FRS301

Which of the following statements is incorrect when preserving digital evidence?

• Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

• Verily if the monitor is in on, off, or in sleep mode

• Remove the power cable depending on the power state of the computer i.e., in on-off, or in sleep mode

• Turn on the computer and extract Windows event viewer log files

Where is the Evidence?

• Servers

• Routers

• Firewalls

• Computers

• All of the other choices

What do you do for web security?

• Using backend and frontend

• Firewall application

• Loadbalancing

• All of mentioned

Which of the following is not a property of computer evidence?

• Authentic and Accurate

• Complete and Convincing

• Duplicated and Preserved

• Conform and Human Readable

• None of the other choices

How the police caught John Mcaffee at Guatemala?

• Because of his phone

• Because of his laptop

• Because of photo published on the Internet with GPS location metadata

• He took a photo with his friend

• None of the other choices

Where does the Linux store password?

• /etc/password

• /etc/passwd

• /etc/shadow

• /etc/shadows

What kind of threats that Insider ?

• Usb connect

• Sniffing

• Passwork attack

• Malware

• All of the other choices

Where does the computer store data when it switch to Hibernate mode?

• Hiberfil.log

• Hiberfil.dll

• Hiberfil.sys

• Hiberfil.exe

Which key of the following is the location for finding information about USBSTOR?

• HKey_Classes_Root-system

• HKey_Current_User - system

• HKey_Local_Machine - system

• HKey_Users – system

What is the cipher algorithm used to test integrity of clone evidences?

• DSA

• SHA

• AES

• WPA2

• 3DES