Weekend Sale Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

GIAC GCFA GIACCertified Forensics Analyst Exam Practice Test

Page: 1 / 32
Total 318 questions

GIACCertified Forensics Analyst Questions and Answers

Question 1

You work as a Network Administrator for Net World International. You have configured the hard disk drive of your computer as shown in the image below:

Question # 1

The computer is configured to dual-boot with Windows 2000 Server and Windows 98. While working on Windows 2000 Server, you save a file on the 6GB partition. You are unable to find the file while working on Windows 98. You are not even able to access the partition on which the file is saved. What is the most likely cause?

Options:

A.

The file is corrupt.

B.

The 6GB partition is corrupt.

C.

Windows 98 does not support the NTFS file system.

D.

Files saved in Windows 98 are not supported by Windows 2000.

Question 2

Which of the following type of file systems is not supported by Linux kernel?

Options:

A.

vFAT

B.

NTFS

C.

HFS

D.

FAT32

Question 3

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options:

A.

Linux

B.

MINIX 3

C.

Windows XP

D.

Mac OS

Question 4

Which of the following file systems is designed by Sun Microsystems?

Options:

A.

NTFS

B.

CIFS

C.

ext2

D.

ZFS

Question 5

Which of the following tools can be used to perform tasks such as Windows password cracking, Windows enumeration, and VoIP session sniffing?

Options:

A.

John the Ripper

B.

L0phtcrack

C.

Obiwan

D.

Cain

Question 6

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He receives the following e-mail:

Question # 6

The e-mail that John has received is an example of __________.

Options:

A.

Virus hoaxes

B.

Spambots

C.

Social engineering attacks

D.

Chain letters

Question 7

Which of the following is a file management tool?

Options:

A.

Defrag

B.

MSCONFIG

C.

Device Manager

D.

Windows Explorer

Question 8

Which of the following sections of an investigative report covers the background and summary of the report including the outcome of the case and the list of allegations?

Options:

A.

Section 2

B.

Section 4

C.

Section 3

D.

Section 1

Question 9

Which of the following is the first computer virus that was used to infect the boot sector of storage media formatted with the DOS File Allocation Table (FAT) file system?

Options:

A.

Melissa

B.

Tequila

C.

Brain

D.

I love you

Question 10

Which of the following parameters is NOT used for calculating the capacity of the hard disk?

Options:

A.

Bytes per sector

B.

Number of heads

C.

Total number of sectors

D.

Number of platters

Question 11

Identify the port in the image given below, which can be connected to the hub to extend the number of ports, and up to 127 devices can be connected to it?

Question # 11

Options:

Question 12

You want to upgrade a partition in your computer's hard disk drive from FAT to NTFS. Which of the following DOS commands will you use to accomplish this?

Options:

A.

FORMAT C: /s

B.

CONVERT C: /fs:ntfs

C.

SYS C:

D.

FDISK /mbr

Question 13

Maria works as a professional Ethical Hacker. She recently got a project to test the security of www.we-are-secure.com. Arrange the three pre-test phases of the attack to test the security of weare-secure.

Question # 13

Options:

A.

Question 14

You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company data. Which of the following is the most important step for you to take in preserving the chain of custody?

Options:

A.

Preserve the email server including all logs.

B.

Make copies of that employee's email.

C.

Seize the employee's PC.

D.

Place spyware on the employee's PC to confirm these activities.

Question 15

You work as a Network Administrator for Perfect Solutions Inc. You install Windows 98 on a computer. By default, which of the following folders does Windows 98 setup use to keep the registry tools?

Options:

A.

$SYSTEMROOT$REGISTRY

B.

$SYSTEMROOT$WINDOWS

C.

$SYSTEMROOT$WINDOWSREGISTRY

D.

$SYSTEMROOT$WINDOWSSYSTEM32

Question 16

Fill in the blank with the appropriate name.

_____is a list, which specifies the order of volatility of data in a Windows based system.

Options:

A.

RFC 3227

Question 17

Mark has been hired by a company to work as a Network Assistant. He is assigned the task to

configure a dial-up connection. He is configuring a laptop. Which of the following protocols should he disable to ensure that the password is encrypted during remote access?

Options:

A.

MSCHAP

B.

SPAP

C.

MSCHAP V2

D.

PAP

Question 18

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He wants to test the effect of a virus on the We-are-secure server. He injects the virus on the server and, as a result, the server becomes infected with the virus even though an established antivirus program is installed on the server. Which of the following do you think are the reasons why the antivirus installed on the server did not detect the virus injected by John?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

The mutation engine of the virus is generating a new encrypted code.

B.

The virus, used by John, is not in the database of the antivirus program installed on the server.

C.

John has created a new virus.

D.

John has changed the signature of the virus.

Question 19

John works as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. John is working as a root user on the Linux operating system. Which of the following commands will John use to display information about all mounted file systems?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

du

B.

ls

C.

df

D.

df -m

Question 20

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack. Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

System logs

B.

Event logs

C.

Web server logs

D.

Program logs

Question 21

Brutus is a password cracking tool that can be used to crack the following authentications:

HTTP (Basic Authentication)

HTTP (HTML Form/CGI)

POP3 (Post Office Protocol v3)

FTP (File Transfer Protocol)

SMB (Server Message Block)

Telnet

Which of the following attacks can be performed by Brutus for password cracking?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Replay attack

B.

Dictionary attack

C.

Man-in-the-middle attack

D.

Hybrid attack

E.

Brute force attack

Question 22

Which of the following firewalls depends on the three-way handshake of the TCP protocol?

Options:

A.

Proxy-based firewall

B.

Stateful firewall

C.

Packet filter firewall

D.

Endian firewall

Question 23

You are responsible for maintaining and troubleshooting PC's at your company. The receptionist reports her screen has gone blue. When you get there you notice the 'blue screen of death' with an error message NTFS_FILE_SYSTEM. What is the most likely cause of this error?

Options:

A.

The hard disk is corrupt

B.

A virus

C.

Windows was installed improperly.

D.

Get the latest patch for Windows.

Question 24

Which of the following anti-child pornography organizations helps local communities to create

programs and develop strategies to investigate child exploitation?

Options:

A.

Anti-Child Porn.org

B.

Project Safe Childhood (PSC)

C.

Innocent Images National Imitative (IINI)

D.

Internet Crimes Against Children (ICAC)

Question 25

Which of the following tools is used to extract human understandable interpretation from the computer binary files?

Options:

A.

FTK Imager

B.

Word Extractor

C.

FAU

D.

Galleta

Question 26

In which of the following files does the Linux operating system store passwords?

Options:

A.

Password

B.

Passwd

C.

Shadow

D.

SAM

Question 27

Sandra wants to create a full system state backup of her computer, which is running on Microsoft Windows XP operating system. Which of the following is saved in full state system backup?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

file system information

B.

Registry

C.

Windows boot files

D.

Active Directory (NTDS)

Question 28

You work as a Network Administrator for Tech Perfect Inc. The company has a TCP/IP-based network. You are configuring a wireless LAN on the network. You experience interference on your network. Through investigation, you come to know that three foreign WAPs are within the range of your LAN. Although they have different SSIDs than yours, they are working on the same channel as yours.

Which of the following steps will you take to reduce the interference?

Options:

A.

Configure the same SSID as of the foreign networks.

B.

Install a router on your network.

C.

Change your WAP's channel.

D.

Install an external antenna.

Question 29

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He has successfully completed the following pre-attack phases while testing the security of the server:

Footprinting

Scanning

Now he wants to conduct the enumeration phase. Which of the following tools can John use to conduct it?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

WinSSLMiM

B.

PsPasswd

C.

PsFile

D.

UserInfo

Question 30

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

Options:

A.

Recovery phase

B.

Eradication phase

C.

Identification phase

D.

Containment phase

E.

Preparation phase

Question 31

John works as a professional Ethical Hacker. He has been assigned the task of testing the security of www.we-are-secure.com. He has performed the footprinting step and now he has enough information to begin scanning in order to detect active computers. He sends a ping request to a computer using ICMP type 13. What kind of ICMP message is John using to send the ICMP ping request message?

Options:

A.

Address mask request

B.

Echo request

C.

Information request (obsolete)

D.

Timestamp request (obsolete)

Question 32

Adam works as a Computer Hacking Forensic Investigator. He has been assigned a project to

investigate child pornography. As the first step, Adam found that the accused is using a Peer-to-peer application to network different computers together over the internet and sharing pornographic materials of children with others. Which of the following are Peer-to-Peer applications?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Gnutella

B.

Kismet

C.

Hamachi

D.

Freenet

Question 33

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He copies the whole structure of the We-are-secure Web site to the local disk and obtains all the files on the Web site. Which of the following techniques is he using to accomplish his task?

Options:

A.

Web ripping

B.

TCP FTP proxy scanning

C.

Fingerprinting

D.

Eavesdropping

Question 34

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Swap files

B.

Unused and hidden partition

C.

Slack spaces

D.

Allocated cluster

Question 35

Which of the following cryptographic methods are used in EnCase to ensure the integrity of the data, which is acquired for the investigation?

Each correct answer represents a complete solution. Choose two.

Options:

A.

MD5

B.

CRC

C.

HAVAL

D.

Twofish

Question 36

Peter works as a Computer Hacking Forensic Investigator for SecureEnet Inc. He has been assigned with a project of investigating a disloyal employee who is accused of stealing secret data from the company and selling it to the competitor company. Peter is required to collect proper evidences and information to present before the court for prosecution. Which of the following parameters is necessary for successful prosecution of this corporate espionage?

Options:

A.

To prove that the information has a value.

B.

To present the evidences before the court.

C.

To submit investigative report to senior officials.

D.

To prove that the data belongs to the company.

Question 37

Which of the following file attributes are not available on a FAT32 partition?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Compression

B.

Encryption

C.

Read Only

D.

Hidden

E.

Archive

Question 38

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to print the super block and block the group information for the filesystem present on a system.

Which of the following Unix commands can you use to accomplish the task?

Options:

A.

e2fsck

B.

dump

C.

e2label

D.

dumpe2fs

Question 39

You work as a Network Administrator for NetTech Inc. To ensure the security of files, you encrypt data files using Encrypting File System (EFS). You want to make a backup copy of the files and maintain security settings. You can backup the files either to a network share or a floppy disk. What will you do to accomplish this?

Options:

A.

Place the files in an encrypted folder. Then, copy the folder to a floppy disk.

B.

Copy the files to a network share on a FAT32 volume.

C.

Copy the files to a network share on an NTFS volume.

D.

Copy the files to a floppy disk that has been formatted using Windows 2000 Professional.

Question 40

Which of the following methods can be used to start the Disk Defragmenter utility in Windows 9x?

Each correct answer represents a complete solution. Choose two.

Options:

A.

From Start menu > Programs > Accessories > System Tools, click Disk Defragmenter.

B.

From Start menu > Programs > Windows Explorer, right-click on the drive to be defragmented > click Properties in the popup menu > Tools tab, then click the Defragment Now button.

C.

From Start menu > Programs > Windows Explorer, right-click on the drive to be defragmented, then click the Disk Defragmenter in the popup window.

D.

From Start menu > Programs, click Disk Defragmenter.

Question 41

John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. John wants to redirect all TCP port 80 traffic to UDP port 40, so that he can bypass the firewall of the We-are-secure server. Which of the following tools will John use to accomplish his task?

Options:

A.

Fpipe

B.

PsList

C.

Cain

D.

PsExec

Question 42

What are the purposes of audit records on an information system?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Backup

B.

Investigation

C.

Upgradation

D.

Troubleshooting

Question 43

You work as a Network Administrator for NetTech Inc. The company's network is connected to the Internet. For security, you want to restrict unauthorized access to the network with minimum administrative effort. You want to implement a hardware-based solution. What will you do to accomplish this?

Options:

A.

Connect a brouter to the network.

B.

Implement firewall on the network.

C.

Connect a router to the network.

D.

Implement a proxy server on the network.

Question 44

Which of the following steps are generally followed in computer forensic examinations?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Encrypt

B.

Acquire

C.

Authenticate

D.

Analyze

Question 45

On your dual booting computer, you want to set Windows 98 as the default operating system at startup. In which file will you define this?

Options:

A.

NTBOOTDD.SYS

B.

BOOT.INI

C.

NTDETECT.COM

D.

BOOTSECT.DOS

Question 46

The Klez worm is a mass-mailing worm that exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm gathers email addresses from the entries of the default Windows Address Book (WAB). Which of the following registry values can be used to identify this worm?

Options:

A.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

B.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

C.

HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"

D.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Question 47

Which of the following articles defines illegal access to the computer or network in Chapter 2 of Section 1, i.e., Substantive criminal law of the Convention on Cybercrime passed by the Council of Europe?

Options:

A.

Article 2

B.

Article 5

C.

Article 16

D.

Article 3

Page: 1 / 32
Total 318 questions