercrime investigator, joined a forensics team to participate in a criminal case involving digital evidence. After the investigator collected all the evidence and presents it to the court, the judge dropped the case and the defense attorney pressed charges against Jacob and the rest of the forensics team for unlawful search and seizure. What forensics privacy issue was not addressed prior to collecting the evidence?

• None of these

• Compliance with the Third Amendment of the U.S. Constitution

• Compliance with the Fourth Amendment of the U.S. Constitution

• Compliance with the Second Amendment of the U.S. Constitution

While collecting active transaction logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file. Here, what does assigning NULL values imply?

• Start and end points for log sequence numbers are zero

• Start and end points for log files are zero

• Start and end points for log sequence numbers are not specified

• Start and end points for log files are not specified

For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?

• General description of the evidence

• SSN of the person collecting the evidence

• Exact location the evidence was collected from

• Relevant circumstances surrounding the collection

Frank, a cloud administrator in his company, needs to take backup of the OS disks of two Azure VMs that store business-critical data. Which type of Azure blob storage can he use for this purpose?

• Append blob

• Medium blob

• Page blob

• Block blob

Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?

• Datagrab

• Helix Live

• Coreography

• Ethereal

Which of the following malware targets Android mobile devices and installs a backdoor that remotely installs applications from an attacker-controlled server?

• Felix

• Unflod

• xHelper

• XcodeGhost