QUIZ 03 CS211

Which of the following best distinguishes data erasure from data remanence?

• Erasure ensures data is unrecoverable, while remanence refers to residual recoverable traces.

• Both guarantee permanent data deletion.

• Erasure only applies to cloud data, while remanence applies to physical drives.

• Remanence encrypts the data, while erasure deletes encryption keys.

A company uses incremental backups daily and a full backup weekly. If Wednesday's incremental is lost, restoring data requires:

• Only the last full backup

• The last full backup and Wednesday's incremental

• The last full backup and all incrementals except Wednesday's

• Re-running the entire backup chain from scratch

Which scenario best demonstrates data masking rather than encryption?

• Storing customer credit card numbers as hashes in a database

• Showing only the last 4 digits of a credit card on an e-commerce site

• Encrypting all employee emails with TLS

• Encrypting patient records in a hospital database

Which attack directly exploits the ARP protocol's trust model?

• Evil Twin Attack

• ARP Spoofing

• Bluejacking

• Wi-Fi Jamming

In an RBAC (Role-Based Access Control) model, access permissions are primarily based on:

• Ownership of resources

• Central security labels assigned to files

• The role assigned to a user within an organization

• Dynamic behavior of processes

Which OS security feature makes return address overwrite attacks significantly harder to exploit?

• Stack Canaries

• File ACLs

• BitLocker

• Reference Monitor

During digital forensic acquisition, why must investigators use write blockers?

• To speed up the copying process

• To prevent accidental modification of original evidence

• To increase the storage size of acquired media

• To encrypt evidence before analysis

Which condition would cause a False Negative (FN) in a SIEM system?

• An admin's normal login flagged as suspicious

• A zero-day attack not matching any detection rule

• A phishing email wrongly classified as safe traffic

• A DoS alert triggered by heavy but legitimate traffic

Which feature differentiates Mandatory Access Control (MAC) from Discretionary Access Control (DAC)?

• In MAC, only system administrators set access policies, not users.

• In DAC, permissions are based on labels, while MAC uses ownership.

• DAC is stricter and tamper-proof, unlike MAC.

• MAC allows users to override policy rules.

Which forensic concept ensures admissibility of evidence in court?

• Data remanence

• Chain of custody

• Data sanitization

• Digital imaging