312-49V8 Online Practice Questions and Answers

Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a hashed format. SAM file in Windows is located at:

A. C:\windows\system32\config\SAM

B. C:\windows\system32\con\SAM

C. C:\windows\system32\Boot\SAM

D. C:\windows\system32\drivers\SAM

You have been given the task to investigate web attacks on a Windows-based server. Which of the following commands will you use to look at which sessions the machine has opened with other systems?

A. Net sessions

B. Net use

C. Net config

D. Net share

Which of the following steganography types hides the secret message in a specifically designed pattern on the document that is unclear to the average reader?

A. Open code steganography

B. Visual semagrams steganography

C. Text semagrams steganography

D. Technical steganography

What is a chain of custody?

A. A legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory

B. It is a search warrant that is required for seizing evidence at a crime scene

C. It Is a document that lists chain of windows process events

D. Chain of custody refers to obtaining preemptive court order to restrict further damage of evidence in electronic seizures

Physical security recommendations: There should be only one entrance to a forensics lab

A. True

B. False

Centralized logging is defined as gathering the computer system logs for a group of systems in a centralized location. It is used to efficiently monitor computer system logs with the frequency required to detect security violations and unusual activity.

A. True

B. False

Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information?

A. UserAssist Key

B. MountedDevices key

C. RunMRU key

D. TypedURLs key

When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.

A. Lost clusters

B. Bad clusters

C. Empty clusters

D. Unused clusters

JPEG is a commonly used method of compressing photographic Images. It uses a compression algorithm to minimize the size of the natural image, without affecting the quality of the image. The JPEG lossy algorithm divides the image in separate blocks of____________.

A. 4x4 pixels

B. 8x8 pixels

C. 16x16 pixels

D. 32x32 pixels

What is a first sector ("sector zero") of a hard disk?

A. Master boot record

B. System boot record

C. Secondary boot record

D. Hard disk boot record