FRS301_SP26_RE_859160

1. (Choose 1 answer)
Which of the following could undermine the credibility of a digital forensic expert's testimony?
A. The expert has extensive experience and certifications in digital forensics.
B. The expert followed standard protocols and documented all procedures accurately.
C. The expert's analysis is based on outdated or discredited techniques.
D. The expert's findings are consistent with the evidence presented.

2. (Choose 1 answer)
Which e-mail protocol is commonly used to send messages?
A. POP3
B. IMAP
C. SMTP
D. SNMP

3. (Choose 1 answer)
What does Digital Forensics primarily deal with?
A. Investigating crimes involving physical evidence.
B. Analyzing digital devices and data for legal purposes.
C. Studying ancient digital civilizations.
D. Predicting weather patterns using computer simulations.

4. (Choose 1 answer)
Which of the following is NOT a potential source of evidence found in modern smartphones?
A. Call detail records
B. Location information
C. Social Security number
D. Browser history

5. (Choose 1 answer)
Which component of the cellular network is responsible for processing calls, coordinating between different networks, handling SMS messages, and storing call detail records and logs?
A. Base Station Controller (BSC)
B. Mobile Switching Center (MSC)
C. Visitor Location Register (VLR)
D. Home Location Register (HLR)

6. (Choose 1 answer)
What is a key difference between steganography and encryption?
A. Encryption hides data by deleting it
B. Steganography hides the existence of data
C. Steganography changes file extensions
D. Encryption uses file carving methods to retrieve data
E. Encryption deletes original data

7. (Choose 1 answer)
Which of the following network devices is explicitly mentioned as potentially containing log files relevant to an investigation?
A. Printers
B. Scanners
C. Routers
D. Webcams

8. (Choose 1 answer)
In the context of the Windows Registry, what is a "hive" defined as?
A. A single value within a key.
B. A collection of executable programs.
C. A key with all its subkeys and values.
D. A temporary file used by the operating system.

9. (Choose 1 answer)
To ensure the integrity and tamper-resistance of collected evidence, what materials should be used for sealing?
A. Regular cellophane tape.
B. Standard paper bags and string.
C. Sealed in evidence anti-static bag and tamper-resistant evidence tape.
D. Zipper-lock plastic bags.

10. (Choose 1 answer)
Which type of evidence in digital forensics is analogous to traces left behind by a criminal at a physical crime scene?
A. Photographs
B. Registry keys and log files
C. Paper documents
D. Metadata

11. (Choose 1 answer)
In digital forensics, what is the primary consideration when selecting a storage solution for evidence?
A. Cost-effectiveness
B. Accessibility
C. Security and integrity
D. Storage capacity

12. (Choose 1 answer)
Which judicial body is responsible for ensuring the admissibility and reliability of digital evidence in court proceedings, especially in cases involving cybercrimes or data breaches?
A. District Attorney's Office
B. Appellate Courts
C. Digital Forensics Laboratories
D. Trial Courts

13. (Choose 1 answer)
Which FAT file system is commonly found on USB drives but is generally NOT used on Windows XP or later operating systems?
A. FAT12
B. FAT36
C. FAT32
D. FATX

14. (Choose 1 answer)
Which method is used to identify a file more reliably than its extension?
A. File icon
B. File name
C. File header
D. File size

15. (Choose 1 answer)
Which of the following is an example of archival data?
A. Current system logs
B. Historical financial records stored on tape
C. Temporary internet files
D. Active user session data

16. (Choose 1 answer)
What is the structure of a root key and its subkeys in the Windows Registry?
A. Subkeys are individual files separate from the root key.
B. Subkeys are organized like folders in Regedit and form a path with the root key.
C. Subkeys do not contain any data or settings.
D. Subkeys are unrelated to their root key.

17. (Choose 1 answer)
Which of the following is considered digital evidence?
A. A printed contract signed by both parties.
B. An email sent from one person to another.
C. A handwritten note found at a crime scene.
D. A physical map with markings indicating specific locations.

18. (Choose 1 answer)
What is the role of expert testimony in digital forensics?
A. To validate and interpret complex network traffic logs
B. To present opinion based on specialized knowledge
C. To prepare and officially file detailed legal complaints
D. To assist law enforcement in serving authorized search warrants

19. (Choose 1 answer)
Which of the following methods is used by 'File Carving' to reconstruct files from fragmented data?
A. Analyzing network traffic logs
B. Relying on file headers and footers
C. Using metadata from social media platforms
D. Deciphering encrypted communications

20. (Choose 1 answer)
What is the primary purpose of examining intermediary devices such as routers and servers in a network investigation?
A. To identify the physical location of the hacker.
B. To determine the type of malware used in the attack.
C. To gather valuable information and evidence along the route followed by the attacker.
D. To identify the specific vulnerabilities in the network's security measures.

21. (Choose 1 answer)
Which of the following is a key advantage of analyzing a live system?
A. The ability to access and analyze volatile data such as RAM contents
B. Reduced risk of data corruption during analysis
C. Simplified evidence preservation process
D. Easier detection of hidden files

22. (Choose 1 answer)
What are the two files created in steganography?
A. Carrier file and payload
B. Source file and encrypted file
C. Container file and payload file
D. Cover file and hidden file

23. (Choose 1 answer)
Why is it important to use validated and tested forensic tools for evidence collection in digital forensics?
A. Validated tools are more expensive but provide faster results
B. Untested tools can alter or corrupt evidence, rendering it inadmissible
C. Forensic tools are unnecessary as data can be collected manually
D. Using multiple unvalidated tools increases the reliability of evidence

24. (Choose 1 answer)
Which of the following accurately describes a Distributed Denial of Service (DDoS) attack?
A. It involves a hacker intercepting communications between two parties.
B. It relies on social engineering techniques to trick individuals into revealing sensitive information.
C. It overwhelms a target system with a large volume of inbound traffic, causing it to shut down.
D. It relies on exploiting default or guessable credentials to gain unauthorized access to a network.

25. (Choose 1 answer)
What is the main purpose of imaging a forensic drive?
A. To examine the original drive.
B. To create an exact copy for examination.
C. To format the drive.
D. To increase storage capacity.

26. (Choose 1 answer)
Which of the following statements correctly describes a client/server network?
A. All machines on the network can function as both clients and servers.
B. Each computer is assigned one of two roles: client or server, where clients request services and servers provide them.
C. It is primarily used for file sharing of music, movies, and software.
D. It is exclusively used for connecting personal devices in a home network.

27. (Choose 1 answer)
What type of GPS data provides a record of where the unit has been and is automatically created by the system?
A. Waypoints
B. Points of Interest (POI)
C. Trackpoints
D. Track logs

28. (Choose 1 answer)
What is the purpose of link files on Windows operating system?
A. Managing system fonts
B. Creating shortcuts to files or folders
C. Storing temporary internet files
D. Optimizing system performance

29. (Choose 1 answer)
What mathematical process is used by GPS receivers to calculate their position?
A. Triangulation
B. Quadratic equation
C. Trilateration
D. Interpolation

30. (Choose 1 answer)
When is the file access time?
A. Wednesday, April 20, 2011, 7:15:52 AM
B. Wednesday, April 20, 2011, 7:15:51 PM
C. Wednesday, April 20, 2011, 7:15:52 PM
D. Wednesday, April 20, 2011, 7:15:51 AM

31. (Choose 1 answer)
Which of the following is a limitation of the FAT32 file system?
A. It is incompatible with Windows operating systems
B. It supports files larger than 4GB
C. It has a maximum file size of 4GB
D. It is only used for network file systems

32. (Choose 1 answer)
What is a common challenge faced when analyzing cell phones in digital forensics?
A. Cell phones typically have limited storage capacity.
B. Extracting data from locked or encrypted devices can be difficult.
C. Cell phone data is often well-documented and easy to interpret.
D. Cell phones are not commonly used to store digital evidence.

33. (Choose 1 answer)
Which of the following is a key aspect of Digital Forensics listed in the text?
A. Marketing digital evidence
B. Developing marketing strategies
C. Chain of custody
D. User interface design

34. (Choose 1 answer)
What is the main purpose of creating a forensic clone?
A. To improve device speed
B. To allow testing by students
C. To preserve the original evidence
D. To share it on the cloud

35. (Choose 1 answer)
What does the Drive wiping utility do?
A. Organizes files on the hard drive
B. Encrypts files stored on the drive
C. Permanently deletes data from the drive
D. Defragments the drive for better performance

36. (Choose 1 answer)
What are restore points used for in Windows?
A. To archive documents
B. To speed up web browsing
C. To revert system settings to a previous state
D. To log in as admin

37. (Choose 1 answer)
What is the primary goal of attribution in digital forensics?
A. Identifying the geographic location of a suspect
B. Determining the intent behind a cyber incident
C. Establishing accountability for a digital crime
D. Decrypting encrypted data for analysis

38. (Choose 1 answer)
What is the primary purpose of isolating a cell phone from the network during forensic examination?
A. To prevent remote wiping and overwriting of potential evidence
B. To ensure the phone's battery doesn't drain completely
C. To make sure the phone doesn't receive any incoming calls or messages
D. To avoid potential interference with the forensic tools

39. (Choose 1 answer)
What is the definition of Antiforensics Techniques?
A. Methods to secure data from unauthorized access.
B. Techniques to recover deleted data.
C. Methods to manipulate, erase, or obfuscate digital data to make its examination difficult.
D. Tools to speed up the forensic investigation process.

40. (Choose 1 answer)
What is the primary function of a forensic laboratory in digital forensics?
A. Conducting criminal investigations
B. Developing software applications
C. Providing technical support for IT departments
D. Researching new encryption techniques

41. (Choose 1 answer)
Which of the following best distinguishes a trackpoint from a waypoint in GPS data analysis?
A. Trackpoints are saved locations, while waypoints are automatically recorded
B. Waypoints include timestamps by default, unlike trackpoints
C. Trackpoints record location over time, whereas waypoints are manually marked
D. Waypoints are stored in RAM, while trackpoints are stored in the cloud

42. (Choose 1 answer)
What is archival data primarily used for?
A. Real-time processing and analysis
B. Long-term storage and future reference
C. Temporary file storage
D. Storing data in RAM for quick access

43. (Choose 1 answer)
Which of the following can be considered potential evidence found in e-mails?
A. Communications relevant to the case, e-mail addresses, IP addresses, dates, and times.
B. Personal preferences, encrypted files, system logs, and user passwords.
C. Calendar entries, video files, audio recordings, and web browser history.
D. Hardware specifications, installed applications, and system configurations.

44. (Choose 1 answer)
Why is drive slack significant in digital forensics?
A. It affects the speed of data retrieval
B. It can contain remnants of previously deleted files and sensitive information
C. It determines the total storage capacity of a drive
D. It is used to store system restore points

45. (Choose 1 answer)
What is the feature of restore points on Windows operating system?
A. Automatic file backup
B. System performance optimization
C. Recovery of system settings and files to a previous state
D. Encryption of sensitive data

46. (Choose 1 answer)
Which forensic tools are capable of deciphering INDEX.DAT files?
A. Microsoft Word and Excel.
B. FTK and EnCase.
C. Photoshop and Illustrator.
D. WinRAR and 7-Zip.

47. (Choose 1 answer)
Is data an individual places on shared computers or drives protected by the Fourth Amendment?
A. Yes, always.
B. Only if the data is encrypted.
C. No, that data is not protected.
D. Only if the user has set a strong password.

48. (Choose 1 answer)
What information is typically recorded in the Chain of Custody documentation?
A. Only the names of forensic analysts.
B. Details of the evidence, including its description, location, and time of collection.
C. Personal opinions and interpretations of the evidence.
D. Instructions for evidence handling in the laboratory.

49. (Choose 1 answer)
What is the main advantage of hexadecimal over binary in digital forensics?
A. It allows storage of larger files
B. It replaces the need for ASCII
C. It makes binary patterns more readable and compact
D. It is used only for network analysis

50. (Choose 1 answer)
What exactly is a “reasonable expectation of privacy”?
A. The expectation that one's private activities will never be observed or interfered with by anyone.
B. The expectation that certain areas or activities are protected from government intrusion under the law.
C. The expectation that all communications and actions, regardless of location, are private.
D. The expectation that private information will always be kept confidential by third parties.

Đang tải dữ liệu

Đang tải dữ liệu

Đang tải dữ liệu