NEW
Font size
Worksheets1-2-2 File Management.
Total questions: 60
Worksheet time: 2hrs 30mins
A cybersecurity analyst explains to new interns that everything stored or transferred within a computer system is ultimately represented as a file. What key takeaway does this illustrate?
Files are used only for documents and pictures
All data on a computer is stored and accessed as files
Files exist only when connected to the internet
Folders and files are interchangeable terms
During a lab exercise, a student creates a directory containing images and text documents. What characteristic distinguishes a folder from a standard file?
A folder executes applications automatically
A folder can store multiple files or other folders
A folder encrypts all contents by default
A folder cannot be renamed once created
While monitoring system performance, an analyst sees several entries listed as processes. Which statement best defines a process?
A compressed archive stored on disk
A file currently running in the operating system’s memory
A backup copy of a program
A deleted file awaiting recovery
An administrator explains that a SQL server stores multiple structured data tables accessed by network users. What does this example demonstrate?
A database hosted on a data server
A spreadsheet linked to a printer
A firewall managing traffic
A proxy cache
A security technician encrypts a spreadsheet before emailing it to management. Which security goal is being met?
Integrity
Availability
Confidentiality
Non-repudiation
A user searches for all Word documents by typing *docx instead of *.docx. Why does the query fail?
The wildcard is case-sensitive
The search lacks the period before the extension
The OS blocks wildcard searches
Hidden files override the command
An attacker renames virus.exe to invoice.txt. What security concern does this action create?
It compresses the file
It disguises the executable as harmless text
It deletes the code inside
It disables encryption
When double-clicking a .x1sx file, Excel automatically opens. What does this reveal about file extensions?
They indicate file size
They instruct the OS which program should process the file
They determine file ownership
They store encryption keys
A user notices that photo.jpg.exe launches an installer instead of an image viewer. What is the most likely explanation?
The file is corrupted
The executable is disguised as an image to trick users
The OS misread metadata
It’s an encrypted photo archive
A help-desk technician warns that changing a file’s extension does not alter its content. What could happen if a user renames a malicious .exe to .txt and opens it?
It becomes safe to read
The OS may still execute malicious code
The file is automatically quarantined
The extension prevents execution permanently
Why must cybersecurity professionals understand different file categories (text, data, executable, compressed, etc.)?
To predict file behavior and potential risk
To increase network speed
To hide malware from scans
To reduce drive space
Which file type commonly contains multiple compressed files bundled together for transport or installation?
.zip
.docx
.mp3
.html
An engineer opens a .cad drawing. Which statement describes this file type?
It stores bitmap pixels
It contains 3-D geometric design data
It holds sound waveforms
It runs installation scripts
A designer compares raster and vector images. Which difference is accurate?
Raster uses pixels; vector uses mathematical paths and shapes
Vector files cannot scale without distortion
Raster files are always smaller
Vector images store audio data
A .dll file found in C:\Windows\System32 most likely serves which purpose?
Audio storage
System library supporting executable programs
Encrypted password vault
Game resource file
A technician reviews running applications in Task Manager. What are those entries known as?
Archives
Processes
Databases
Drivers
During a forensic audit, several files show “Owner: Unknown.” Why is ownership important for cybersecurity?
It tracks accountability and legitimacy of each file
It speeds up search indexing
It reduces storage size
It disables auto-updates
Which condition would make a file immediately suspicious?
Owned by the administrator
Hidden with an illegitimate or missing owner
Stored on a desktop
Modified recently by the user
Why do operating systems hide certain system files by default?
To reduce clutter and prevent accidental modification
To hide malware from users
To encrypt temporary data
To speed up searches
From a security standpoint, why do attackers often hide files?
Hidden files load faster
Concealing files helps avoid detection by users and tools
It grants administrator privileges
It encrypts metadata automatically
Which of the following is a legitimate reason to use encryption?
Securing confidential payroll data
Hiding ransomware payloads
Evading file ownership
Spoofing identity information
Which example represents a malicious use of encryption?
Encrypting a system backup
A ransomware attack locking user data for payment
Protecting VPN tunnels
Encrypting an HTTPS session
How can an investigator view hidden files in Windows during analysis?
Enable “Show hidden items” in File Explorer settings
Use Notepad
Restart in Safe Mode only
Run Disk Cleanup
Which Windows search filter lists all files modified today?
datemodified:today
kind:folder
filename:*today*
owner:system
A digital-forensics student wants only folders changed today. Which query should they use?
kind:folder AND datemodified:today
folder:today
*.exe
kind:image
Which wildcard query locates filenames ending with “first”?
first*
*first
first?
kind:first
When combining filters with the keyword OR, what is the effect?
Either condition may be true for inclusion in results
Both must be true
It limits results to duplicates
It filters out hidden files only
What does the command kind:=.doc AND NOT datemodified:today return?
Word documents not changed today
Documents modified today
All image files
Only hidden folders
Why might a file named update.jpg.exe raise an alert?
It’s too large
It conceals an executable within a misleading name
It’s compressed
It’s encrypted
What does the principle “All data is a file” emphasize in computing?
Every stored element, including folders and programs, exists as a file within the OS
Only text documents are true files
Files exist only online
Audio and video are exceptions
Which search operator limits results to file categories such as image, document, or folder?
kind
owner
size
tag
A file with no owner appears in System32. How should an analyst classify it?
Likely suspicious and potentially malicious
Normal temporary file
Safe configuration file
Backup archive
When a malicious file spoofs ownership information, what is it doing?
Faking metadata to appear legitimate
Compressing itself
Changing permissions automatically
Encrypting system logs
Why should hidden files be inspected during threat-hunting activities?
Malware frequently hides within these directories
They never contain data
They speed up startup
They are auto-deleted
Which command finds all .exe or .jpg files?
kind:=.exe OR kind:=.jpg
kind:folder
datemodified:today
owner:admin
When narrowing searches during forensics, why might an analyst use wildcards?
To broaden search patterns when the exact filename is unknown
To delete duplicates
To encrypt data
To remove metadata
Which file type is least likely to contain executable code?
.mp4
.exe
.bat
.dll
What is the risk of running an unknown .exe downloaded from email?
It may install or execute malicious software
It automatically encrypts itself
It deletes harmless files
None; executables are safe by default
Why should investigators adjust default search settings before an examination?
To include hidden and system files that may contain evidence
To disable audit logging
To hide personal data
To reset file permissions
What accurately describes the function of a data server?
Hosts and manages databases for multiple users over a network
Stores only image backups
Encrypts traffic automatically without configuration
Filters spam emails
A .html file is most closely associated with which purpose?
Displaying webpages in browsers
Running executable code
Storing compressed archives
Managing audio tracks
How can analysts reduce false positives during advanced searches?
Combine filters logically (AND / OR) to narrow scope
Repeat the same keyword repeatedly
Avoid filters entirely
Ignore modification dates
If an encrypted file is legitimate, how can it be accessed?
Decrypt with the correct key or certificate
Rename to remove encryption
Copy to a different folder
Change its extension
Why is using short, broad search terms (like “My”) sometimes effective?
Computers interpret queries literally; shorter terms capture more results
It hides data from view
It speeds up encryption
It renames duplicates
The query kind:folder OR datemodified:today would return which items?
All folders and all files modified today
Only images
Only text documents
Hidden files only
Why must cybersecurity professionals understand file extensions?
Extensions reveal how files behave and which programs may execute them
They identify IP addresses
They prevent viruses
They track bandwidth
Which search string identifies Word files not updated today?
kind:=.doc AND NOT datemodified:today
*.jpg
owner:admin
kind:music
A .exe file located in the Downloads folder was last modified yesterday by “Unknown User.” Which conclusion is most accurate?
The file may be malicious or improperly sourced
It is a legitimate system update
It’s a harmless cache file
Ownership is irrelevant
Why might investigators prioritize reviewing recently modified executable files?
Attackers often drop or alter executables during compromise
To compress disk space
To clear cache files
To defragment drives
Which search query combines file type and modification-date filters effectively?
kind:=.doc AND NOT datemodified:today
datemodified:thisweek only
owner:system
*.tmp
You receive an email with an attachment named invoice.pdf.exe. What should a cybersecurity professional suspect?
A harmless PDF file
An executable disguised as a document
A compressed archive
An outdated invoice
During a malware investigation, you find a hidden .exe in C:\Users\Public\Videos. What is your first action?
Delete it immediately
Verify file ownership and digital signature
Execute to confirm behavior
Move it to another folder
A user reports that all personal files now end in .locked and cannot be opened. Which threat best fits this symptom?
Spyware
Ransomware
Rootkit
Keylogger
During an audit, several files display ownership by an Unknown SID. What does this indicate?
The user account was deleted or spoofed
The file is encrypted
Normal OS operation
Network latency
While reviewing system logs, you find hundreds of files in System32 modified today without an update notice. What should you do first?
Investigate for potential malware or unauthorized modifications
Ignore the results
Rename the folder
Empty the Recycle Bin
A suspicious .zip file appears in AppData\Roaming. What risk does this most likely represent?
Temporary cache
Encrypted malware payload delivery
Audio library
Backup folder
You discover update.bat created by a “Guest” account. Why is this a red flag?
BAT files can’t run in Windows
Guest accounts should not create or run scripts
It’s a normal maintenance task
It’s a hidden system driver
An examiner searches *password* across all drives. What is the purpose of this wildcard query?
Locate any file containing “password” in its name or path
Encrypt those files
Delete credential logs
Change permissions
Several .exe files are renamed to .txt within a temporary folder. Why might an attacker do this?
To evade filters that block executables
To speed up system performance
To compress them
To allow printing
A file named grades.xlsx is encrypted and requests a decryption key. What should a cybersecurity technician do first?
Attempt to identify whether encryption is legitimate and obtain authorization
Guess the password
Delete the file
Rename the extension to open it
