Question 1

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

Accepted Answer

This type of attack is known as a Denial of Service (DoS) attack, where the attacker overwhelms the router with excessive traffic, causing it to become unable to process legitimate requests.

Question 2

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

Accepted Answer

The answer of When examining the log files from a...

Question 3

In the context of file deletion process, which of the following statement holds true?

Accepted Answer

Temporary files created during booting can overwrite deleted files, potentially removing evidence.

Question 4

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital video discs (DVDs) by using a large magnet. You inform him that this method will not be effective in wiping out the data because CDs and DVDs are ______________ media used to store large amounts of data and are not affected by the magnet.

Accepted Answer

CDs and DVDs are optical media, which store data using laser technology rather than magnetic fields, so a magnet will not affect them.

Question 5

With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode internal link count reaches ________.

Accepted Answer

In Ext2fs, a file is deleted when its inode's internal link count reaches 0, indicating no directory entries are pointing to it.

Question 6

A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker. Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt. (Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.) 03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF ***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84 Len: 64 01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ................ 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 ................ 00 00 00 11 00 00 00 00 ........ 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104 Len: 1084 47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8

Accepted Answer

The log shows multiple connection attempts to port 111, which is commonly used by the RPC service. This indicates a network sweep to identify active RPC services on the network.

Question 7

The offset in a hexadecimal code is:

Accepted Answer

The answer of The offset in a hexadecimal code is:
...

Question 8

You are working on a thesis for your doctorate degree in Computer Science. Your thesis is based on HTML, DHTML, and other web-based languages and how they have evolved over the years. You navigate to archive. org and view the HTML code of news.com. You then navigate to the current news.com website and copy over the source code. While searching through the code, you come across something abnormal: What have you found?

Accepted Answer

A web bug is a tracking object embedded in a web page or email, often used to monitor user behavior without their knowledge. This could be considered abnormal if found unexpectedly in the source code.

Question 9

Which part of the Windows Registry contains the user's password file?

Accepted Answer

The user's password file is stored in the Security Account Manager (SAM) database, which is located in the HKEY_LOCAL_MACHINE\SAM subkey.

Question 10

A(n) _____________________ is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

Accepted Answer

An automated attack is one that's performed by a computer program rather than the attacker manually performing the steps in the attack sequence.

Question 11

When examining a file with a Hex Editor, what space does the file header occupy?

Accepted Answer

The answer of When examining a file with a Hex...

Question 12

Before you are called to testify as an expert, what must an attorney do first?

Accepted Answer

An attorney must first qualify you as an expert witness to establish your credentials and expertise before you can testify as an expert.

Question 13

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data. What method would be most efficient for you to acquire digital evidence from this network?

Accepted Answer

Creating a bit-stream disk-to-image file is the most efficient method for acquiring digital evidence because it creates an exact copy of the entire storage, including all files, folders, and unallocated space, which is crucial for forensic analysis. This method ensures data integrity and allows for thorough examination without altering the original data.

Question 14

The newer Macintosh Operating System is based on:

Accepted Answer

The newer Macintosh Operating System, macOS, is based on BSD Unix, which is part of the Unix family of operating systems.

Question 15

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

Accepted Answer

The format "0:1709, 150" specifies starting at sector 1709 on drive 0 and copying 150 sectors.

Question 16

How many characters long is the fixed-length MD5 algorithm checksum of a critical system file?

Accepted Answer

The MD5 algorithm produces a checksum that is 32 hexadecimal characters long.

Question 17

A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

Accepted Answer

The investigator can image the disk and try to recover deleted files to prove the violation.

Question 18

You are working for a large clothing manufacturer as a computer forensics investigator and are called in to investigate an unusual case of an employee possibly stealing clothing designs from the company and selling them under a different brand name for a different company. What you discover during the course of the investigation is that the clothing designs are actually original products of the employee and the company has no policy against an employee selling his own designs on his own time. The only thing that you can find that the employee is doing wrong is that his clothing design incorporates the same graphic symbol as that of the company with only the wording in the graphic being different. What area of the law is the employee violating?

Accepted Answer

The employee is violating trademark law, as they are using a graphic symbol that is similar to the company's trademark, which can cause confusion or imply association with the company.

Question 19

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

Accepted Answer

A single mismanaged case can significantly damage a computer forensics examiner's professional reputation due to the high stakes and trust involved in handling digital evidence.

Question 20

What file structure database would you expect to find on floppy disks?

Accepted Answer

FAT12 is the file system typically used on floppy disks due to its simplicity and efficiency for the small storage capacity of floppy disks.

Exam 2: Certified Network Defender