Deck 13: Cell Phone and Mobile Device Forensics

Question 1

The law requires search warrants to contain specific descriptions of what's to be seized. For cloud environments, the property to be seized usually describes physical hardware rather than data, unless the CSP is a suspect.

Answer 1

False

Question 2

In the United States, the Electronic Communications Privacy Act (ECPA) describes 5 mechanisms the government can use to get electronic information from a provider.​

Answer 2

True

Question 3

In a prefetch file, the application's last access date and time are at offset _______________.​

A)​0x80
B)​0x88
C)0x90
D)0xD4

Answer 3

C

Question 4

The ______________ tool can be used to bypass a virtual machine's hypervisor, and can be used with OpenStack.

A)​OpenForensics
B)​FROST
C)WinHex
D)ARC

Question 5

What cloud application offers a variety of cloud services, including automation and CRM, cloud application development, and Web site marketing?​

A)IBM Cloud​
B)​Amazon EC2
C)Salesforce
D)HP Helion

Question 6

A _________________ is a tool with application programming interfaces (APIs) that allow reconfiguring a cloud on the fly; it's accessed through the application's Web interface.​

A)​programming language
B)​management plane
C)backdoor
D)configuration manager

Question 7

​The Internet is the successor to the Advanced Research Projects Agency Network (ARPANET).​

Question 8

Where is the snapshot database created by Google Drive located in Windows?​

A)​C: \Program Files\Google\Drive
B)​C: \ Users\​username​\AppData\Local\\Google\Drive
C)C: \ Users\​username​\Google\Google Drive
D)C: \Google\Drive

Question 9

The Google drive file _________________ contains a detailed list of a user's cloud transactions.​

A)​loggedtransactions.log
B)​sync_log.log
C)transact_user.db
D)history.db

Question 10

​At what offset is a prefetch file's create date & time located?

A)​0x80
B)​0x88
C)0x90
D)0x98

Question 11

The __________________________ is an organization that has developed resource documentation for CSPs and their staff. It provides guidance for privacy agreements, security measures, questionnaires, and more.​

A)​OpenStack Framework Alliance
B)​Cloud Security Alliance
C)Cloud Architecture Group
D)vCloud Security Advisory Panel

Question 12

The __________________ Dropbox file stores information on shared directories associated with a Dropbox user account and file transfers between Dropbox and the client's system.​

A)​filecache.dbx
B)​read_filejournal
C)filetx.log
D)filecache.dll

Question 13

A ________________ is written by a judge to compel someone to do or not do something, such as a CSP producing user logon activities.​

A)court order
B)​subpoena
C)warrant
D)temporary restraining order

Question 14

Which is not a valid method of deployment for a cloud?​

A)​public
B)​private
C)community
D)targeted

Question 15

Which of the following is not a valid source for cloud forensics training??

A)?(ISC)²Certified Cyber Forensics Professional
B)?INFOSEC Intitute
C)Sans Cloud Forensics with F-Response
D)A+ Security

Question 16

A search warrant can be used in any kind of case, either civil or criminal.​

Question 17

Which of the following is not one of the five mechanisms the government can use to get electronic information from a provider?​

A)search warrants
B)​subpoenas
C)court orders
D)seizure order

Question 18

Specially trained system and network administrators are often a CSP's first responders.​

Question 19

Which of the following is NOT a service level for the cloud?​ ​

A)​Software as a service
B)​Virtualization as a service
C)Platform as a service
D)Infrastructure as a service

Question 20

Metadata in a prefetch file contains an application's _____________ times in UTC format and a counter of how many times the application has run since the prefect file was created.​

A)​MAC
B)​ACL
C)startup ​/ access
D)log event

Question 21

Math each item with a statement below

-A principle of software architecture in which a single installation of a program runs on a server accessed by multiple entities (tenants). when software is access by tenants in multiple jurisdictions, conflicts in copyright and licensing laws might result.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 22

Math each item with a statement below

-A shared cloud service that provides access to common or shared data.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 23

The _____________ ​cloud service is most likely found on a desktop or a server, although it could also be found on a company network or the remote service provider's infrastructure.

Question 24

The __________________ file contains cid (client ID), clientType, clientVersion, device, deviceID, and timeUtc values relevant to OneDrive.

Question 25

Math each item with a statement below

-A cloud service dedicated to a single organization.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 26

Math each item with a statement below

-?With this cloud service level, an organization supplies its own OS, applications, databases, and operations staff, and the cloud provider is responsible only for selling or leasing the hardware.

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 27

Math each item with a statement below

-A cloud service that's available to the general public.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 28

Describe the role of incident first responders, and discuss some factors that should be addressed with first responders.

Question 29

Math each item with a statement below

-Destroying, altering, hiding, or failing to preserve evidence, whether it's intentional or a result of negligence.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 30

A _____________ is a contract between a CSP and a customer that describes what services are being provided and at what level.​

Question 31

The ________________ script converts Dropbox's config.db into a readable text file.?

Question 32

Math each item with a statement below

-A cloud deployment model that combines public, private, or community cloud services under one cloud. Segregation of data is used to protect private cloud storage and applications.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 33

Math each item with a statement below

-Deallocating cloud resources that were assigned to a user or an organization.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 34

What information below is not something recorded in Google Drive's snapshot.db file?​

A)​file access records
B)​URL pathnames
C)modified and created times
D) file SHA values and sizes

Question 35

Math each item with a statement below

-Allocating cloud resources, such as additional disk space.?

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 36

?With cloud systems running in a virtual environment, _______________ can give you valuable information before, during, and after an incident.

A)?RAM
B)?snapshot
C)live acquisition
D)carving

Question 37

Math each item with a statement below

-?Vendors that provide on-demand network access to a shared pool of resources (typically remote data storage or Web applications)

A)cloud service providers (CSPs)
B)community cloud
C)deprovisioning
D)hybrid cloud
E)infrastructure as a service (IaaS)
F)multitenancy
G)private cloud
H)provisioning
I)public cloud
J)spoliation

Question 38

__________________ uses an "ideal lattice" mathematical formula to encrypt data.
a.​cloud service providers (CSPs)

Question 39

To reduce the time it takes to start applications, Microsoft has created __________ files, which contain the DLL pathnames and metadata used by applications.​

A)cache​
B)​prefetch
C)config
D)temp

Question 40

What cloud service listed below provides a freeware type 1 hypervisor used for public and private clouds?​

A)​Cisco Cloud Computing
B)​Amazon EC2
C)XenServer and XenCenter Windows Management Console
D)HP Helion

Question 41

What capabilities should a forensic tool have to handle acquiring data from the cloud?

Question 42

Describe how the Forensic Open-Stack Tools (FROST) bypasses a virtual machine's hypervisor.​

Question 43

Explain what a government agency subpoena is, and describe how it is used.

Question 44

Explain what non-government and civil litigation subpoenas are, and describe how they work.

Question 45

Explain what "anti-forensics" is, and provide detail on some anti-forensics tactics.

Question 46

Explain what a service level agreement is.

Question 47

Discuss the four different types of cloud deployment methods.?

Question 48

Explain why digital forensics examiners should be most concerned with restrictions applied to customers and security measures.​

Question 49

Explain what a court order is, and describe how it is used.