This is about obfuscating a message so that it cannot be read?

This calculation is used to calculate single loss expectency?

_______________ memory analysis is a live-system forensic technique in which you collect a memory dump and perform analysis in an isolated environment?

If the computer is turned on when you arrive, what does the Secret Service recommend you do?

Which of the following might contain data that was live in memory and not stored on the hard-drive?

What is the most important reason that you not touch the actual original evidence any more than you have to?

The MD5 message-digest algorithm is used to _____.

What Linux command helps you delete or remove a file?

Which below is a technique for file system repair that involves recovering data from a damaged partition with limited knowledge of the file system?

Spyware is legal?

Business Continuity Plan development depends most on:

What is the primary reason to take cyberstalking seriously?

Encrypting files/folders would be an example of:

Which of the following drives would be least susceptible to damage when dropped?

Which log file contains failed user logins?

What is the essence of the Daubert standard?

What file system does Windows 10 use?

RAID-____ is known as a MIRROR and is essentially two-hard drives with one being an identical copy of the other.

What Linux command can be used to wipe a target drive?

Evidence need not be locked if it is at a police station.

Which backup will backup all changes?

In Windows 10, the swap file ends with what extension?

Many forensic tools and software have the option to do a forensic wipe for you. This Linux command can also do that:

Which of the following is the Linux equivalent of a shortcut?

Once a incident has been detected, you should then:

Which of the following focuses on keeping the organization functioning as well as possible until a full recovery can be made?

ReFS is the newest file system for Windows. What has been the popular file system used by Windows for the last 10-20 years?

What file system does MAC OS use?

What type of attack results from an attacker sending specially crafted packets to a web server that cause it to crash?

Once an intrusion into your organizations information system has been detected, which of the following actions should be performed first?

Which is a common method for scoring system vulnerabilities?

It is legal for employers to monitor work computers?

Which of the following focuses on sustaining an organizations business functions during and after a disruption?

Damage to how data is stored, such as file system corruption, is known as:

Your roommate can give consent to search your computer.

Which backup will backup all changes since last full backup?

What is the most commonly used hashing algorithm?

Which of the following is an asymmetric cryptography algorithm invented by 3 mathematicians in the 1970s?

Deep Sound is a tool that allows you to:

Logic bombs are often perpetrated by:

Using "science and technology to investigate and establish facts in criminal or civil courts of law" is called:

Why can you undelete files in Windows 7?

What Windows Log is most-likely the most important log from a forensics point of view?

The art and science of writing hidden messages is known as:

Which of the following is an asymmetric cryptography algorithm invented by 3 mathematicians in the 1970s?

What type of encryption uses a different key to encrypt the message than it uses to decrypt the message?

Where would you seek evidence that ophcrack had been used on a Windows Server 2008 machine?

When cataloging digital evidence, the primary goal is to do what?

_____________ is commonly used name for a command-line utility that provides disk partitiioning functions in an operating system?

In a computer forensics investigation, describe the route that evidence takes from the time you find it until the case is closed or goes to court.

Why should you note all cable connections for a computer you want to seize as evidence?

When a Windows system books, the BIOS helps perform a:

_________________________is a process used in computer forensics to extract data from a drive without the assistance of the file system; perhaps because the file has become corrupted?

Which backup will backup all change since last backup of any type”

What Linux command lists the contents of the current directory?

Which of the following crimes is most likely to leave email evidence?

This is an attempt to trick a victim into giving up personal information?

RAID-____ combines three or more disks in a way that protects data against the loss of any one disk.

What is the most commonly used file system with Linux?

The use of analytical and investigative techniques to identify, collect, examine and preserve evidence is called:

This is the primary standard for Contingency Planning Guide for Information Technology System?

What is the purpose of hashing a copy of a suspect drive?

In steganography, the _________________ is the data to be covertly communicated. In other words, it is the message you want to hide.

What is the starting point for investigating denial of service attacks?

What kind of attack results from an attacker sending specially crafted packets to a web server to cause it to crash?

This holds passwords with precalculated hashses of all password?

It takes _____ occurrence(s) of overextending yourself during testimony to ruin your reputation.

How many HIVES are in the Windows Registry?

What assesses potential loss that could be caused by a disaster?

What Linux command can be used to create a hash?

When investigating a virus, what is the first step?

What do you call a list of people who have had physical possession of the evidence?

Hiding messages inside another medium is referred to as:

Which port below is associated with HTTPS?

Which type of attack involves an attackers sending a large amount of ICMP packets to a target in hopes to overwhelm it?

The synchronization bits in the TCP header can yield important information. Which below is a flag use to Reset a connection?

The Private Class B IP Range is:

The synchronization bits in the TCP header can yeild important information. Which flag generally indicates the communication is ended?

Which port below is associated with DNS?

What TYPE of firewall is most likely to prevent SYN Floods, where an attacker sends unlimited SYNchronize requests to a host system?

When using Volatility, this command can examine the registry and is probably the one most useful in examining DLL injection?

Which malware below is software that appears to have some legitimate purpose, but when executied a second payload of malware is delivered instead?

This command is very command and is used to list details of all services that were in memory when a memory dump is taken?

Which GUI program has a graphical user interface for Volatility and includes a Volatilty Workbench?

This table is a data structure that maps virtual addresses to physical addresses?

The _____________ is memory that programs can allocate as needed; it is not the organized automatically allocated memory area?

Which cloud technology applies to renting/using an entire network infrastructure that is virtulatized online?

Which cloud technology applies to the ability to access software as a service on demand through the cloud?

Which cloud technology applies to providing individual operating systems as a service so they can create programs and develop code?