A digital signature needs a
1. private-key system
2.shared-key system
3.public-key system
4.all of them
Posted Date:-2022-07-18 09:08:07
A false positive can be defined as:
1.an alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior
2.an alert that indicates nefarious activity on a system that, upon further inspection, turns out to truly be nefarious activity
3.the lack of an alert for nefarious activity
4.All of the above
Posted Date:-2022-07-18 09:48:41
A valid definition of digital evidence is:
1.none of the below
2.data stored or transmitted using a computer
3.digital data of probative value
4.any digital evidence on a computer
Posted Date:-2022-07-18 09:51:28
Forensic analysis involves the following:
1. assessment, experimentation, fusion, correlation, and validation
2.seizure and preservation
3.recovery, harvesting, filtering, organization, and search
4.All of the above
Posted Date:-2022-07-18 10:34:28
In crimes against individuals the ______ period leading up to the crime often contains the most important clues regarding the relationship between the offender and the victim.
1.24-hour
2.28-hour
3.60-minute
4. 15-minute
Posted Date:-2022-07-18 10:41:21
In the DNS the names are defined in _____ sturucture
1.a linear list
2.an invertred tree
3. a graph
4.None of These
Posted Date:-2022-07-18 09:45:13
Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?
1.functional
2.intentional
3.relational
4.temporal
Posted Date:-2022-07-18 10:40:00
Investigators should not rely on one piece of digital evidence when examining an alibi – they should look for an associated _______.
1.cybertrail
2.piece of physical evidence
3.statement
4.none of the above
Posted Date:-2022-07-18 10:43:48
SSL stands for?
1.secured socket layer
2. secured shell layer
3.system socket layer
4.system secured layer
Posted Date:-2022-07-18 09:23:48
The type of report that is a preliminary summary of findings is known as:
1.sitrep
2.threshold assessment report
3.full investigative report
4.field notes
Posted Date:-2022-07-18 10:42:21
What is necessary for a cross-site script attack with cookies to be thwarted
1.captchas
2.virtual machines
3.proxies
4.firewalls
Posted Date:-2022-07-18 09:09:43
A full domain name is sequence of lables seperated by____
1.semicolons
2.dots
3.colons
4.None of These
Posted Date:-2022-07-18 09:46:47
An HTTP connection uses port _________ whereas HTTPS uses port ____________ and invokes SSL
1.40; 80
2.60; 620
3.80; 443
4. 620; 80
Posted Date:-2022-07-18 06:24:25
An investigation can be hindered by the following:
1.preconceived theories
2.improperly handled evidence
3.offender concealment behavior
4.all of the above
Posted Date:-2022-07-18 10:33:40
Computers can play the following roles in a crime:
1. target, object, and subject
2.evidence, instrumentality, contraband, or fruit of crime
3.object, evidence, and tool
4.symbol, instrumentality, and source of evidence
Posted Date:-2022-07-18 10:08:05
Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?
1. functional
2.intentional
3.relational
4.temporal
Posted Date:-2022-07-18 10:42:58
Cybertrails are advantageous because:
1.they are not connected to the physical world.
2.nobody can be harmed by crime on the internet.
3.they are easy to follow.
4.offenders who are unaware of them leave behind more clues than they otherwise would have.
Posted Date:-2022-07-18 09:56:29
DNS can use services of________using the well known port 53
1.udp
2.tcp
3. either (a) or (b)
4.None of the above
Posted Date:-2022-07-18 09:43:58
For a client-server authentication, the client requests from the KDC a ________ for access to a specific asset.
1.ticket
2.local
3.token
4.user
Posted Date:-2022-07-18 09:14:20
For each _______ the Kerberos Key Distribution Center (KDC) maintains a database of the realm’s principal and the principal’s associated “secret keysâ€.
1. key
2.realm
3.document
4.none of the mentioned
Posted Date:-2022-07-18 09:11:52
How does machine learning benefit IDSes/IPSes?
1.by lowering the volume of attacks analyzed
2. by adding heuristic anomaly detection capabilities
3. by searching for similar patterns to known attacks
4.by helping identify signatures more quickly
Posted Date:-2022-07-18 09:50:33
Imagine a social networking web app (like Twitter) that allows users to post short blurbs of text.
1.cross-site scripting
2.sql injection
3.packet sniffing
4.a and b
Posted Date:-2022-07-18 09:17:33
In terms of digital evidence, the Internet is an example of:
1.open computer systems
2. communication systems
3.embedded computer systems
4. none of the above
Posted Date:-2022-07-18 09:55:41
In the _______ mode, IPSec protects the whole IP packet, including the original IP header.
1.transport
2.tunnel
3.either (a) or (b)
4.neither (a) nor (b)
Posted Date:-2022-07-18 06:23:44
It is quite difficult to fabricate an alibi on a network successfully because:
1.an offender may not have the proper access.
2. an offender would need system administrator access level to make the necessary changes.
3.an individual rarely has the ability to falsify digital evidence on all the computers that are involved.
4.creating an alibi on a network could take months of work.
Posted Date:-2022-07-18 10:44:42
Personal computers and networks are often a valuable source of evidence. Those involved with _______ should be comfortable with this technology.
1.criminal investigation
2.prosecution
3.defense work
4.all of the above
Posted Date:-2022-07-18 10:07:07
The crime scene preservation process includes all but which of the following:
1.protecting against unauthorized alterations
2.acquiring digital evidence
3.confirming system date and time
4. controlling access to the crime scene
Posted Date:-2022-07-18 10:38:55
The domain name space (tree) is devided into---------different sections
1.3
2.2
3.4
4.None of the mentioned
Posted Date:-2022-07-18 09:41:53
The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:
1. best evidence rule
2. due diligence
3.quid pro quo
4.voir dire
Posted Date:-2022-07-18 10:32:08
The features of traditional IPSes are found in all of these modern systems, except:
1.next-generation firewalls
2.antimalware
3.unified threat management appliances
4.network behavior analysis systems
Posted Date:-2022-07-18 09:49:46
The first step in applying the scientific method to a digital investigation is to:
1. form a theory on what may have occurred
2. experiment or test the available evidence to confirm or refute your prediction
3.make one or more observations based on events that occurred
4.form a conclusion based on the results of your findings
Posted Date:-2022-07-18 10:36:54
The following specializations exist in digital investigations:
1.first responder (a.k.a. digital crime scene technician)
2.forensic examiner
3.digital investigator
4.All of the above
Posted Date:-2022-07-18 10:09:16
The process model whose goal is to completely describe the flow of information in a digital investigation is known as:
1. the physical model
2. the staircase model
3.the evidence flow model
4.the subphase model
Posted Date:-2022-07-18 10:37:55
The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:
1.chain of custody
2. field notes
3.interim report
4.None of the above
Posted Date:-2022-07-18 10:10:13
The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:
1.chain of custody
2. field notes
3.interim report
4.None of the above
Posted Date:-2022-07-18 10:17:07
The root of DNS tree is____
1.a string of characters
2.a string of 63 characters
3.an empty string
4.None of These
Posted Date:-2022-07-18 09:46:02
The _____domains define registered hosts according to their generic behaviour.
1.generic
2.country
3.inverse
4.none
Posted Date:-2022-07-18 09:42:31
The _______ mode is normally used when we need host-to-host (end-to-end) protection of data.
1.transport
2.tunnel
3.either (a) or (b)
4. neither (a) nor (b)
Posted Date:-2022-07-18 09:10:40
To demonstrate that someone is lying about an alibi, it is necessary to:
1.find evidence that clearly demonstrates the lie
2. require the suspect to submit to a polygraph
3. interrogate the suspect using a number of methods
4.show that no evidence confirming the alibi is available
Posted Date:-2022-07-18 10:46:57
Types of digital evidence that might corroborate an alibi include:
1.evidence of computer usage when the offense was supposed to occurred
2.computer records from credit cards, the telephone company, or subway ticket usage
3.. gps information from mobile devices indicating the user’s location and time
4.all of the above
Posted Date:-2022-07-18 10:45:49
What are the three general categories of computer systems that can contain digital evidence?
1.Desktop, laptop, server
2.personal computer, internet, mobile telephone
3. hardware, software, networks
4.open computer systems, communication systems, embedded systems
Posted Date:-2022-07-18 09:54:50
What are the two primary classifications of cross-site scripting?
1.dom based and persistent
2.traditional and dom based
3. traditional and non-persistent
4.non-persistent and persistent
Posted Date:-2022-07-18 09:15:28
What is Firewall?
1.firewalls are network based security measures that control the flow of incoming and outgoing traffic
2.firewall is a program that encrypts all programs that access the internet
3.a firewall is a program that keeps other programs from using the internet
4. firewall are the interrupts that automatically disconnect from the internet when a threat appears.
Posted Date:-2022-07-18 09:22:52
What is the most important activity in system hacking?
1.information gathering
2.cracking passwords
3.escalating privileges
4.covering tracks
Posted Date:-2022-07-18 09:25:44
What port does Telnet use?
1.22
2.80
3.20
4.23
Posted Date:-2022-07-18 06:25:01
When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:
1.whether chain of custody was maintained
2.whether there are indications that the actual digital evidence was tampered with
3. whether the evidence was properly secured in transit
4.whether the evidence media was compatible with forensic machines
Posted Date:-2022-07-18 10:31:15
Which is true of a signature-based IDS?
1.it cannot work with an ips
2.it only identifies on known signatures
3. it detects never-before-seen anomalies
4.it works best in large enterprises.
Posted Date:-2022-07-18 09:47:54
Why would a hacker use a proxy server?
1. to create a stronger connection with the target.
2. to create a ghost server on the network.
3. to obtain a remote access connection
4.to hide malicious activity on the network.
Posted Date:-2022-07-18 09:20:53
Why would HTTP Tunneling be used?
1.to identify proxy servers
2.web activity is not scanned
3. to bypass a firewall
4.http is a easy protocol to work with
Posted Date:-2022-07-18 09:40:51
_____uses the idea of certificate trust levels
1. x509
2.pgp
3.kdc
4.none of them
Posted Date:-2022-07-18 06:26:55