Question 1

When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?

Accepted Answer

JPEG files typically start with the hexadecimal sequence FF D8 FF E0, which is known as the Start of Image (SOI) marker.

Question 2

To check for POP3 traffic using Ethereal, what port should an investigator search by?

Accepted Answer

POP3 traffic typically uses port 110, so an investigator should search for this port to identify POP3 communications.

Question 3

Where are files temporarily written in Unix when printing?

Accepted Answer

In Unix systems, files are temporarily written to the /var/spool directory when printing. This directory is used for storing data that is waiting to be processed, such as print jobs.

Question 4

Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America. What crime should Julie focus on?

Accepted Answer

Industrial espionage is a common white-collar crime in corporate America, involving the theft of trade secrets or confidential business information for commercial advantage.

Question 5

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

Accepted Answer

The answer of Sniffers that place NICs in promiscuous mode...

Question 6

Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus.  He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

Accepted Answer

The answer of Jack Smith is a forensics investigator who...

Question 7

You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?

Accepted Answer

You are monitoring at the Network layer of the OSI model, as routers operate at this layer to route packets between networks.

Exam 4: EC-Council Certified CISO

When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?

To check for POP3 traffic using Ethereal, what port should an investigator search by?

Where are files temporarily written in Unix when printing?

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?