> > Computer Science MCQs > Computer forensics MCQs

Computer forensics MCQ

The __________________ is the version of pcap available for linux based operating systems.

Wincap

Libcap

Tcpcap

Netcap

Answer

Correct Answer: Libcap

Note: This Question is unanswered, help us to find answer for this one

Elements in a smartart graphic are grouped in ____.

Aggregates

Clusters

Levels

Fields.

Answer

Correct Answer: Levels

Note: This Question is unanswered, help us to find answer for this one

In microsoft exchange, a(n) ____ file is responsible for messages formatted with mapi.

Edb

Cfg

Mbx

Mapi

Answer

Correct Answer: Edb

Note: This Question is unanswered, help us to find answer for this one

In facebook the ____ info simply tells you the last time a person logged on.

Neoprint

Extended subscriber

Basic subscriber

Advanced subscriber

Answer

Correct Answer: Basic subscriber

Note: This Question is unanswered, help us to find answer for this one

In order to retrieve logs from exchange, the powershell cmdlet _______________________ can be used.

GetExchangeLogs.psl

GetLogInfo.psl

ShowExchangeHistrory.psl

GetTransactionLogStats.psl

Answer

Correct Answer: GetTransactionLogStats.psl

Note: This Question is unanswered, help us to find answer for this one

A judge _____ accept(s) the challenges put forth by attorneys regarding jury selection.

Characteristics

Excluded

Sometimes

Same as

Answer

Correct Answer: Sometimes

Note: This Question is unanswered, help us to find answer for this one

To complete a forensic disk analysis and examination, you need to create a ____.

Forensic disk copy

Risk assessment

Budget plan

Report

Answer

Correct Answer: Report

Note: This Question is unanswered, help us to find answer for this one

Software forensics tools are commonly used to copy data from a suspects disk drive to a(n) ____.

Executable file

Video file

Audio file

Image file

Answer

Correct Answer: Image file

Note: This Question is unanswered, help us to find answer for this one

After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

Exhibit

Affidavit

Allegation

Verdict

Answer

Correct Answer: Verdict

Note: This Question is unanswered, help us to find answer for this one

A ____ is a column of tracks on two or more disk platters.

Cylinder

Sector

Track

Head

Answer

Correct Answer: Cylinder

Note: This Question is unanswered, help us to find answer for this one

Details concerning the average age, sex, and income of a magazine's readership are known as _____.

Writer PROFILE

READER PROFILE

Both of these

None of these

Answer

Correct Answer: READER PROFILE

Note: This Question is unanswered, help us to find answer for this one

Families operate as a _____________ where members interact with one another to form a whole.

System

Control

Personality

Communication

Answer

Correct Answer: System

Note: This Question is unanswered, help us to find answer for this one

The specificity of microcrystalline tests is ________ the specificity of color tests.

Less than

The same as

Greater than

None of the above

Answer

Correct Answer: Greater than

Note: This Question is unanswered, help us to find answer for this one

Cases of arson, assault, and murder of homosexuals __________ in the 1990s.

Decreased slightly

Decreased dramatically

Increased slightly

Increased dramatically

Answer

Correct Answer: Increased dramatically

Note: This Question is unanswered, help us to find answer for this one

Exchange logs information about changes to its data in a(n) ____ log.

Checkpoint.

Communication.

Transaction.

Tracking

Answer

Correct Answer: Transaction.

Note: This Question is unanswered, help us to find answer for this one

Some popular web-based e-mail service providers are gmail, ____, outlook online, and yahoo!

Zoho

Google Docs

Microsoft Office Web Apps

Pda

Answer

Correct Answer: Zoho

Note: This Question is unanswered, help us to find answer for this one

Winhex provides several hashing algorithms, such as md5 and ____.

CRC

SHA-1

AES

RC4

Answer

Correct Answer: SHA-1

Note: This Question is unanswered, help us to find answer for this one

The ____ digital network, a faster version of gsm, is designed to deliver data.

TDMA

IDEN

EDGE

D-AMPS

Answer

Correct Answer: EDGE

Note: This Question is unanswered, help us to find answer for this one

Some e-mail systems store messages in flat plaintext files, known as a(n) ____ format.

SMTP

POP3

Mbox

MIME

Answer

Correct Answer: Mbox

Note: This Question is unanswered, help us to find answer for this one

If you cant open a graphics file in an image viewer, the next step is to examine the files ____.

Size

Extension

Header data

All of the above

Answer

Correct Answer: Header data

Note: This Question is unanswered, help us to find answer for this one

Candidates who complete the iacis test successfully are designated as a _______.

Certified Forensic Computer Examiner (CFCE)

Certified Forensics Investigator (CFI)

Certified Investigative Forensics Examiner (CIFE)

Certified Investigative Examiner (CIE)

Answer

Correct Answer: Certified Forensic Computer Examiner (CFCE)

Note: This Question is unanswered, help us to find answer for this one

____ alters hash values, which makes cracking passwords more difficult.

Hybrid attack

Rainbow table

Salting passwords

PRTK

Answer

Correct Answer: Salting passwords

Note: This Question is unanswered, help us to find answer for this one

Analog footage can be digitized using video _____ equipment.

Capture

Container

MIDI

Digitizing

Answer

Correct Answer: Capture

Note: This Question is unanswered, help us to find answer for this one

To view e-mail headers on yahoo! click the ____ list arrow, and click view raw message.

Mbox

Zoho?

.edb

Answer

Correct Answer: More

Note: This Question is unanswered, help us to find answer for this one

The most important laws applying to attorneys and witnesses are the ____.

Professional ethics

Rules of ethics

Rules of evidence

None of these

Answer

Correct Answer: Professional ethics

Note: This Question is unanswered, help us to find answer for this one

The ______________ imaging tool produces three proprietary formats: idif, irbf, and ieif.

IXimager

Sparse acquisition

Server farm

$LogFile

Answer

Correct Answer: IXimager

Note: This Question is unanswered, help us to find answer for this one

The _____________ format is a proprietary format used by adobe photoshop.

Psd

Tga

Lzip

XIF

Dxf

Answer

Correct Answer: Psd

Note: This Question is unanswered, help us to find answer for this one

A _______ is not a private sector organization.

Small to medium business

Large corporation

Nongovernment organization

Hospital

Answer

Correct Answer: Hospital

Note: This Question is unanswered, help us to find answer for this one

A ____ differs from a trial testimony because there is no jury or judge.

Rebuttal

Plaintiff

Civil case

Deposition

Answer

Correct Answer: Deposition

Note: This Question is unanswered, help us to find answer for this one

Fre ____ describes whether the expert is qualified and whether the expert opinion can be helpful.

702

703

704

705

Answer

Correct Answer: 702

Note: This Question is unanswered, help us to find answer for this one

Within windows vista and later, partition gaps are _____________ bytes in length.

128

256

512

Answer

Correct Answer: 128

Note: This Question is unanswered, help us to find answer for this one

When cases go to trial, you as a forensics examiner can play one of ____ roles.

Answer

Correct Answer: 2

Note: This Question is unanswered, help us to find answer for this one

Validate your tools and verify your evidence with ____ to ensure its integrity.

Hashing algorithms

Watermarks

Steganography

Digital certificates

Answer

Correct Answer: Hashing algorithms

Note: This Question is unanswered, help us to find answer for this one

The term for detecting and analyzing steganography files is _________________.

Carving

Steganology

Steganalysis

Steganomics

Answer

Correct Answer: Steganalysis

Note: This Question is unanswered, help us to find answer for this one

The prodiscover utility makes use of the proprietary _______________ file format.

Iso

Pro

Img

Eve.

Answer

Correct Answer: Eve.

Note: This Question is unanswered, help us to find answer for this one

The lempel-ziv-welch (lzw) algorithm is used in _____________ compression.

Jpeg

Exif

Psd

FFE1

FFD9

Answer

Correct Answer: FFD9

Note: This Question is unanswered, help us to find answer for this one

The _______________ format is an image format produced by the nuance paperport scanning program.

.xif

.dxf

Both a and b

None of thesethe _______________ format is an image format produced by the nuance paperport scanning program.

.xif

.dxf

Both a and b

None of these

Answer

Correct Answer: .xif

Note: This Question is unanswered, help us to find answer for this one

The _______ is not one of the three stages of a typical criminal case.

Complaint

Investigation

Civil suit

Prosecution

Answer

Correct Answer: Civil suit

Note: This Question is unanswered, help us to find answer for this one

The _______ command was developed by nicholas harbour of the defense computer forensics laboratory.

Bitcopy

Dcfldd

Raw

Echo

Answer

Correct Answer: Dcfldd

Note: This Question is unanswered, help us to find answer for this one

The ____ is the most important part of testimony at a trial.

Cross-examination

Direct examination

Rebuttal

Motions in limine

Answer

Correct Answer: Direct examination

Note: This Question is unanswered, help us to find answer for this one

Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.

Federal Rules of Evidence

federal consistency standards

Federal proceedings law

data recovery

Answer

Correct Answer: Federal Rules of Evidence

Note: This Question is unanswered, help us to find answer for this one

One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.

Nigerian Scam

Lake Venture Scam

Conficker virus

Iloveyou Scam.

Answer

Correct Answer: Nigerian Scam

Note: This Question is unanswered, help us to find answer for this one

In a prefetch file, the application's last access date and time are at offset ____.

0x88

0x90

0x85

0x80

Answer

Correct Answer: 0x88

Note: This Question is unanswered, help us to find answer for this one

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

Two

Five

One

Three

Answer

Correct Answer: One

Note: This Question is unanswered, help us to find answer for this one

If a microphone is present during your testimony, place it ____ to eight inches from you.

Answer

Correct Answer: 6

Note: This Question is unanswered, help us to find answer for this one

How you format _____________ is less important than being consistent in applying formatting.

Words

Text

Paragraphs

Sections

Answer

Correct Answer: Text

Note: This Question is unanswered, help us to find answer for this one

For exif jpeg files, the hexadecimal value starting at offset 2 is _____________.

FFE0

FFE1

FFD8

FFD9

Answer

Correct Answer: FFE1

Note: This Question is unanswered, help us to find answer for this one

Ext4f can support disk partitions as large as ____ tb.

Answer

Correct Answer: 16

Note: This Question is unanswered, help us to find answer for this one

Criminal law deals with harm to , whereas civil law involves harm to .

Individuals; groups

Civil law.

Society; individuals

Society; government

Answer

Correct Answer: Society; individuals

Note: This Question is unanswered, help us to find answer for this one

Blu-ray discs are the successor to the dvd and store up to __________ per layer.

25 GB

50 GB

75 GB

100 GB

Answer

Correct Answer: 25 GB

Note: This Question is unanswered, help us to find answer for this one

Autopsy uses ____ to validate an image.

AFD

AFF

MD5

RC4

Answer

Correct Answer: MD5

Note: This Question is unanswered, help us to find answer for this one

An evidence custody form does not usually contain _______.

A witness list

the nature of the case

a description of evidence

Vendor names for computer components

Answer

Correct Answer: A witness list

Note: This Question is unanswered, help us to find answer for this one

A(n) _______________ acts as an evidence locker or safe to preserve the integrity of evidence.

Secure Facility.

Silver-Platter

Digital Forensics

Hash Value

Answer

Correct Answer: Secure Facility.

Note: This Question is unanswered, help us to find answer for this one

____, or mirrored striping with parity, is a combination of raid 1 and raid 5.

RAID 0

RAID 15

RAID 10

RAID 16

Answer

Correct Answer: RAID 15

Note: This Question is unanswered, help us to find answer for this one

_______ is not recommended for a digital forensics workstation.

A text editor tool

A write-blocker device

An SCSI card

Remote access software

Answer

Correct Answer: Remote access software

Note: This Question is unanswered, help us to find answer for this one

_______ is not one of the functions of the investigations triad.

Digital investigations

Data recovery

Vulnerability/threat assessment and risk management

Network intrusion detection and incident response

Answer

Correct Answer: Data recovery

Note: This Question is unanswered, help us to find answer for this one

_______ describes an accusation of fact that a crime has been committed.

Attrition

Attribution

Allegation

Assignment

Answer

Correct Answer: Allegation

Note: This Question is unanswered, help us to find answer for this one

_______ can be used with the dcfldd command to compare an image file to the original medium.

Compare

Cmp

Imgcheck

Answer

Correct Answer: Vf

Note: This Question is unanswered, help us to find answer for this one

Current distributions of linux include two hashing algorithm utilities: md5sum and ____.

Hashsum

Sha1sum

Shasum

Rcsum

Answer

Correct Answer: Shasum

Note: This Question is unanswered, help us to find answer for this one

Fre ____ describes whether basis for the testimony is adequate.

700

701

702

703

Answer

Correct Answer: 703

Note: This Question is unanswered, help us to find answer for this one

Forensics tools such as ____ can retrieve deleted files for use as evidence.

ProDiscover Basic

FDisk

ProDelete

GainFile

Answer

Correct Answer: ProDiscover Basic

Note: This Question is unanswered, help us to find answer for this one

One technique for extracting evidence from large systems is called ____.

Raw format

Sparse acquisition

Proprietary format

Raid imaging

Answer

Correct Answer: Sparse acquisition

Note: This Question is unanswered, help us to find answer for this one

Generally, digital records are considered admissible if they qualify as a ____ record.

Probable cause

Sparse acquisition

Business

Much easier than

Answer

Correct Answer: Business

Note: This Question is unanswered, help us to find answer for this one

_______ is a common cause for lost or corrupted evidence.

Keyed hash set

Computer-stored records

Professional curiosity

Probable cause

Answer

Correct Answer: Professional curiosity

Note: This Question is unanswered, help us to find answer for this one

There are two types of depositions: ____ and testimony preservation.

Examination

Discovery

Direct

Rebuttal

Answer

Correct Answer: Discovery

Note: This Question is unanswered, help us to find answer for this one

Computer forensics examiners have two roles: fact witness and ____ witness.

Professional

Direct

Discovery

Expert

Answer

Correct Answer: Expert

Note: This Question is unanswered, help us to find answer for this one

Addresses that allow the mft to link to nonresident files are known as _______________.

Zone Bit Recorder (ZBR)

Boot.ini

The outer most track

Logical cluster numbers

Answer

Correct Answer: Logical cluster numbers

Note: This Question is unanswered, help us to find answer for this one

A(n) ____ is a person using a computer to perform routine tasks other than systems administration.

Warning banner

Consumer

User banner

End user

Answer

Correct Answer: End user

Note: This Question is unanswered, help us to find answer for this one

_______ is the utility used by the prodiscover program for remote access.

SubSe7en

10pht

PDServer

VNCServer

Answer

Correct Answer: PDServer

Note: This Question is unanswered, help us to find answer for this one

_______ does not recover data in free or slack space.

Sparse acquisition

Fourth Amendment

U.S. DOJ

Answer

Correct Answer: Sparse acquisition

Note: This Question is unanswered, help us to find answer for this one

____ is a written list of objections to certain testimony or exhibits.

Defendant

Empanelling the jury

Plaintiff

Motion in limine

Answer

Correct Answer: Motion in limine

Note: This Question is unanswered, help us to find answer for this one

Courts consider evidence data in a computer as ____ evidence.

Emotional

Biological

Hearsay

Physical

Answer

Correct Answer: Physical

Note: This Question is unanswered, help us to find answer for this one

____ is a core win32 subsystem dll file.

Hal.dll

User32.sys

Pagefile.sys

Ntoskrnl.exe

Answer

Correct Answer: User32.sys

Note: This Question is unanswered, help us to find answer for this one

The simplest way to access a file header is to use a(n) ____ editor

Hexadecimal

Image

Disk

Text

Answer

Correct Answer: Hexadecimal

Note: This Question is unanswered, help us to find answer for this one

The physical data copy subfunction exists under the ______________ function.

Reporting

Validation / verification

Extraction

Acquisition

Answer

Correct Answer: Acquisition

Note: This Question is unanswered, help us to find answer for this one

Most users rely on ____ for finding, viewing, and managing information on their computers.

Search boxes

The address bar

The resolution finder

Folder windows

Answer

Correct Answer: Folder windows

Note: This Question is unanswered, help us to find answer for this one

Compared to todays computers, computers from the 1970s were ________

.Bigger and more powerful

Smaller and more powerful

Bigger and less powerful

Smaller and less powerful

Answer

Correct Answer: Bigger and less powerful

Note: This Question is unanswered, help us to find answer for this one

____ is a session data probe, collector, and analysis tool.

Etherape

Argus

Tcpslice

Tethereal

Answer

Correct Answer: Argus

Note: This Question is unanswered, help us to find answer for this one

The ____ is where directories and files are stored on a disk drive.

/etc/group

/etc/exports

Data block

None of these

Answer

Correct Answer: Data block

Note: This Question is unanswered, help us to find answer for this one

The linux command _____ can be used to write bit-stream data to files.

Write

Cat

Dump

Answer

Correct Answer: DD

Note: This Question is unanswered, help us to find answer for this one

Using steganography to hide a message inside a larger message is known as __________.

Data transformation

Data contraception

Data hiding

Data fabrication

Answer

Correct Answer: Data transformation

Note: This Question is unanswered, help us to find answer for this one

Attorneys search ____ for information on expert witnesses.

Cross-examination banks

Examination banks

Deposition banks

Disqualification banks

Answer

Correct Answer: Deposition banks

Note: This Question is unanswered, help us to find answer for this one

Passwords are typically stored as one-way _____________ rather than in plaintext.

Variables

hex values

Hashes

Slack spaces

Answer

Correct Answer: Variables

Note: This Question is unanswered, help us to find answer for this one

Hard drives that run __________ address blocks, or integer multiples of blocks, at a time.

Linux

Windows

Vista

Mac

Answer

Correct Answer: Linux

Note: This Question is unanswered, help us to find answer for this one

Getting a hash value with a is much faster and easier than with a(n) .

Bookmarks

Hiding

Scope creep

Hexadecimal editor, computer forensics tool

Answer

Correct Answer: Hexadecimal editor, computer forensics tool

Note: This Question is unanswered, help us to find answer for this one

Confidential business data included with the criminal evidence are referred to as ____ data.

Business

Commingled

Sniffing

Government

Answer

Correct Answer: Commingled

Note: This Question is unanswered, help us to find answer for this one

_______ would not be found in an initial-response field kit.

Computer evidence bags (antistatic bags)

Leather gloves and disposable latex gloves

A digital camera with extra batteries or 35mm camera with film and flash

External USB devices or a portable hard drive

Answer

Correct Answer: Leather gloves and disposable latex gloves

Note: This Question is unanswered, help us to find answer for this one

_______ describes the characteristics of a safe storage container.

ISO2960

NISPOM

SSO 990

STORSEC

Answer

Correct Answer: NISPOM

Note: This Question is unanswered, help us to find answer for this one

More Computer Science Subjects

Introduction to computer

Operating Systems

Programming skill

Computer Graphics

Information System and Security

Computer Literacy

Computer Essentials

Computer Viruses

Flowcharts

Data Storage

Input and Output Devices

Central Processing Unit (CPU)

User Support

Hard Drive

Memory Devices

Computer Concepts

Virtual Computer

Internet Research

Internet Protocol

Web Site & Design

More Resources

Computer Science Skill Assessment

Computer Science PDF

Related MCQs

Core Java

CRISC Information Systems Control

CSS

CSS 3

Cyber Security

Computer forensics MCQ

The __________________ is the version of pcap available for linux based operating systems.

Elements in a smartart graphic are grouped in ____.

In microsoft exchange, a(n) ____ file is responsible for messages formatted with mapi.

In facebook the ____ info simply tells you the last time a person logged on.

In order to retrieve logs from exchange, the powershell cmdlet _______________________ can be used.

A judge _____ accept(s) the challenges put forth by attorneys regarding jury selection.

To complete a forensic disk analysis and examination, you need to create a ____.

Software forensics tools are commonly used to copy data from a suspects disk drive to a(n) ____.

After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

A ____ is a column of tracks on two or more disk platters.

Details concerning the average age, sex, and income of a magazine's readership are known as _____.

Families operate as a _____________ where members interact with one another to form a whole.

The specificity of microcrystalline tests is ________ the specificity of color tests.

Cases of arson, assault, and murder of homosexuals __________ in the 1990s.

Exchange logs information about changes to its data in a(n) ____ log.

Some popular web-based e-mail service providers are gmail, ____, outlook online, and yahoo!

Winhex provides several hashing algorithms, such as md5 and ____.

The ____ digital network, a faster version of gsm, is designed to deliver data.

Some e-mail systems store messages in flat plaintext files, known as a(n) ____ format.

If you cant open a graphics file in an image viewer, the next step is to examine the files ____.

Candidates who complete the iacis test successfully are designated as a _______.

____ alters hash values, which makes cracking passwords more difficult.

Analog footage can be digitized using video _____ equipment.

To view e-mail headers on yahoo! click the ____ list arrow, and click view raw message.

The most important laws applying to attorneys and witnesses are the ____.

The ______________ imaging tool produces three proprietary formats: idif, irbf, and ieif.

The _____________ format is a proprietary format used by adobe photoshop.

A _______ is not a private sector organization.

A ____ differs from a trial testimony because there is no jury or judge.

Fre ____ describes whether the expert is qualified and whether the expert opinion can be helpful.

Within windows vista and later, partition gaps are _____________ bytes in length.

When cases go to trial, you as a forensics examiner can play one of ____ roles.

Validate your tools and verify your evidence with ____ to ensure its integrity.

The term for detecting and analyzing steganography files is _________________.

The prodiscover utility makes use of the proprietary _______________ file format.

The lempel-ziv-welch (lzw) algorithm is used in _____________ compression.

The _______________ format is an image format produced by the nuance paperport scanning program.

The _______ is not one of the three stages of a typical criminal case.

The _______ command was developed by nicholas harbour of the defense computer forensics laboratory.

The ____ is the most important part of testimony at a trial.

Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.

One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.

In a prefetch file, the application's last access date and time are at offset ____.

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

If a microphone is present during your testimony, place it ____ to eight inches from you.

How you format _____________ is less important than being consistent in applying formatting.

For exif jpeg files, the hexadecimal value starting at offset 2 is _____________.

Ext4f can support disk partitions as large as ____ tb.

Criminal law deals with harm to __________, whereas civil law involves harm to __________.

Blu-ray discs are the successor to the dvd and store up to __________ per layer.

Autopsy uses ____ to validate an image.

An evidence custody form does not usually contain _______.

A(n) _______________ acts as an evidence locker or safe to preserve the integrity of evidence.

____, or mirrored striping with parity, is a combination of raid 1 and raid 5.

_______ is not recommended for a digital forensics workstation.

_______ is not one of the functions of the investigations triad.

_______ describes an accusation of fact that a crime has been committed.

_______ can be used with the dcfldd command to compare an image file to the original medium.

Current distributions of linux include two hashing algorithm utilities: md5sum and ____.

Fre ____ describes whether basis for the testimony is adequate.

Forensics tools such as ____ can retrieve deleted files for use as evidence.

One technique for extracting evidence from large systems is called ____.

Generally, digital records are considered admissible if they qualify as a ____ record.

_______ is a common cause for lost or corrupted evidence.

There are two types of depositions: ____ and testimony preservation.

Computer forensics examiners have two roles: fact witness and ____ witness.

Addresses that allow the mft to link to nonresident files are known as _______________.

A(n) ____ is a person using a computer to perform routine tasks other than systems administration.

_______ is the utility used by the prodiscover program for remote access.

_______ does not recover data in free or slack space.

____ is a written list of objections to certain testimony or exhibits.

Courts consider evidence data in a computer as ____ evidence.

____ is a core win32 subsystem dll file.

The simplest way to access a file header is to use a(n) ____ editor

The physical data copy subfunction exists under the ______________ function.

Most users rely on ____ for finding, viewing, and managing information on their computers.

Compared to todays computers, computers from the 1970s were ________

____ is a session data probe, collector, and analysis tool.

The ____ is where directories and files are stored on a disk drive.

Criminal law deals with harm to , whereas civil law involves harm to .

Getting a hash value with a is much faster and easier than with a(n) .