312-49V10 Online Practice Questions and Answers

Billy, a computer forensics expert, has recovered a large number of DBX files during forensic investigation of a laptop. Which of the following email clients he can use to analyze the DBX files?

A. Microsoft Outlook

B. Microsoft Outlook Express

C. Mozilla Thunderoird

D. Eudora

Shortcuts are the files with the extension .Ink that are created and are accessed by the users. These files provide you with information about:

A. Files or network shares

B. Running application

C. Application logs

D. System logs

Syslog is a client/server protocol standard for forwarding log messages across an IP network. Syslog uses ___________to transfer log messages in a clear text format.

A. TCP

B. FTP

C. SMTP

D. POP

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

A. All forms should be placed in an approved secure container because they are now primary evidence in the case

B. The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file

C. All forms should be placed in the report file because they are now primary evidence in the case

D. The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an

approved secure container

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

A. Recycle Bin

B. MSDOS.sys

C. BIOS

D. Case files

What TCP/UDP port does the toolkit program netstat use?

A. Port 7

B. Port 15

C. Port 23

D. Port 69

To calculate the number of bytes on a disk, the formula is: CHS**

A. number of circles x number of halves x number of sides x 512 bytes per sector

B. number of cylinders x number of halves x number of shims x 512 bytes per sector

C. number of cells x number of heads x number of sides x 512 bytes per sector

D. number of cylinders x number of heads x number of sides x 512 bytes per sector

The use of warning banners helps a company avoid litigation by overcoming an employees assumed _________ when connecting to the company intranet, network, or virtual private network (VPN) and will allow the company investigators to monitor, search, and retrievecompany? intranet, network, or virtual private network (VPN) and will allow the company? investigators to monitor, search, and retrieve information stored within the network.

A. Right to work

B. Right of free speech

C. Right to Internet access

D. Right of privacy

In Linux OS, different log files hold different information, which help the investigators to analyze various issues during a security incident. What information can the investigators obtain from the log file var/log/ dmesg?

A. Kernel ring buffer information

B. All mail server message logs

C. Global system messages

D. Debugging log messages

An investigator has extracted the device descriptor for a 1GB thumb drive that looks like: DiskandVen_Best_BuyandProd_Geek_Squad_U3andRev_6.15. What does the “Geek_Squad” part represent?

A. Product description

B. Manufacturer Details

C. Developer description

D. Software or OS used