Question 1

Most metadata about a file is generated and recorded automatically without the user's knowledge.

Accepted Answer

Most metadata such as file creation date, file size, and file type are generated automatically without the user's input or knowledge. However, some metadata such as file tags or keywords can be manually assigned by the user.

Question 2

Duplicate image backups are considered a primary key to uncovering evidence because they create exact replicas of the crime scene.

Accepted Answer

False

Question 3

In a(n) ____ cluster, every server in the cluster performs useful work.&#10;A) symmetric network&#10;B) asymmetric network&#10;C) symmetric server&#10;D) symmetric network

Accepted Answer

In a symmetric server cluster, every server performs useful work, as opposed to an asymmetric cluster where some servers may be on standby or perform different roles.

Question 4

A ____ is a service contract between a vendor and a client that specifies what services will be provided, the responsibilities of each party, and any guarantees of service.&#10;A) service level agreement&#10;B) recovery point objective&#10;C) recovery time objective&#10;D) service point agreement

Accepted Answer

A service level agreement (SLA) is a contract between a vendor and a client that outlines the level of service that will be provided, as well as any guarantees or commitments that are made regarding the delivery of that service. SLAs typically include details such as the specific services to be provided, performance metrics, responsibilities of both parties, and penalties or incentives for meeting or failing to meet service targets.

Question 5

A(n) ____ is a device that maintains power to equipment in the event of an interruption in the primary electrical power source.&#10;A) uninterruptible power supply&#10;B) redundant power supply&#10;C) uninterruptible system supply&#10;D) replica power supply

Accepted Answer

An uninterruptible power supply (UPS) is a device that provides battery backup power to equipment in case of a power outage or flicker. This allows for critical equipment to continue functioning without interruption. A redundant power supply, while similar, is a separate power supply that provides redundancy in case of a primary power supply failure. The other options (C and D) are not commonly used terms in the context of power supply equipment.

Question 6

____ is a form of eavesdropping in which special equipment is used to pick up telecommunication signals or data within a computer device by monitoring the electromagnetic fields.&#10;A) Newton phreaking&#10;B) Van Eck phreaking&#10;C) Van Zek hacking&#10;D) EMF phreaking

Accepted Answer

Van Eck phreaking, also known as TEMPEST, is a form of eavesdropping that involves using special equipment to monitor the electromagnetic fields emitted by electronic devices such as computers and telecommunication systems. This allows the attacker to intercept sensitive information being transmitted through these devices. Newton phreaking and Van Zek hacking are not recognized terms in the field of cybersecurity, and EMF phreaking is not a commonly used term either.

Question 7

The ____ response team serves as first responders whenever digital evidence needs to be preserved.&#10;A) incident&#10;B) computer forensics&#10;C) risk&#10;D) emergency

Accepted Answer

The term "digital evidence" indicates that the need for preservation of evidence is related to a computer or electronic device. Therefore, the team most likely responsible for this task is a computer forensics team. Options A, C, and D are broader terms and could refer to any kind of incident, risk, or emergency response team.

Question 8

In a(n) ____ cluster, a standby server exists only to take over for another server in the event of its failure.&#10;A) symmetric network&#10;B) symmetric server&#10;C) asymmetric network&#10;D) asymmetric server

Accepted Answer

An asymmetric server cluster relies on one or more standby servers that exist solely to take over for a failed server. The active server sends its state to the standby server in real-time, so it can seamlessly take over if necessary. This type of cluster is used to achieve high availability and fault tolerance. A symmetric server cluster, on the other hand, consists of multiple active servers that work together to handle incoming requests, and typically use load balancing to distribute the workload evenly. Asymmetric network and symmetric network are not related to server clusters.

Question 9

____ uses technology to search for computer evidence of a crime, can attempt to retrieve information-even if it has been altered or erased-that can be used in the pursuit of the attacker or criminal.&#10;A) Computer forensics&#10;B) Penetration testing&#10;C) Vulnerability testing&#10;D) Risk management

Accepted Answer

Computer forensics involves using technology to search for and retrieve computer evidence related to a crime or attack. This can include information that has been altered or erased, and can help in the pursuit and prosecution of the attacker or criminal. Penetration testing involves attempting to exploit vulnerabilities in a system to identify potential weaknesses, while vulnerability testing involves assessing a system for known vulnerabilities. Risk management involves identifying and mitigating potential risks to a system or organization.

Question 10

System availability is often expressed as a percentage of uptime in a year.

Accepted Answer

System availability is commonly expressed as a percentage of uptime in a year, where the percentage represents the amount of time the system is operational and available for use without any unplanned downtime. This metric is used to evaluate the reliability and performance of a system.

Question 11

A ____ typically begins by identifying threats through a risk assessment.&#10;A) BRA&#10;B) BAA&#10;C) BPA&#10;D) BIA

Accepted Answer

The answer of A ____ typically begins by identifying threats...

Question 12

A ____ is a metallic enclosure that prevents the entry or escape of an electromagnetic field.&#10;A) bollard&#10;B) mantrap&#10;C) Faraday cage&#10;D) Newton cage

Accepted Answer

The answer of A ____ is a metallic enclosure that...

Question 13

A ____ is a component or entity in a system which, if it no longer functions, will disable the entire system.&#10;A) recovery site&#10;B) recovery point&#10;C) single point of failure&#10;D) cascade point of failure

Accepted Answer

The answer of A ____ is a component or entity...

Question 14

____ is designed to ensure that an organization can continue to function in the event of a natural or man-made disaster.&#10;A) Business continuity planning and testing&#10;B) Disaster planning&#10;C) Business management planning and testing&#10;D) Enterprise disaster planning

Accepted Answer

The answer of ____ is designed to ensure that an...

Question 15

____ plans typically include procedures to address redundancy and fault tolerance as well as data backups.&#10;A) Enterprise recovery&#10;B) Disaster recovery&#10;C) Business recovery&#10;D) Emergency recovery

Accepted Answer

The answer of ____ plans typically include procedures to address...

Question 16

A ____ has all of the equipment installed, but does not have active Internet or telecommunications facilities, and does not have current backups of data.&#10;A) cold site&#10;B) hot site&#10;C) spare site&#10;D) warm site

Accepted Answer

The answer of A ____ has all of the equipment...

Question 17

____ data is the most difficult type of data to capture.&#10;A) Volatile&#10;B) Static&#10;C) Non-volatile&#10;D) Persistent

Accepted Answer

The answer of ____ data is the most difficult type...

Question 18

According to the Federal Bureau of Investigation (FBI), almost ____ percent of crimes committed today leave behind digital evidence that can be retrieved through computer forensics.&#10;A) 65&#10;B) 75&#10;C) 85&#10;D) 95

Accepted Answer

The answer of According to the Federal Bureau of Investigation...

Question 19

RAM slack can contain any information that has been created, viewed, modified, downloaded, or copied since the computer was last booted.

Accepted Answer

The answer of RAM slack can contain any information that...

Question 20

A subset of business continuity planning and testing is disaster recovery, also known as IT recovery planning.

Accepted Answer

The answer of A subset of business continuity planning and...

Question 21

____ pertains only to the last sector of a file.&#10;A) Disk slack&#10;B) RAM slack&#10;C) ROM slack&#10;D) Edge slack

Accepted Answer

The answer of ____ pertains only to the last sector...

Question 22

The ____ documents that the evidence was under strict control at all times and no unauthorized person was given the opportunity to corrupt the evidence.&#10;A) chain of value&#10;B) chain of use&#10;C) chain of property&#10;D) chain of custody

Accepted Answer

The answer of The ____ documents that the evidence was...

Question 23

Discuss the purpose and importance of the chain of custody.

Accepted Answer

The answer of Discuss the purpose and importance of the...

Question 24

Generally, ____________________ focuses on restoring computing and technology resources to their former state.

Accepted Answer

The answer of Generally, ____________________ focuses on restoring computing and...

Question 25

A(n) ____ backup is an evidence-grade backup because its accuracy meets evidence standards.&#10;A) baseline&#10;B) mirror image&#10;C) logical image&#10;D) thin image

Accepted Answer

The answer of A(n) ____ backup is an evidence-grade backup...

Question 26

A ____ is a snapshot of the current state of the computer that contains all current settings and data.&#10;A) system standard&#10;B) system view&#10;C) system image&#10;D) system baseline

Accepted Answer

The answer of A ____ is a snapshot of the...

Question 27

Windows stores files on a hard drive in 512-byte blocks called ____________________.

Accepted Answer

The answer of Windows stores files on a hard drive...

Question 28

Multiple sectors are used to make up a ____.&#10;A) cluster&#10;B) track&#10;C) slice&#10;D) platter

Accepted Answer

The answer of Multiple sectors are used to make up...

Question 29

Describe what happens when the response team arrives and secures the crime scene.

Accepted Answer

The answer of Describe what happens when the response team...

Question 30

Describe the Windows page file and discuss why it can be important for evidence recovery.

Accepted Answer

The answer of Describe the Windows page file and discuss...

Question 31

RAID 0 technology is based on ____________________.

Accepted Answer

The answer of RAID 0 technology is based on ____________________....

Question 32

Explain how to best capture volatile data.

Accepted Answer

The answer of Explain how to best capture volatile data....

Question 33

____ could contain remnants of previously deleted files or data from the format pattern associated with disk storage space that has yet to be used by the computer.&#10;A) RAM slack&#10;B) Edge slack&#10;C) Drive file slack&#10;D) Sector slack

Accepted Answer

The answer of ____ could contain remnants of previously deleted...

Question 34

What are the steps in damage control?

Accepted Answer

The answer of What are the steps in damage control?...

Question 35

What are the objectives of disaster exercises?

Accepted Answer

The answer of What are the objectives of disaster exercises?...

Question 36

____________________ is data about data.

Accepted Answer

The answer of ____________________ is data about data....

Question 37

Identify two scenarios that could be used in a BIA.

Accepted Answer

The answer of Identify two scenarios that could be used...

Question 38

The air-handling space above drop ceilings (and sometimes even between the walls and under structural floors) used to circulate and otherwise handle air in a building are called ____________________.

Accepted Answer

The answer of The air-handling space above drop ceilings (and...

Question 39

Describe the purpose of a disaster recovery plan.

Accepted Answer

The answer of Describe the purpose of a disaster recovery...

Question 40

What is required upon completion of an evidence examination?

Accepted Answer

The answer of What is required upon completion of an...

Question 41

What does Windows do if a file being saved is not long enough to fill up the last sector on the disk?

Accepted Answer

The answer of What does Windows do if a file...

Question 42

Match between columns&#10;                        Premises: The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The sudden flow of electric current between two objects&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;The ability of an organization to maintain its operations and services in the face of a disruptive event&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;Determining in advance who will be authorized to take over in the event of the incapacitation or death of key employees&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;The average time until a component fails, cannot be repaired, and must be replaced&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Focuses on protecting and restoring the information technology functions and services that support the business&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;Analyzes the most important mission-critical business functions and then identifies and quantifies the impact a loss of such functions may have on the organization in terms of its operational and financial position&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The process of identifying exposure to threats, creating preventive and recovery procedures, and then testing them to determine if they are sufficient.&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession&#10;The application of science to questions that are of interest to the legal profession

Accepted Answer

The Answer of Business continuity and MTTR and Business continuity is...

Deck 13: Business Continuity