NEW
Font size
S
M
L
XL
WorksheetsCHFI Prep
Total questions: 75
Worksheet time: 55mins
Name
Class
Date
1.
Sniffers that place NICs in prpmiscuous mode work at what layer of the OSI model?
a)
Session
b)
Network
c)
Transport
d)
Physical
2.
Which list contains the most recent actions performed by a Windows User?
a)
Windows Error Log
b)
Activity
c)
MRU
d)
Recents
3.
Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?
a)
Eudora
b)
Microsoft Outlook Express
c)
Microsoft Outlook
d)
Mozilla Thunderbird
4.
A small law firm located in the Midwest has possibly been breached by a computer hacker who was looking to obtain information on their clientele. The law firm does not have any on-site IT employees but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?
a)
Searching for evidence themselves would not have any ill effects
b)
Searching create cache files that would hinder the investigation
c)
Searching could possibly crash the machine or device
d)
Searching can change date/time stamps
5.
The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?
a)
INFO1
b)
INFO2
c)
LOGINFO2
d)
LOGINFO1
6.
Stephen is checking an image using Compare Files by The Wizard, and he sees the file signature is shown as FF D8 FF El. What is the file type of the image?
a)
Gif
b)
Bmp
c)
Png
d)
Jpeg
7.
Which rule requires an original to be provided to prove the content of a recording?
a)
1003
b)
1004
c)
1005
d)
1002
8.
What technique is used by JPEGs for compression?
a)
TCD
b)
DCT
c)
ZIP
d)
TIFF-8
9.
Which password cracking technique uses details such as length of the password, character sets used to construct the password, etc.?
a)
Brute force attack
b)
Man in the middle attack
c)
Rule-based attack
d)
Dictionary attack
10.
Which of the following setups should a tester choose to analyze malware behavior?
a)
A virtual system network simulation for internet connection
b)
A normal system with connection
c)
A virtual system with internet connection
d)
A normal system without internet connection
11.
Which of the following attack uses HTML tags like <script><script>?
a)
SQL Injection
b)
Spam
c)
XSS attack
d)
Phising
12.
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages (instead of the sender's address)?
a)
Mime-Version header
b)
Content-Type header
c)
Errors-To header
d)
Content-Transfer-Encoding header
13.
Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?
a)
Media services
b)
Core Services
c)
Cocoa Touch
d)
Core OS
14.
Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?
a)
Net file
b)
Net share
c)
Net config
d)
Net sessions
15.
Andie, a network administrator, suspects unusual network services running on a Windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?
a)
net start
b)
lusrmgr
c)
net serv
d)
netmgr
16.
Which principle states that "anyone or anything, entering a crime scene takes something of the scene with them, and leaves something of themselves behind when they leave"?
a)
Locard's Evidence Principle
b)
Evidence Theory of Investigation
c)
Enterprise Theory of Ivestigation
d)
Locard's Exchange Principle
17.
Which of the following file system uses Master File Table (MFT) database to store information about every file and directory on a volume?
a)
exFAT
b)
ReFS
c)
FAT File System
d)
NTFS File System
18.
Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.
a)
Slacker
b)
RUneFS
c)
Waffen FS
d)
FragFS
19.
Which of the following files stores information about a local Google Drive installation such as User email ID, Local Sync Root Path, and Client version installed?
a)
config.db
b)
sigstore.db
c)
filecache.db
d)
Sync_config.db
20.
Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?
a)
Cross-platform correlation
b)
Network-platform correlation
c)
Multiple-platform correlation
d)
Same-platform correlation
21.
What does the command "C:\>wevtutil gl <log name>" display?
a)
Event logs are saved in .xml format
b)
Event Log Event log record structure
c)
Configuration information of a spesific
d)
List of available Event Logs
22.
What does the 56.58.152.114(445) denote in a Cisco router log? Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084) -> 56.58.152.114(445), 1 packet
a)
Destination IP address
b)
Source IP address
c)
Login IP address
d)
None of these
23.
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?
a)
Equipment Identity Register (EIR)
b)
Integrated circuit card identifier (ICCID)
c)
International mobile subscriber identity (IMSI)
d)
International Mobile Equipment Identifier (IMEI)
24.
Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.
a)
Statement of personal orfamily history
b)
Statement under belief of Impending death
c)
Statement against interest
d)
Prior statement by witness
25.
Casey has required data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?
a)
Proprietary Format
b)
Portable Document Format
c)
Advance Forensics Format (AFF)
d)
Raw Format
26.
UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?
a)
GUI D Partition Table (GPT)
b)
BIOS Parameter Block
c)
Master Boot Record (MBR)
d)
BIOS-MBR
27.
John is extracting volatile data from a system and uses the command doskey /history. What is he trying to extract?
a)
Password used across the system
b)
Event history
c)
History of the browser
d)
Previously typed commands
28.
During an investigation of an XSS attack, the investigator comes across the term "[a-zA-Z0-9\%]+" in analyzed evidence details. What is the expression used for?
a)
Checks for opening angle bracket, its hex or double-encoded hex equivalent
b)
Checks for forward slash used in HTML closing tags, its hex or double-encoded hex equivalent
c)
Checks for closing angle bracket, hex or double-encoded hex equivalent
d)
Checks for upper and lower-case alphanumeric string inside the tag, or its hex representation
29.
Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."
a)
Man-in-the-Middle Attack
b)
DdoS
c)
Buffer Overflow
d)
Sniffer Attack
30.
Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?
a)
Email spamming
b)
Phishing
c)
Mail bombing
d)
Email spoofing
31.
Daren, a forensics investigator, is trying to extract complete information about running processes from a system. Where should he look apart from the RAM and virtual memory?
a)
Swap space.
b)
Slack space
c)
Application data
d)
Files and documents
32.
Ron, a computer forensics expert, is investigating a case involving corporate espionage. He has recovered several mobile computing devices from the crime scene. One of the evidence that Ron possesses is a mobile phone from Nokia that was left in ON condition. Ron needs to recover the IMEI number of the device to establish the identity of the device owner. Which of the following key combinations can he use to recover the IMEI number?
a)
#*06*#
b)
#06#*
c)
*#06#
d)
*IMEI#
33.
Which of the following tool can reverse machine code to assembly language?
a)
RAM Capturer
b)
PEiD
c)
Deep Log Analyzer
d)
IDA Pro
34.
Centralized binary logging is a process in which many websites write binary and unformatted log data to a single log file. What extension should the investigator look to find its log file?
a)
.txt
b)
.lbl
c)
.log
d)
.cbl
35.
What malware analysis operation can the investigator perform using the jv16 tool?
a)
Registry Analysis/Monitoring
b)
Files and Folder Monitor
c)
Network Traffic Monitoring/Analysis
d)
Installation Monitor
36.
Katty is on trial for allegedly breaking into her university's internal network. The police raided her dorm room and seized all of her computer equipment. Madison's lawyer is trying to convince the judge that the seizure was unfounded and baseless. Under which US Amendment is Madison's lawyer trying to prove the police violated?
a)
The 10th Amendment
b)
The 1st Amendment
c)
The 4th Amendment
d)
The 5th Amendment
37.
Graphics Interchange Format (GIF) is a _____ RGB bitmap image format for images with up to 256 distinct colors per frame.
a)
16-bit
b)
24-bit
c)
8-bit
d)
32-bit
38.
While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?
a)
Windows 7
b)
Windows 10
c)
Windows 8
d)
Windows 8.1
39.
What malware analysis operation can the investigator perform using the jv16 tool?
a)
Registry Analysis/Monitoring
b)
Files and Folder Monitor
c)
Network Traffic Monitoring/Analysis
d)
Installation Monitor
40.
Which of the following commands shows you all of the network services running on Windows-based servers?
a)
Net start
b)
Net use
c)
Net Session
d)
Net config
41.
Which of the following ISO standard defines file systems and protocol for exchanging data between optical disks?
a)
IEC 3490
b)
ISO/IEC 13940
c)
ISO 9060
d)
ISO 9660
42.
One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?
a)
The file footer
b)
The sector map
c)
The file header
d)
The File Allocation Table
43.
After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?
a)
PUB.EDB
b)
PUB.STM
c)
PRIV.STM
d)
PRIV.EDB
44.
In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?
a)
RAID 0
b)
RAID 1
c)
The images will always be identical because data is mirrored for redundancy
d)
It will always be different
45.
Joshua is analyzing an MSSQL database for finding the attack evidence and other details, where should he look for the database logs?
a)
Model.log
b)
Model.ldf
c)
Model.txt
d)
Model.lgf
46.
Which of the following tool enables data acquisition and duplication?
a)
Colasoft's Capsa
b)
Xplico
c)
Wireshark
d)
DriveSpy
47.
An expert witness is a ____________ who is normally appointed by a party to assist in the formulation and preparation of a party's claim or defense.
a)
Expert law graduate appointed by attorney
b)
Subject matter specialist
c)
Witness present at the crime scene
d)
Expert in criminal investigation
48.
Besty, a computer forensics apprentice, uses the command nbtstat -c while analyzing the network information in a suspect system. What information is he looking for?
a)
Status of the network carrier
b)
Contents of the network routing table
c)
Network connections
d)
Contents of the NetBIOS name cache
49.
Which of the following is NOT a part of pre-investigation phase?
a)
Gathering evidence data
b)
Gathering information about the incident
c)
Creating an investigation team
d)
Building forensics workstation
50.
An investigator has extracted the device descriptor for a 1GB thumb drive that looks like: Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the "Geek_Squad" part represent?
a)
Developer description
b)
Manufacturer Details
c)
Software or OS used
d)
Product description
51.
Which one of the following is not a first response procedure?
a)
Crack passwords
b)
Take photos
c)
Preserve volatile data
d)
Fill forms
52.
When a user deletes a file or folder, the system stores complete path including the original filename in a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ________.
a)
Reboot Windows
b)
Use a recovery tool to undelete the file
c)
Download the file from Microsoft website
d)
Undo the last action performed on the system
53.
Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?
a)
Bit-by-bit Acquisition
b)
Bit-stream disk-to-disk Acquisition
c)
Static Acquisition
d)
Sparse or Logical Acquisition
54.
Hendric, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?
a)
Isolating the host device
b)
Installing malware analysis tools
c)
Enabling shared folders
d)
Using network simulation tools
55.
Which of the following tool is used to locate IP addresses?
a)
Towelroot
b)
Deep Log Analyzer
c)
SmartWhois
d)
XRY LOGICAL
56.
Which of the following is a tool to reset Windows admin password?
a)
TestDisk for Windows
b)
R-Studio
c)
Windows Data Recovery Software
d)
Windows Password Recovery Bootdisk
57.
Which among the following is an act passed by the U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations?
a)
GLBA
b)
FISMA
c)
SOX
d)
HIPAA
58.
Which file is a sequence of bytes organized into blocks understandable by the system's linker?
a)
source file
b)
Object file
c)
executable file
d)
None of these
59.
The surface of a hard disk consists of several concentric rings known as tracks; each of these tracks has smaller partitions called disk blocks. What is the size of each block?
a)
256 bits
b)
512 bytes
c)
512 bits
d)
256 bytes
60.
Jason is a computer forensics investigator with over 10 years of experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer frauD. What is the term used for Jacob's testimony in this case?
a)
Reiteration
b)
Authentication
c)
Justification
d)
Certification
61.
During forensics investigations, investigators tend to first collect the system time and then compare it with UTD. What does the abbreviation UTC stand for?
a)
Coordinated Universal Time
b)
Universal Time for Computers
c)
Correlated Universal Time
d)
Universal Computer Time
62.
What value of the 'Boot Record Signature' is used to indicate that the boot-loader exists?
a)
AA55
b)
00AA
c)
AA00
d)
A100
63.
Which MySQL log file contains information on server start and stop?
a)
Error log file
b)
Binary log
c)
Slow query log file
d)
General query log file
64.
What do you call the process in which an attacker uses magnetic field over the digital media device to delete any previously stored data?
a)
Disk cleaning
b)
Disk degaussing
c)
Disk magnetization
d)
Disk deletion
65.
Which of the following is a list of recently used programs or opened files?
a)
Recently Used Programs (RUP)
b)
GUID Partition Table (GPT)
c)
Master File Table (MFT)
d)
Most Recently Used (MRU)
66.
Microsoft Security IDs are available in Windows Registry Editor. The path to locate IDs in Windows 7 is:
a)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
b)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Regedit
c)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \ProfileList
d)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegList
67.
Which of the following tools is not a data acquisition hardware tool?
a)
Atola Insight Forensic
b)
UltraKit
c)
F-Response Imager
d)
Triage-Responder
68.
In which registry does the system store the Microsoft security Ids?
a)
HKEY_CURRENT_CONFIG (HKCC)
b)
HKEY_LOCAL_MACHINE (HKLM)
c)
HKEY_CLASSES_ROOT (HKCR)
d)
HKEY_CURRENT_USER (HKCU)
69.
Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?
a)
Witness Examination
b)
Cross Examination
c)
Direct Examination
d)
Indirect Examination
70.
Which of the following techniques can be used to beat steganography?
a)
Cryptanalysis
b)
Encryption
c)
Steganalysis
d)
Decryption
71.
NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:
a)
FAT does not index files
b)
NTFS has lower cluster size space
c)
FAT is an older and inefficient file system
d)
NTFS is a Journaling file system
72.
Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.
a)
DevScan
b)
Devcon
c)
Reg.exe
d)
Fsutil
73.
%3cscript%3ealert("XXXXXXXX")%3c/script%3e is a script obtained from a Cross-Site Scripting attack. What type of encoding has the attacker employed?
a)
Unicode
b)
Double encoding
c)
Base64
d)
Hex encoding
74.
What does the code 89 44 represent?
a)
Issuer Identifier Number and TAC
b)
Industry Identifier and Country code
c)
TAC and Industry Identifier
d)
Individual Account Identification Number and Country Code
75.
A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?
a)
/auth
b)
/var/log/debug
c)
/proc
d)
/var/spool/cron/
Reset
