WorksheetsCyber Forensics Quiz
Total questions: 99
Worksheet time: 50mins
Name
Class
Date
1.
What is the primary purpose of a write blocker in digital forensics?
a)
To speed up data acquisition
b)
To prevent accidental modification of the source media
c)
To encrypt the acquired data
d)
To analyze filesystem metadata
2.
What does the term 'Chain of Custody' refer to?
a)
The order of evidence analysis
b)
A chronological documentation of evidence handling
c)
The encryption key for the evidence
d)
The network path of a data packet
3.
Which of the following is considered volatile data?
a)
Files on a hard drive
b)
Contents of RAM
c)
USB drive contents
d)
Archived emails
4.
What is the main difference between a logical and a physical acquisition?
a)
Logical is faster
b)
Physical acquires the entire disk, including unallocated space
c)
Logical only works on Windows
d)
Physical is less forensically sound
5.
In the context of hashing, what is a collision?
a)
When two different files produce the same hash value
b)
When a hash algorithm is too slow
c)
When a file is corrupted during hashing
d)
When a file cannot be hashed
6.
Which file system is native to modern Windows operating systems?
a)
ext4
b)
HFS+
c)
FAT32
d)
NTFS
7.
What is 'slack space'?
a)
Unused space on a server
b)
The space between the end of a file and the end of the cluster it occupies
c)
A temporary storage area in RAM
d)
A type of network packet
8.
The 'dd' command in Linux is commonly used for what forensic task?
a)
File carving
b)
Creating a bit-for-bit copy of a drive
c)
Analyzing network traffic
d)
Viewing file metadata
9.
What is steganography?
a)
The art of cracking passwords
b)
The art of hiding data within another file or message
c)
A method for encrypting data
d)
A type of malware
10.
Which forensic tool is primarily used for memory analysis?
a)
Wireshark
b)
EnCase
c)
Volatility
d)
FTK Imager
11.
What is the purpose of the 'SAM' file in Windows?
a)
It stores system logs
b)
It contains user account information and hashed passwords
c)
It's a part of the system registry
d)
It stores temporary internet files
12.
What does 'file carving' refer to in digital forensics?
a)
Deleting files securely
b)
Recovering files based on their headers and footers from unallocated space
c)
Editing a file's metadata
d)
Compressing a file
13.
Which of these is a common hashing algorithm used for forensic integrity checks?
a)
AES
b)
RSA
c)
SHA-256
d)
DES
14.
What is the primary function of Wireshark?
a)
Disk imaging
b)
Memory forensics
c)
Password cracking
d)
Network protocol analysis
15.
The 'MFT' or Master File Table is a critical component of which file system?
a)
ext3
b)
FAT16
c)
NTFS
d)
HFS+
16.
What is the 'Order of Volatility' in evidence collection?
a)
A legal principle for presenting evidence
b)
A guideline for collecting data from most volatile to least volatile
c)
The order in which to shut down systems
d)
A method for ranking evidence by importance
17.
Which Windows Registry hive contains user-specific settings?
a)
HKEY_LOCAL_MACHINE
b)
HKEY_CLASSES_ROOT
c)
HKEY_CURRENT_USER
d)
HKEY_USERS
18.
What is the purpose of a Faraday bag?
a)
To protect evidence from physical damage
b)
To keep evidence at a stable temperature
c)
To block electromagnetic signals to and from a device
d)
To securely store paper documents
19.
In mobile forensics, what does 'JTAG' stand for?
a)
Java Test Action Group
b)
Joint Test Action Group
c)
Joint Terminal Attack Controller
d)
Java Tactical Application Grid
20.
What does 'metadata' describe?
a)
The content of a file
b)
Data about data, such as creation date and author
c)
The physical location of a file on a disk
d)
The hash value of a file
21.
Which type of RAID configuration provides redundancy through mirroring?
a)
RAID 0
b)
RAID 1
c)
RAID 5
d)
RAID 10
22.
What is the first step in the digital forensic process?
a)
Analysis
b)
Reporting
c)
Identification
d)
Preservation
23.
Which of the following is a common format for forensic disk images?
a)
.docx
b)
.jpeg
c)
.E01 (EnCase format)
d)
.mp3
24.
The Sleuth Kit (TSK) is often used with what graphical interface?
a)
Volatility Workbench
b)
Wireshark GUI
c)
Autopsy
d)
FTK Imager
25.
What is the goal of a forensic investigation?
a)
To prove a suspect's guilt
b)
To find and present digital evidence impartially
c)
To restore a system after an attack
d)
To develop new security policies
26.
What does BIOS stand for?
a)
Basic Input/Output System
b)
Binary Integrated Operating System
c)
Basic Internal Object Storage
d)
Binary Information On System
27.
In network forensics, what information can a firewall log provide?
a)
Contents of emails
b)
Keystrokes from a user's keyboard
c)
Allowed and blocked network connections
d)
A list of installed software
28.
Which artifact can show a user's web browsing history on Windows?
a)
The SAM file
b)
The pagefile.sys
c)
The MFT
d)
The index.dat or browser-specific history files
29.
What is a 'live acquisition'?
a)
Acquiring data from a powered-off system
b)
Acquiring data from a running system
c)
Acquiring data over a network
d)
Acquiring data from a mobile device
30.
The 'inode' in a Linux file system stores what?
a)
The file's name
b)
The file's content
c)
Metadata about the file, but not its name or content
d)
The user's password
31.
What is the purpose of a 'rainbow table'?
a)
To store color codes for a GUI
b)
To reverse cryptographic hash functions (crack passwords)
c)
To map network IP addresses
d)
To visualize data structures
32.
Which part of a hard drive contains the partition table?
a)
The File Allocation Table (FAT)
b)
The Master Boot Record (MBR)
c)
The swap partition
d)
The root directory
33.
What is 'exculpatory evidence'?
a)
Evidence that is irrelevant to the case
b)
Evidence that proves guilt
c)
Evidence that tends to prove a defendant's innocence
d)
Evidence that has been tampered with
34.
Which is a characteristic of a solid-state drive (SSD) that makes forensics challenging?
a)
They are slower than HDDs
b)
They use magnetic platters
c)
The TRIM command can permanently erase deleted data
d)
They are not supported by forensic tools
35.
What type of information is typically found in a packet header?
a)
The full content of the message
b)
Source and destination IP addresses
c)
The user's password
d)
The physical location of the sender
36.
In email forensics, what information is found in the email header?
a)
Only the subject and recipient
b)
The body of the email
c)
The path the email took across servers
d)
A list of attachments
37.
What is a 'logical time bomb' in the context of malware?
a)
Malware that activates at a certain time or when a condition is met
b)
A virus that spreads through logic puzzles
c)
A tool for synchronizing system clocks
d)
A type of firewall rule
38.
What does anti-forensics refer to?
a)
Techniques used to frustrate forensic investigations
b)
A branch of forensics focused on preventing crime
c)
The legal opposition to a forensic report
d)
A software suite for forensic analysis
39.
Which of the following would be the BEST tool to use to acquire RAM?
a)
dd
b)
FTK Imager
c)
DumpIt or Magnet RAM Capture
d)
EnCase
40.
The EXIF data of an image file would likely contain which of the following?
a)
The name of the person who took the photo
b)
The GPS coordinates of where the photo was taken
c)
A hash of the image
d)
The password to open the file
41.
What is a major challenge in cloud forensics?
a)
Cloud data is always encrypted
b)
Data is stored across multiple jurisdictions and physical locations
c)
Cloud providers do not keep logs
d)
Forensic tools cannot access the cloud
42.
What is the purpose of the pagefile.sys or swap file?
a)
To store user login information
b)
To serve as virtual memory on the hard drive
c)
To log system errors
d)
To store the operating system kernel
43.
Which forensic principle states that every contact leaves a trace?
a)
The Daubert Standard
b)
The Frye Standard
c)
Locard's Exchange Principle
d)
The Chain of Custody Principle
44.
What is a 'golden ticket' attack in Active Directory?
a)
An attack that gives the attacker a free software license
b)
An attack that exploits the Kerberos authentication protocol
c)
An attack that uses social engineering to get a password
d)
An attack that targets the physical gold master disk
45.
Which of these is a MAC timestamp?
a)
Modified, Accessed, Created
b)
Media, Access, Control
c)
Memory, Allocation, Cluster
d)
Master, Archive, Copied
46.
What is data carving?
a)
A method to securely wipe data
b)
Extracting data from a larger data set, often from unallocated space
c)
Encrypting a file system
d)
Analyzing data in RAM
47.
In iOS forensics, where is most user data stored?
a)
In a single, unencrypted file
b)
On the SIM card
c)
In a series of SQLite databases
d)
In the device's firmware
48.
What is the purpose of 'salting' a password hash?
a)
To make the hash longer
b)
To add random data to a password before hashing to prevent rainbow table attacks
c)
To encrypt the hash itself
d)
To make the password easier to remember
49.
What does DHCP stand for?
a)
Dynamic Host Configuration Protocol
b)
Digital Hash Control Protocol
c)
Direct Hardware Communication Port
d)
Data Handling and Cryptography Protocol
50.
A forensic copy is also known as a:
a)
Logical copy
b)
Bit-stream image
c)
Backup
d)
File copy
51.
What does 'time stomping' refer to?
a)
Synchronizing clocks on all systems in a network
b)
Logging the time of a security incident
c)
Modifying file timestamps to hide activity
d)
A tool for measuring network latency
52.
Which of the following is a key component of a forensic workstation?
a)
A fast internet connection
b)
A high-end graphics card for gaming
c)
A reliable write-blocker and a variety of storage media
d)
The latest version of Microsoft Office
53.
The 'Journaling' feature in a file system like ext4 or NTFS helps with what?
a)
Encrypting files
b)
Tracking user activity
c)
Maintaining file system integrity and speeding up recovery
d)
Storing old versions of files
54.
What is the primary goal of the 'Analysis' phase in a forensic investigation?
a)
To create a report for the court
b)
To collect all possible evidence
c)
To interpret the evidence and draw conclusions
d)
To secure the crime scene
55.
What does DNS stand for?
a)
Digital Network Service
b)
Domain Name System
c)
Dynamic Naming Service
d)
Data Naming Standard
56.
In forensics, what is 'unallocated space'?
a)
Space on a drive that is not currently part of a partition
b)
Space within a partition that is not allocated to an active file
c)
Free space available in a cloud storage account
d)
Empty space in a physical evidence bag
57.
What information can be found in router logs?
a)
A history of all websites visited by every user
b)
Source and destination IP addresses, timestamps, and port numbers
c)
The contents of encrypted data packets
d)
A list of all software installed on connected computers
58.
What is a 'DDoS' attack?
a)
A type of physical break-in
b)
An attack that uses one computer to steal data
c)
An attack that overwhelms a server with traffic from many sources
d)
A type of virus that deletes files
59.
Which tool would you use to analyze a Windows Registry file?
a)
Wireshark
b)
Volatility
c)
Registry Editor (RegEdit) or a specialized registry viewer
d)
FTK Imager
60.
What is the purpose of 'normalizing' a timestamp?
a)
Deleting the timestamp
b)
Setting all timestamps to the current time
c)
Converting timestamps from different sources to a single, standard time zone (like UTC)
d)
Encrypting the timestamp
61.
In mobile forensics, what is a 'chip-off' technique?
a)
A non-invasive data extraction method
b)
Physically removing the memory chip from a device to read its contents
c)
Using a software exploit to bypass the lock screen
d)
Cloning the SIM card
62.
What does 'entropy' mean in the context of data analysis?
a)
The size of a file
b)
The level of randomness or unpredictability in a set of data
c)
The creation date of a file
d)
The hash value of a file
63.
Which of the following is an example of an anti-forensic technique?
a)
Keeping detailed logs
b)
Using encryption and data wiping tools
c)
Creating regular backups
d)
Using strong, unique passwords
64.
What is the 'hiberfil.sys' file in Windows?
a)
A log of all system errors
b)
A backup of the registry
c)
A file that stores the contents of RAM when the system hibernates
d)
A temporary file for internet browsing
65.
The unique serial number assigned to a network interface controller (NIC) is known as what?
a)
IP Address
b)
Subnet Mask
c)
MAC Address
d)
Default Gateway
66.
What is the 'Daubert Standard'?
a)
A standard for data encryption
b)
A rule of evidence regarding the admissibility of expert witness testimony
c)
A protocol for network communication
d)
A method for hashing files
67.
Which forensic artifact can link a specific USB device to a specific computer?
a)
The SAM file
b)
The system's event logs
c)
The Windows Registry's USBSTOR key
d)
The pagefile.sys
68.
What is 'RAID'?
a)
A type of malware
b)
A secure method for deleting files
c)
A way of combining multiple disk drives into one logical unit
d)
A protocol for secure email
69.
What is the role of an expert witness in a court case?
a)
To provide an opinion on the ultimate issue of guilt or innocence
b)
To explain complex technical matters to the court
c)
To represent the defendant
d)
To prosecute the case
70.
What is 'data reduction' in the context of forensic analysis?
a)
Deleting irrelevant data
b)
Compressing the evidence
c)
Using techniques to filter and search for relevant information
d)
Making the final report shorter
71.
What type of file often has the header 'FF D8 FF E0'?
a)
PDF
b)
PNG
c)
DOCX
d)
JPEG
72.
What is the purpose of 'documentation' throughout a forensic investigation?
a)
To create a user manual for the tools used
b)
To create a detailed and defensible record of every action taken
c)
To bill the client for the work performed
d)
To practice writing skills for the final report
73.
What is a 'rootkit'?
a)
A tool for gaining administrative access to a system
b)
Malware designed to hide its presence and provide concealed access
c)
The main user account on a Linux system
d)
A hardware device for cracking passwords
74.
The 'Alternate Data Stream' (ADS) is a feature of which file system?
a)
ext4
b)
HFS+
c)
NTFS
d)
FAT32
75.
What is a 'hash library' (like the NSRL) used for?
a)
To store cracked passwords
b)
To identify known, standard system files to exclude them from analysis
c)
To catalog different types of malware
d)
To provide documentation for hashing algorithms
76.
What is the primary difference between a 'hot' and 'cold' site for disaster recovery?
a)
The temperature of the servers
b)
A hot site is fully equipped and ready to go; a cold site is just space
c)
Hot sites are for web servers, cold sites are for databases
d)
Hot sites are more expensive
77.
What does 'IoT' stand for?
a)
Internet of Things
b)
Internal Operating Temp
c)
Input/Output Transfer
d)
Internet on Time
78.
In mobile forensics, 'Flasher boxes' are primarily used for what purpose?
a)
To charge the device's battery
b)
To bypass passcodes or install custom firmware
c)
To enhance the device's camera flash
d)
To block network signals
79.
What is a 'man-in-the-middle' attack?
a)
An attack where the perpetrator is physically located between two servers
b)
An attack where the attacker secretly intercepts and relays communications
c)
A social engineering attack targeting middle management
d)
A type of denial-of-service attack
80.
What is the purpose of the 'Prefetch' files in Windows?
a)
To store user passwords
b)
To speed up the loading of frequently used applications
c)
To log system errors
d)
To store a backup of the MFT
81.
What is 'big-endian' vs 'little-endian'?
a)
The size of a hard drive
b)
The order in which bytes are stored in computer memory
c)
A type of encryption algorithm
d)
The physical layout of a keyboard
82.
Which is a common challenge with virtual machine forensics?
a)
Virtual machines cannot be imaged
b)
Timestamp inconsistencies and the fact that a VM can be moved or deleted easily
c)
Forensic tools do not support VM file formats
d)
Virtual machines do not have a file system
83.
What does a 'Proxy Server' do?
a)
It encrypts all data on a hard drive
b)
It acts as an intermediary for requests from clients seeking resources from other servers
c)
It is the main server in a data center
d)
It automatically backs up data
84.
What information can LNK (shortcut) files provide in a Windows investigation?
a)
The user's password
b)
The contents of the target file
c)
Information about files that were accessed, including their original location and timestamps
d)
A log of all network connections
85.
What is 'opto-isolation' in the context of forensic hardware?
a)
A method for viewing data using optical cables
b)
A way to isolate a device electrically to prevent power surges
c)
A feature of a write-blocker
d)
A technique for cleaning fiber optic cables
86.
What does 'TCP/IP' stand for?
a)
Total Computer Protection / Internet Protocol
b)
Transmission Control Protocol / Internet Protocol
c)
Technical Control Point / Inter-network Protocol
d)
Temporal Computing Process / Image Protocol
87.
Which phase of the forensic process involves creating a final report?
a)
Identification
b)
Preservation
c)
Analysis
d)
Reporting
88.
What is the purpose of a 'clean room' in a forensic lab?
a)
To have a dust-free environment for disassembling hard drives
b)
To conduct interviews with suspects
c)
To store finalized evidence reports
d)
To hold team meetings
89.
In cryptography, what is a 'key'?
a)
A piece of hardware
b)
A piece of information that determines the functional output of a cryptographic algorithm
c)
A legal document authorizing an investigation
d)
The primary piece of evidence
90.
What is 'memory smearing'?
a)
A technique for cleaning RAM chips
b)
The process where memory from one virtual machine can leak into another's space
c)
A method for wiping memory
d)
An anti-forensic technique to corrupt RAM before acquisition
91.
Which of the following would be an example of 'active' data?
a)
A deleted file in unallocated space
b)
A file stored in RAM
c)
A file that is visible in the file system to the user
d)
A file in slack space
92.
What is the 'registry hive' for system-wide settings in Windows?
a)
NTUSER.DAT
b)
SAM
c)
SYSTEM
d)
SOFTWARE
93.
What does the 'pslist' command in Volatility do?
a)
Lists all physical storage devices
b)
Lists the running processes at the time of the memory capture
c)
Lists all open network connections
d)
Lists the contents of the pagefile
94.
What is the 'Fourth Amendment' of the U.S. Constitution relevant to?
a)
The right to a speedy trial
b)
Protection against unreasonable searches and seizures
c)
The right to bear arms
d)
Freedom of speech
95.
What is a 'logical acquisition' of a mobile device?
a)
Physically removing the memory chip
b)
A bit-for-bit copy of the entire memory
c)
An acquisition of the files and directories accessible through the normal user interface
d)
Cloning the SIM card
96.
Which file signature (magic number) corresponds to a Portable Document Format (PDF) file?
a)
4D 5A
b)
25 50 44 46
c)
FF D8
d)
89 50 4E 47
97.
The Sleuth Kit is a collection of what?
a)
Graphical user interface tools
b)
Network analysis tools
c)
Command-line forensic tools
d)
Password cracking utilities
98.
What is the primary function of a file system?
a)
To encrypt data on a drive
b)
To control how data is stored and retrieved
c)
To provide a graphical user interface
d)
To connect the computer to the internet
99.
What is a 'live response' in incident handling?
a)
Shutting down the affected system immediately
b)
Collecting volatile data from a running system
c)
Wiping the system and restoring from backup
d)
Interviewing the user of the system
100 %
