II0-001 Exam Questions

In order to access a desktop computer for a forensics investigation that has a BIOS boot password enabled, which of the following is not a technique to over-ride the password:

Many manufacturers of BIOS Chips have backdoor passwords in order to access the CMOS settings.

In certain cases, a system may have CMOS or Boot passwords that prevent an investigator from accessing the hard drive. What technique would be most effective in circumventing the p...

The SAM in a Microsoft XP system is:

In Microsoft's security architecture, the "SID" refers to:

As a private investigator, you are not required by law to report crimes discovered during an investigation (with a few exceptions), but the IISFA Code of Ethics does require you to...

"Backsplatter" is a conceptual method of identifying what type of malicious attack?

"Slack Space" refers to:

The MS Windows swap file is useful to an investigator because

An effective counter measure to prevent unauthorized viewing of sensitive data is to:

All of the following systems can be compromised by a malicious entity utilizing existing, commonly found and easily obtained, utilities except:

An area of discovery that may be utilized during an audit may be:

A subject machine may have evidence in the clipboard if

Step 1 in analyzing data during an investigation is:

All of the following are critical in the first stages of an investigation except:

An effective means of circumventing windows security is to:

Most BIOS manufacturers provide tools to disable passwords on the BIOS of their machines

Once a file has been removed from a Microsoft XP trashcan, the file is not recoverable

One method child pornographers use to hide images is to change the file extension. Once this is done it is impossible to determine if a file is an image or some other type of file.

The history file in Internet Explorer is a good source of evidence.

A bad guy discovers child pornography on a system he has illegally penetrated. He immediately reports it to law enforcement and the owner of the system is arrested and charged. The...

A file viewer is handy for an investigative toolkit because:

Steganography is:

It is critical for an investigator to understand counter measures and secure design fully in order to:

During a traceback, an investigator can perform a "footprint" that will identify much about the target host. This is an effective information gathering step, but is illegal in most...

Footprinting can be illegal if what condition exists?

Automated tools make up a large part of the forensic investigators tool kit and are very helpful in investigations. Which of the following statements is also true:

The required files to boot an MS-DOS system are:

Identify the statement below that best supports the term 'Rootkit':

It is critical during court testimony to have:

At the current time, tools commonly used by law enforcement investigators fall into one of three categories:

Challenges to the authenticity of computer records often take on one of three forms. Please select the statement that best describes one of the three challenges.

What should be in an electronic forensic tool kit?

A forensically safe file viewer can cross not only application but OS boundaries, and they offer the added benefit that:

Password protection, and especially file encryption, can cause the following problem for Forensic processes:

Why is it important to collect alarms that denote when external sources are targeting your network with a scan?

The IDS logs show scans directed at the network. What usefulness would an intruder gather in performing a scan against your network?

IP-based denial- of-service (DOS) and fragmented packet (TearDrop) attacks can be identified by looking at the packet headers as they travel across a network. This type of attack c...

It has been determined that a system on your network has been compromised. What should you do on your IDS and firewalls as soon as possible?

During your initial investigation of a compromised system, you will need to create a detailed time- based reconstruction of the attack and compromise. Which of these questions will...

In many cases, the trail of an investigation begins with an audit of:

An audit the is PRIMARY method of re-creating the cyber-crime.

Often, an audit is a ..... type of control that is useful in an investigation.

Why is an audit conducted by a 3rd party audit team?

Logs should be kept:

A syslog is a device/system that collects log files from various sources in an internet. Syslogs provide:

Log files are located:

Processes included in the investigative process are?

Mistakes an expert witness can make are which of the following:

Expertise in a team leader should include: