Deck 2: The Investigators Office and Laboratory

Question 1

_______ is a specialized viewer software program.

A)​FastView
B)​IrfanView
C)ThumbsLoader
D)ABSee

Answer 1

B

Question 2

Which file system below is utilized by the Xbox gaming system?​

A)​NTFS
B)​ReFS
C)EXT
D)FATX

Answer 2

D

Question 3

​In order to qualify for the Certified Computer Forensic Technician, Basic Level certification, how many hours of computer forensics training are required?

A)​10
B)​20
C)30
D)40

Answer 3

D

Question 4

The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. Department of Defense.​

Question 5

​The recording of all updates made to a workstation or machine is referred to as configuration management.

Question 6

​Candidates who complete the IACIS test successfully are designated as a _______.

A)​Certified Forensic Computer Examiner (CFCE)
B)​Certified Forensics Investigator (CFI)
C)Certified Investigative Forensics Examiner (CIFE)
D)Certified Investigative Examiner (CIE)

Question 7

_______ describes the characteristics of a safe storage container.

A)​ISO2960
B)​NISPOM
C)SSO 990
D)STORSEC

Question 8

​In order to qualify for the Advanced Certified Computer Forensic Technician certification, a candidate must have _______ years of hands-on experience in computer forensics investigations.

A)​two
B)three
C)five
D) six

Question 9

Which tool below is not recommended for use in a forensics lab?​

A)​2.5-inch adapters for drives
B)​FireWire and USB adapters
C)SCSI cards
D)Degausser

Question 10

Which option below is not one of the recommended practices for maintaining a keyed padlock?

A)​Appoint a key custodian.
B)Take inventory of all keys when the custodian changes.
C)Use a master key.
D)Change locks and keys annually.

Question 11

Which operating system listed below is not a distribution of the Linux OS?

A)Minix
B)​Debian
C)Slackware
D)Fedora

Question 12

In order to qualify for the Certified Computer Crime Investigator, Basic Level certification, candidates must provide documentation of at least _______ cases in which they participated.​

A)​5
B)​10
C)15
D)20

Question 13

_______ can be used to restore backup files directly to a workstation.

A)​Belarc Advisor
B)​Norton Ghost
C)ProDiscover
D)Photorec

Question 14

?What certification program, sponsored by ISC², requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?

A)?Certified Computer Crime Investigator
B)?Certified Forensic Computer Examiner
C)Certified Cyber Forensics Professional
D)EnCase Certified Examiner

Question 15

Linux Live CDs and WinFE disks do not automatically mount hard drives, but can be used to view file systems.​

Question 16

​Because they are outdated, ribbon cables should not be considered for use within a forensics lab.

Question 17

A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.

Question 18

​A TEMPEST facility is designed to accomplish which of the following goals?

A)​Prevent data loss by maintaining consistent backups.
B)​Shield sensitive computing systems and prevent electronic eavesdropping of computer emissions.
C)Ensure network security from the Internet using comprehensive security software.
D)Protect the integrity of data.

Question 19

_______ is responsible for creating and monitoring lab policies for staff, and provides a safe and secure workplace for staff and evidence.​

A)​The lab manager
B)​The lab investigator
C)The lab secretary
D)The lab steward

Question 20

​Which option below is not a recommendation for securing storage containers?

A)​The container should be located in a restricted area.
B)​Only authorized access should be allowed, and it should be kept to a minimum.
C)Evidence containers should remain locked when they aren't under direct supervision.
D)Rooms with evidence containers should have a secured wireless network.

Question 21

As part of a business case, _______________ requires researching different products to determine which one is the best and most cost effective.​

Question 22

Match the terms with the correct definitions?.

-?A facility that can be locked and allows limited access to the room's contents

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 23

Match the terms with the correct definitions?.

-A term referring to facilities that have been hardened so that electrical signals from computers, the computer network, and telephone systems can't be monitored or accessed easily by someone outside the facility

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 24

Match the terms with the correct definitions?.

-?A certification from the International Society of Forensic Computer Examiners

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 25

A(n) ______________ is a plan that can be used to sell your services to management or clients, in which a justification is made for acquiring newer and better resources to investigate digital forensics cases.​
e.Configuration management

Question 26

_______________ are generated at the federal, state, and local levels to show the types and frequency of crimes committed.

Question 27

Match the terms with the correct definitions?.

-?A lab dedicated to computing investigations; typically, it has a variety of computers, OSs, and forensics software

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 28

​How often should hardware be replaced within a forensics lab?

A)​Every 6 to 12 months
B)Every ​12 to 18 months
C) Every ​18 to 24 months
D) Every ​24 to 30 months

Question 29

Which ISO standard below is followed by the ASCLD?

A)​17025:2005
B)​17026:2007
C)12075:2007
D)12076:2005

Question 30

Which of the following scenarios should be covered in a disaster recovery plan??

A)damage caused by lightning strikes
B)?damage caused by flood
C)damage caused by a virus contamination
D)all of the above

Question 31

A(n) _______________ acts as an evidence locker or safe to preserve the integrity of evidence.

Question 32

​What percentage of consumers utilize Intel and AMD PCs?

A)​60
B)​70
C)80
D)90

Question 33

Match the terms with the correct definitions?.

-A national organization that provides certification for computer crime investigators and digital forensics technicians

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 34

Match the terms with the correct definitions?.

-A certification from ISC² for completing the education and work experience and passing the exam

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 35

Match the terms with the correct definitions?.

-?A document that provides justification to upper management or a lender for purchasing new equipment, software, or other tools when upgrading your facility

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 36

Match the terms with the correct definitions?.

-?A certificate awarded by IACIS at completion of all portions of the exam

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 37

Match the terms with the correct definitions?.

-?The process of keeping track of all upgrades and patches you apply to your computer's OS and applications

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 38

The ________________________ provides guidelines to members for managing a forensics lab and acquiring crime and forensics lab accreditation.?

Question 39

Match the terms with the correct definitions?.

-?The process of determining how much risk is acceptable for any process or operation, such as replacing equipment

A)Business case
B)Certified Computer Examiner (CCE)
C)Certified Cyber Forensics Professional (CCFP)
D)Certified Forensic Computer Examiner (CFCE)
E)Configuration management
F)Digital forensics lab
G)High Tech Crime Network (HTCN)
H)Risk management
I)Secure facility
J)TEMPEST

Question 40

How long are computing components designed to last in a normal business environment?​

A)​12 to 16 months
B)​14 to 26 months
C)18 to 36 months
D)36 to 90 months

Question 41

What is a business case used for?​

Question 42

​What should be included as part of the approval process?

Question 43

A forensics lab should maintain a paper or electronic sign-in log for all visitors. What information should be in this log?​

Question 44

What information should be recorded every time an evidence container is opened and closed?​

Question 45

What are three questions that should be asked when performing the justification step?

Question 46

​When creating a new forensics lab, what are some questions that should be considered when calculating the budget required? List at least three questions.

Question 47

List three practices that should be followed when using a keyed padlock.

Question 48

​How should backups be stored and maintained?

Question 49

List at least three things that should be included in an audit of a digital forensics lab.

Question 50

What can be done to help prevent the buildup of static electricity?​