How will you categorize a cybercrime that took place within a CSP's cloud environment?

Which of the following reports are delivered under oath to a board of directors/managers/panel of the jury?

The process of restarting a computer that is already turned on through the operating system is called?

Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?

Sectors are pie-shaped regions on a hard disk that store data. Which of the following parts of a hard disk do not contribute in determining the addresses of data?

Netstat is a tool for collecting information regarding network connections. It provides a simple view of TCP and UDP connections, and their state and network traffic statistics. Which of the following commands shows you the TCP and UDP network connections, listening ports, and the identifiers?

Billy, a computer forensics expert, has recovered a large number of DBX files during the forensic investigation of a laptop. Which of the following email clients can he use to analyze the DBX files?

Which network attack is described by the following statement? "At least five Russian major banks came under a continuous hacker attack, although online client services were not disrupted. The attack came from a wide-scale botnet involving at least 24,000 computers, located in 30 countries."

Which of the following is NOT a part of pre-investigation phase?

To which phase of the Computer Forensics Investigation Process does the Planning and Budgeting of a Forensics Lab belong?

Which tool does the investigator use to extract artifacts left by Google Drive on the system?

BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each bitmap file contains a header, the RGBQUAD array, information header, and image data. Which of the following element specifies the dimensions, compression type, and color format for the bitmap?

Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?

Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

Which of the following Windows-based tool displays who is logged onto a computer, either locally or remotely?

A forensic examiner is examining a Windows system seized from a crime scene. During the examination of a suspect file, he discovered that the file is password protected. He tried guessing the password using the suspect's available information but without any success. Which of the following tool can help the investigator to solve this issue?

Which of the following Android libraries are used to render 2D (SGL) or 3D (OpenGL/ES) graphics content to the screen?

Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

You are assigned a task to examine the log files pertaining to MyISAM storage engine. While examining, you are asked to perform a recovery operation on a MyISAM log file. Which among the following MySQL Utilities allow you to do so?

Andie, a network administrator, suspects unusual network services running on a Windows system. Which of the following commands should he use to verify unusual network services started on a Windows system?

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

Sheila is a forensics trainee and is searching for hidden image files on a hard disk. She used a forensic investigation tool to view the media in hexadecimal code for simplifying the search process. Which of the following hex codes should she look for to identify image files?

Shane, a forensic specialist, is investigating an ongoing attack on a MySQL database server hosted on a Windows machine with SID `WIN-ABCDE12345F.` Which of the following log files will help Shane in tracking all the client connections and activities performed on the database server?

What must an attorney do first before you are called to testify as an expert?

Gary is checking for the devices connected to USB ports of a suspect system during an investigation. Select the appropriate tool that will help him document all the connected devices.

Which of the following is NOT a physical evidence?

During forensics investigations, investigators collect the system time and compare it with UTC. What does the abbreviation UTC stand for?

Buffer overflow vulnerability occurs when a web application allows writing beyond a buffer’s maximum size, overwriting the ________.

Which of the following is a part of a Solid-State Drive (SSD)?

Which standard represents a legal precedent set in 1993 by the U.S. Supreme Court regarding the admissibility of expert witnesses’ testimony during federal legal proceedings?

Which statement is incorrect when preserving digital evidence?

Which ISO standard defines file systems and protocol for exchanging data between optical disks?

In computer forensics, Heap Buffer Overflow is categorized under which broader vulnerability class?

What value of the Boot Record Signature is used to indicate that the boot-loader exists?

Which of the following is a MAC-based File Recovery Tool?

Smith wants to find all values typed into the Run box in the Start menu during a Windows forensic analysis. Which registry key should he check?

When analyzing logs, clocks of all network devices must be synchronized. Which protocol helps in synchronizing these clocks?

The first eight digits of an IMEI that provide information about the model and origin of a mobile device are known as:

Which of the following is NOT an anti-forensics technique?

A computer forensics apprentice uses the command nbtstat -c to analyze a suspect system. What information is he looking for?

Tasklist command displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer. Which of the following tasklist commands provides information about the listed processes, including the image name, PID, name, and number of the session for the process?

Which part of Metasploit framework helps users to hide the data related to a previously deleted file or currently unused by the allocated file.

Which one of the following is not a first response procedure?

Graphics Interchange Format (GIF) is a ____ RGB bitmap image format for images with up to 256 distinct colors per frame.

Hard disk data addressing is a method of allotting addresses to each ______ of data on a hard disk.

Which of the following standard represents a legal precedent regarding the admissibility of scientific examinations or experiments in legal cases?

Event correlation is the process of finding relevance between the events that produce a final result. What type of correlation will help an organization to correlate events across a set of servers, systems, routers and network?

In Apache error logs, which entry type typically records server-side issues such as missing modules, script failures, or permission problems?

You are investigating events from Windows servers, Linux routers, and a SIEM. Which approach best helps you sequence and relate these events to detect a multi-stage attack?

What malware analysis operation can the investigator perform using the jv16 tool?

Which email header specifies an address for mailer-generated errors, like "no such user" bounces, to go to instead of the sender's address?

A computer forensics investigator with extensive experience is called as a qualified witness to testify to the accuracy and integrity of technical log files gathered in a fraud investigation. What is the term for this testimony?

When a user deletes a file, the system creates an SI file to store its details. What detail does the SI file not contain?

Raw data acquisition format creates ________ of a data set or suspect drive.

Under the CAN-SPAM Act, which requirement applies to commercial email senders?

Which registry hive provides configuration information about which application was used to open various files on the system?

Select the tool appropriate for examining the dynamically linked libraries of an application or process.

Which U.S. federal law requires financial institutions that offer consumers financial products or services to protect their customers' private information?

Which application password-cracking tool can discover all password-protected items on a computer and decrypt them?

After analyzing a mobile device, what identifier can reveal the manufacturer information?

Which command-line tool is used to determine active network connections?

Which process is part of dynamic malware analysis?

Investigators use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located on mobile devices?

What is the process where a magnetic field is used over a digital media device to delete previously stored data?

Which of the following tool can reverse machine code to assembly language?

Which of the following file formats allows the user to compress the acquired data as well as keep it randomly accessible?

What is the investigator trying to view by issuing the command displayed in the following screenshot?

Which layer of iOS architecture should a forensics investigator evaluate to analyze services such as Threading, File Access, Preferences, Networking and high-level features?

Which command can provide the investigators with details of all the loaded modules on a Linux-based system?

In a Linux-based system, what does the command 'last -F' display?

Which of the following examinations refers to the process of providing the opposing side in a trial the opportunity to question a witness?

Pick the statement which does not belong to the Rule 804 Hearsay Exceptions; Declarant

Which of the following is a responsibility of the first responder?

NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

If the partition size is 4 GB, each cluster will be 32 K. Even if a file needs only 10 K, the entire 32 K will be allocated, resulting in 22 K of ________.

After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?

Which of the following is a tool to reset Windows admin password?

Ron, a computer forensics expert, needs to recover the IMEI number of a Nokia phone left ON. Which key combination can he use to recover the IMEI number?

Select the data that a virtual memory would store in a Windows-based system.

Which principle states that anyone or anything entering a crime scene takes something of the scene with them, and leaves something of themselves behind?

During an investigation, Noel found a SIM card from a suspect's mobile. What does the code 89 44 represent on the card?

Which file system uses the Master File Table (MFT) database to store information about every file and directory on a volume?

A forensic expert needs detailed transaction log information from a SQL Server database named Transfers, including AllocUnitId, page id, and slot id. Which DBCC LOG command should be executed?

%3cscript%3ealert('XXXXXXXX')%3c/script%3e is a script obtained from a Cross-Site Scripting attack. What type of encoding has been employed?

Which of the following is a device monitoring tool?

What system details can an investigator obtain from the NetBIOS name table cache?

While analyzing a hard disk, the investigator finds that the file system does not use UEFI-based interface. Which of the following operating systems is present on the hard disk?

In which registry does the system store the Microsoft security IDs?

An investigator has extracted the device descriptor for a 1GB thumb drive that looks like: Disk&Ven_Best_Buy&Prod_Geek_Squad_U3&Rev_6.15. What does the 'Geek_Squad' part represent?

Which of the following Perl scripts will help an investigator to access the executable image of a process?

Which of the following attack uses HTML tags like ?

Examination of a computer by a technically unauthorized person will almost always result in:

Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best practice?

Which log file records details of files deleted from the Windows Recycle Bin?

During an investigation of an XSS attack, the investigator comes across the term '[a-zA-Z0-9%]+' in analyzed evidence details. What is the expression used for?

Which among the following search warrants allows the first responder to search and seize the victim's computer components such as hardware, software, storage devices, and documentation?

Centralized binary logging is a process in which many websites write binary and unformatted log data to a single log file. What extension should the investigator look to find its log file?

Where should the investigator look for the Edge browser's browsing records, including history, cache, and cookies?

Which of the following setups should a tester choose to analyze malware behavior?

A Linux system is undergoing investigation. In which directory should the investigators look for its current state data if the system is in powered on state?