Which of the following commands shows you the username and IP address used to access the system via a remote login session and the type of client from which they are accessing the system?

Which of the following is a federal law enacted in the US to control the ways that financial institutions deal with the private information of individuals?

UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?

You are working as an independent computer forensics investigator and received a call from a systems administrator for a local school system requesting your assistance. One of the students at the local high school is suspected of downloading inappropriate images from the Internet to a PC in the Computer Lab. When you arrive at the school, the systems administrator hands you a hard drive and tells you that he made a 'simple backup copy' of the hard drive in the PC and put it on this drive and requests that you examine the drive for evidence of the suspected images. You inform him that a 'simple backup copy' will not provide deleted files or recover file fragments. What type of copy do you need to make to ensure that the evidence found is complete and admissible in future proceeding?

Which of the following network attacks refers to sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address is hosted so as to cause a denial-of-service attack?

Gill is a computer forensics investigator who has been called upon to examine a seized computer. This computer, according to the police, was used by a hacker who gained access to numerous banking institutions to steal customer information. After preliminary investigations, Gill finds in the computer’s log files that the hacker was able to gain access to these banks through the use of Trojan horses. The hacker then used these Trojan horses to obtain remote access to the companies’ domain controllers. From this point, Gill found that the hacker pulled off the SAM files from the domain controllers to then attempt and crack network passwords. What is the most likely password cracking technique used by this hacker to break the user passwords from the SAM files?

An attacker has compromised a cloud environment of a company and used the employee information to perform an identity theft attack. Which type of attack is this?

In which implementation of RAID will the image of a Hardware RAID volume be different from the image taken separately from the disks?

One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, [1] extension?

An investigator enters the command sqlcmd -S WIN-CQQMK62867E -e -s", -E as part of collecting the primary data file and logs from a database. What does the "WIN-CQQMK62867E" represent?

During the trial, an investigator observes that one of the principal witnesses is severely ill and cannot be present for the hearing. He decides to record the evidence and present it to the court. Under which rule should he present such evidence?

What is cold boot (hard boot)?

Which of the following malware analysis involves executing the malware code to know how the code interacts with the host system and its impact on the system?

Which among the following laws emphasizes the need for each Federal agency to develop, document, and implement an organization-wide program to provide information security for the information systems that support its operations and assets?

Which of the following techniques delete the files permanently?

What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?

Email archiving is a systematic approach to save and protect the data contained in emails so that it can be accessed fast at a later date. There are two main archive types, namely Local Archive and Server Storage Archive. Which of the following statements is correct while dealing with local archives?

Which of the following tool is used to locate IP addresses?

Which of the following protocols allows non-ASCII files, such as video, graphics, and audio, to be sent through the email messages?

What is the framework used for application development for iOS-based mobile devices?

Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his claim?

Which of the following tools is not a data acquisition hardware tool?

The given image displays information about date and time of installation of the OS along with service packs, patches, and sub-directories. What command or tool did the investigator use to view this output?

Which list contains the most recent actions performed by a Windows User?

Joshua is analyzing an MSSQL database for finding the attack evidence and other details, where should he look for the database logs?

What is the name of the first reserved sector in File allocation table?

What does the command 'C:\>wevtutil gl ' display?

An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?

For what purpose do the investigators use tools like iPhoneBrowser, iFunBox, OpenSSHSSH, and iMazing?

In a computer that has Dropbox client installed, which of the following files related to the Dropbox client store information about local Dropbox installation and the Dropbox user account, along with email IDs linked with the account?

Robert is a regional manager working in a reputed organization. One day, he suspected malware attack after unwanted programs started to popup after logging into his computer. The network administrator was called upon to trace out any intrusion on the computer and he/she finds that suspicious activity has taken place within Autostart locations. In this situation, which of the following tools is used by the network administrator to detect any intrusion on a system?

What do you call the process of studying the changes that have taken place across a system or a machine after a series of actions or incidents?

Self-Monitoring, Analysis, and Reporting Technology (SMART) is built into the hard drives to monitor and report system activity. Which of the following is included in the report generated by SMART?

Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?

In Windows, prefetching is done to improve system performance. There are two types of prefetching: boot prefetching and application prefetching. During boot prefetching, what does the Cache Manager do?

The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created. Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?

Robert, a cloud architect, received a huge bill from the cloud service provider, which usually doesn't happen. After analyzing the bill, he found that the cloud resource consumption was very high. He then examined the cloud server and discovered that a malicious code was running on the server, which was generating huge but harmless traffic from the server. This means that the server has been compromised by an attacker with the sole intention to hurt the cloud customer financially. Which attack is described in the above scenario?

What is the role of Alloc.c in Apache core?

Which of the following statements is true regarding SMTP Server?

Which ISO Standard enables laboratories to demonstrate that they comply with quality assurance and provide valid results?

Which type of attack is possible when attackers know some credible information about the victim's password, such as the password length, algorithms involved, or the strings and characters used in its creation?

In which of these attacks will a steganalyst use a random message to generate a stego-object by using some steganography tool, to find the steganography algorithm used to hide the information?

Which of these Windows utility help you to repair logical file system errors?

Identify the term that refers to individuals who, by virtue of their knowledge and expertise, express an independent opinion on a matter related to a case based on the information that is provided.

Steve, a forensic investigator, was asked to investigate an email incident in his organization. The organization has Microsoft Exchange Server deployed for email communications. Which among the following files will Steve check to analyze message headers, message text, and standard attachments?

Which of the following information is displayed when Netstat is used with -ano switch?

While collecting Active Transaction Logs using SQL Server Management Studio, the query Select * from ::fn_dblog(NULL, NULL) displays the active portion of the transaction log file. Here, assigning NULL values implies?

Which of the following statements is TRUE with respect to the Registry settings in the user startup folder HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\

Which cloud model allows an investigator to acquire the instance of a virtual machine and initiate the forensics examination process?

An attacker successfully gained access to a remote Windows system and plans to install persistent backdoors on it. Before that, to avoid getting detected in future, he wants to cover his tracks by disabling the last-accessed timestamps of the machine. What would he do to achieve this?

Which of the following web browser uses the Extensible Storage Engine (ESE) database format to store browsing records, including history, cache, and cookies?

Which U.S. law sets the rules for sending emails for commercial purposes, establishes the minimum requirements for commercial messaging, gives the recipients of emails the right to ask the senders to stop emailing them, and spells out the penalties in case the above said rules are violated?

Which of the following statements is TRUE about SQL Server error logs?

Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?

Consider that you are investigating a machine running an Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:\Recycler\\. You read an entry named "Dd5.exe". What does Dd5.exe mean?

Which Linux command when executed displays kernel ring buffers or information about device drivers loaded into the kernel?

A section of your forensics lab houses several electrical and electronic equipment. Which type of fire extinguisher you must install in this area to contain any fire incident?

Checkpoint Firewall logs can be viewed through a Check Point Log viewer that uses icons and colors in the log table to represent different security events and their severity. What does the icon in the checkpoint logs represent?

In which cloud crime do attackers try to compromise the security of the cloud environment in order to steal data or inject a malware?

POP3 is an Internet protocol used to retrieve emails from a mail server. Through which port does an email client connect with a POP3 server?

James identifies a website vulnerability. He visits the login page, notes the session ID, appends it to the login URL, and shares the link. When the victim logs in using the shared URL, James reloads the page and can browse the victim’s active session. Which attack did James execute?

Which Android architecture component is responsible for displaying windows owned by different applications?

Which web application threat results when developers expose internal implementation objects such as files, directories, database records, or key-through references?

What does Locard’s Exchange Principle state?

A company begins a network vulnerability assessment. What is the first step the team should take to create the assessment plan?

What is the location of a Protective MBR in a GPT disk layout?

In Linux, what information can investigators obtain from the log file /var/log/dmesg?

Which Windows registry hive contains configuration information related to the application type used to open various files on the system?

Which ISO standard defines the file system for optical storage media such as CD-ROM?

Which of the following Linux command searches through the current processes and lists the process IDs those match the selection criteria to stdout?

Which forensic investigation methodology believes that criminals commit crimes solely to benefit their criminal enterprises?

Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

Which program uses different techniques to conceal a malware's code, thereby making it difficult for security mechanisms to detect or remove it?

What do the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

What does the Rule 101 of Federal Rules of Evidence states?

What document does the screenshot represent?

You are asked to build a forensic lab and your manager has specifically informed you to use copper for lining the walls, ceilings, and floor. What is the main purpose of lining the walls, ceilings, and floor with copper?

James is dealing with a case regarding a cybercrime that has taken place in Arizona, USA. James needs to lawfully seize the evidence from an electronic device without affecting the user's anonymity. Which of the following law should he comply with, before retrieving the evidence?

Which of the following stand true for BIOS Parameter Block?

Which Event Correlation approach assumes and predicts what an attacker can do next after the attack by studying statistics and probability?

MAC filtering is a security access control methodology, where a __________ is assigned to each network card to determine access to the network.

Which of the following files store the MySQL database data permanently, including data that had been deleted, helping investigation?

Which tool allows dumping the contents of process memory without stopping the process?

Which component in the hard disk moves over the platter to read and write information?

A log entry reads 192.168.0.1 - - [18/Jan/2020:12:42:29 +0000] "GET / HTTP/1.1" 200 1861. Which log format does it belong to?

In a Filesystem Hierarchy Standard (FHS), which directory contains the binary files required for working?

A computer has a failed OS install and damaged MBR/partition sector. Which tool can find and restore files and information on the disk?

There is a file named myfile.txt on C: that contains hidden data streams. Which command displays the contents of a data stream?

Cybercriminals use compromised computers to commit other crimes and may prevent a company from providing a service to its customers. Which type of cybercrime does this describe?

A MySQL server on Windows named WIN-DTRAI83202X was attacked. To retrieve information on changes made to the database, which file should be examined?

Which OWASP IoT vulnerability talks about security flaws such as lack of firmware validation, lack of secure delivery, and lack of anti-rollback mechanisms on IoT devices?

Which of the following malware targets Android mobile devices and installs a backdoor that remotely installs applications from an attacker-controlled server?

Which of the following tools is used to dump the memory of a running process, either immediately or when an error condition occurs?

Which Federal Rule of Evidence speaks about the Hearsay exception where the availability of the declarant is immaterial and certain characteristics of the declarant such as present sense impression, excited utterance, and recorded recollection are also observed while giving their testimony?

Williamson is a forensic investigator. While investigating a case of data breach at a company, he is maintaining a document that records details such as the forensic processes applied on the collected evidence, particulars of people handling it, the dates and times when it is being handled, and the place of storage of the evidence. What do you call this document?

Which of the following is a requirement for senders as per the CAN-SPAM act?

Donald made an OS disk snapshot of a compromised Azure VM under a resource group used by the affected company as a part of forensic analysis process. He then created a vhd file out of the snapshot and stored it in a file share and as a page blob as backup in a storage account under different region. What is the next thing he should do as a security measure?

Identify the location of Recycle Bin on a Windows 7 machine that uses NTFS file system to store and retrieve files on the hard disk.

Which "Standards and Criteria" under SWDGE states that "the agency must use hardware and software that are appropriate and effective for the seizure or examination procedure"?