Sr.

No Question Options Correct Answer

a) Criminal Prosecutors
Who Can Use Computer b) Civil litigations
1 d)All of them
Forensic Evidence? c) Law enforcement
d) All of them
A. How to recover data from
computers while preserving
evidential integrity
When handling computers B. How to keep your data and
for legal purposes, information safe from theft or B. How to keep
investigators increasingly are accidental loss your data and
2
faced with four main types of C. How to securely store and information safe
problems, except: handle recovered data from theft
D. How to find the significant
information in a large volume
of data

A. A defined methodology
In order for a double tier
B. Civil control A. A defined
approach to work it is
3 C. A breach of contract methodology
necessary to have:
D. Asset recovery

Criteria for equipment in the A. Simple to use

double tier approach results B. Quick to learn
4 D. Legally operable
in the following C. Totally reliable
except: D. Legally operable
computer forensics specialist
a) Protect
will take several careful steps
b) Discover
5 to identify and d)All of them
c) Recover
attempt to retrieve possible
d) All of them
evidence
A computer forensics
professional does more than
turn on a computer, make
a directory listing, and search
through files. Your forensics
professionals should A. Data seizure
be able to successfully B. Data duplication and
6 perform complex evidence preservation D. Data dump
recovery procedures with the C. Data recovery
skill and expertise that lends D. Data dump
credibility to your case. For
example, they should
be able to perform the
following services, except:

A computer forensics A. Protects the subject

specialist is the person computer system during the
responsible for doing forensic examination from C. Reconstructs
7 computer any possible alteration, system failure
forensics. The computer damage, data corruption, or
forensics specialist will take virus introduction
several careful steps to B. Discovers all files on the
 identify and attempt to subject system. This includes
retrieve possible evidence existing normal files,
that may exist on a subject deleted yet remaining files,
computer system. This hidden files, password-
results in the following steps protected files, and encrypted
except: files
C. Reconstructs system failure
D. Recovers all (or as much as
possible) of discovered deleted
files

A. The price of the

replacement hardware
The following are what it
B. The price of replacing the C. The cost of
really costs to replace a
8 software creating data
stolen computer, except:
C. The cost of creating data
D. The cost of lost production
time or instruction time
A. Lost password and file
recovery
Forensic services include but
B. Location and retrieval of D. Email non-
are not limited to the
9 deleted and hidden files supervision and
following, except:
C. File and email decryption non-authentication
D. Email non-supervision and
non-authentication
a) Authentic
Computer evidence is like
b) Accurate
10 any other evidence. It must d)All of them
c) Complete
be
d) All of them
A. The requirements that need
to be met in order for evidence
to be successfully
presented in court and, of
course, not considered legally
admissible
B. The requirements that need
to be met in order for evidence
to be successfully B. The
presented in court and, of requirements that
The legal aspects of a
course, considered legally need to be met in
computer forensics
admissible order for evidence
investigation center primarily
11 C. The right of the investigator to be successfully
on the
to avoid the possibility of not presented in court
following two main issues:
incurring legal and, of course,
action against himself or the considered legally
organization for whom he is admissible
conducting the
investigation
D. The acceptance of the
investigator to avoid the
possibility of incurring
legal action against himself or
the organization for whom he
is reviewing
 the investigation
a) There is no direct
return on investment in
building security
systems.
b) Security systems are
detrimental to usability
and can make IT
systems less functional,
Considering commerce and
and therefore less
marketing, which of the
attractive to the
12 following present the most d) All of the above
consumer.
significant obstacle to
c) There is pressure to
developing IT security?
reduce the time it takes
to get a new IT product
or system onto the
market, so security
systems are sacrificed
in order to reduce the
time-to-market.
d) All of the above
a) Digitalised sensitive
information
b) Critical Information
What is the referent object in c) Government
Infrastructures
13 contemporary cyber- IT systems
c) Government IT
security?
systems
d) Telecommunication
networks
When did politicians, a) 1970s
academics, and other agents b) 1960s a)1970s
14
begin to talk seriously about c) 1990s
cyber-security? d) 1980s
a) Careful methodology
of approach, including
record keeping
b) A sound knowledge of
The key features of the computing, particularly
15 d) All of them
forensic technician are in any specialist areas
claimed
c) A sound knowledge of
the law of evidence
d) All of them
a) Any crime that uses
computers to
jeopardise or attempt to
jeopardise national
security d) Any crime that
What is meant by the term
16 b) The use of computer involves computers
'cyber-crime'?
networks to commit and networks
financial or identity
fraud
c) The theft of digital
information
 d) Any crime that
involves computers and
networks
a) Data theft
Which of the following is not b) Forgery d) Installing
17 a type of cyber crime? c) Damage to data and systems antivirus for
d) Installing antivirus for protection
protection
a) Phishing
Which of the following is not b) Injecting Trojans to a target
d) Credit card
a type of peer-to-peer cyber- victim
18 details leak in deep
crime? c) MiTM
web
d) Credit card details leak in
deep web
a) Credit card fraudulent
Which of the following is not
b) Spying someone using
an example of a computer as b) Spying someone
19 keylogger
defense cyber-crime? using keylogger
c) IPR Violation
d) Pornography
a. Open computer systems
In terms of digital evidence, b. Communication systems b. Communication
20 the Internet is an example of c. Embedded computer systems
systems
d. None of the above
a. Open computer systems
In terms of digital evidence, b. Communication systems a. Open computer
21 a hard drive is an example c. Embedded computer systems
of: systems
d. None of the above
a. Open computer systems
In terms of digital evidence, b. Communication systems c. Embedded
22 a Smart Card is an example c. Embedded computer computer systems
of systems
d. None of the above
a. Data stored or transmitted
using a computer
b. Information of probative
c. Digital data of
A valid definition of digital value
23 probative value
evidence is: c. Digital data of probative
value
d. Any digital evidence on a
computer
a. An unknown person logged
into the system using the
account c. The account was
A logon record tells us that,
b. The owner of a specific used to log into the
24 at a specific time:
account logged into the system system
c. The account was used to log
into the system
d. None of the above
Computers can be involved a. Homicide and sexual assault
in which of the following b. Computer intrusions and
25 d. All of the above
types of crime? intellectual property theft
c. Civil disputes
 d. All of the above
a. They retain data for longer
periods of time.
b. Owners of private networks c. Private networks
Private networks can be a
are more cooperative with law contain a higher
richer source of evidence
26 enforcement. concentration of
than the Internet because:
c. Private networks contain a digital evidence.
higher concentration of digital
evidence.
d. All of the above.
a. Target, object, and subject
b. Evidence,
b. Evidence, instrumentality,
Computers can play the instrumentality,
contraband, or fruit of crime
27 following roles in a crime: contraband, or fruit
c. Object, evidence, and tool
of crime
d. Symbol, instrumentality, and
source of evidence
a. First responder (a.k.a. digital
The following specializations crime scene technician)
28 exist in digital investigations: b. Forensic examiner d. All of the above
c. Digital investigator
d. All of the above
a. Examine the source code
b. Ask others if the software is
One of the most common c. Compare results
reliable
approaches to validating of multiple tools for
29 c. Compare results of multiple
forensic software is to: discrepancies
tools for discrepancies
d. Computer forensic tool
testing projects
a. Hardware as contraband or
fruits of crime
A printer used for
b. Hardware as an b. Hardware as an
counterfeiting is an example
30 instrumentality instrumentality
of:
c. Hardware as evidence
d. Information as contraband
or fruits of crime
who handle the evidence
Having a member of the b. Can serve to streamline the
search team trained to handle presentation of the case
digital evidence: c. Can reduce the opportunity
31 d. All of the above
a. Can reduce the number of for opposing counsel to
people impugn the integrity of the
evidence
d. All of the above
a. Use a UNIX tool like
hdparm
What can you do to b. Use a Windows tools like
determine the number of EnCase
32 d. All of the above
sectors on a hard drive larger c. Check the drive
than 8GB? manufacturer’s website for the
specific drive
d. All of the above
A device that connets a. Switch
c. Gateway
33 network with different b. Hub
protocols c. Gateway
 d. All of these
a. Routers
A device that is used to b. Repeater
34 a. Routers
connect a number of LANs is c. Bridge
d. All of these
A. Financial information
B. Sabotage of data and/or
networks
Computer crimes include the
C. Theft of proprietary A. Financial
35 following, except:
information information
D. System penetration from
the outside and denial of
service
A. Do not turn on or attempt to
examine the suspect computer.
The following are some
This could result
helpful tips that you can
in destruction of evidence. C. Run all in-
follow to help preserve data
36 B. Identify all devices that house
for future computer forensic
may contain evidence. computers
examination, except:
C. Run all in-house computers.
D. Quarantine all in-house
computers.
Each participant in a
computer forensics course
who successfully completes
the A. Computer evidence
course should receive some processing
C. Troy horse
sort of a certificate of B. Preservation of evidence
37 programs
completion that is suitable C. Troy horse programs
for D. Computer forensics
framing. They should also documentation
leave the course with a good
understanding of the
following, except:
Internal events are
committed by those with a A. Downloading or
substantial link to the distributing offensive material D.
intended B. Theft of intellectual Unintentional
victim, for example, a bank property or intentional
38 employee who siphons C. Internal system intrusions addition or
electronic funds from a D. Unintentional or intentional damage of data
customer’s account. Other addition or damage of data or or systems
examples include the systems
following, except:
A. Detect the extent of a
security breach.
Forensic investigators B. Recover found
B. Recover found data.
39 perform the following, data.
C. Recover lost data.
except:
D. Determine how an intruder
got past security mechanisms.
The following are critical A. Electric power system
C. Web site
40 national infrastructures as B. Gas and oil storage and
listed by the executive transportation
 order, except: C. Web site
D. Banking and finance
A. The incident must not be
well defined.
B. The identity of the
perpetrator must be A. The incident
For a strategy of deterrence
unambiguous. must not be well
41 to work the following must
C. The will and ability to carry defined.
hold, except:
out a deterrence strike must be
believed.
D. The perpetrator must have
something of value at stake.
A. Complex systems fail in
unpredictable ways from
causes that seem to be
minor and, often, obvious
flaws in retrospect.
B. Complex systems pass in
unpredictable ways from B. Complex
causes that seem to be systems pass in
In what has been called the unpredictable ways
minor and, often, obvious
“complex-system issue,” the flaws in retrospect. from causes that
42 following are axioms, C. The failure of a complex seem to be
except: system may be exceptionally minor and, often,
difficult to discover obvious flaws in
and repair. retrospect.
D. Complex systems fail at
inopportune moments—
usually during demanding
system use when the
consequences of failure are
highest.
A. The resort to force must
have a just cause.
The following requirements B. It must be authorized by a C. It is expected to
of jus ad bellum were competent authority. produce a
43 developed by Thomas C. It is expected to produce a preponderance of
Aquinas in the 13th century, preponderance of evil over evil over good.
except: good.
D. It must have a reasonable
chance of success.
A. Offensive software
(viruses, worms, trojan horses)
B. Sniffing or “wiretapping”
By changing perspectives software (enabling the capture D. Directed non-
from defense to offense, the of an adversary’s energy weapons
following are in the U.S. (designed to
44 communications)
arsenal to wage IW against destroy electronics,
C. Chipping (malicious
an adversary, except: not humans
software embedded in systems
and buildings)
by manufacturer)
D. Directed non-energy
weapons (designed to destroy
electronics, not humans
 and buildings)
Because the Internet is built
upon the TCP/IP protocol,
many hacker attacks
A. FTP (21)
will seek to exploit the TCP
B. Telnet (23)
45 ports of these servers with D. INS (53)
C. SMTP (25)
public IP addresses. A
D. INS (53)
number of common ports are
scanned and attacked,
except:
A. Preserve confidentiality
B. Protect flaws
Private citizens have C. Protect trade secrets B. Protect flaws
46 legitimate reasons to do the D. Prevent legal or medical
following, except: records from falling into
strangers’ hands
A. You can keep doing the
same old tricks.
You only have three B. You can become a real C. You can be hired
directions to go with criminal cracker. to hack other
47
hacking, except: D. You can use those skills hackers.
wisely to build new software
and create a more secure
Internet.
Just as perpetrators such as
hackers and crackers have A. Unauthorized access points
done to wired networks, B. Data interception
D. Authorized
48 they can assault WLANs C. Denial-of-service (DoS)
access points
through the same methods, attacks
except: D. Authorized access points

A. Break into computers

through well-documented
holes (they read security
alerts, too) when users don’t
install patches.
B. Enter networks through old
computers that are no longer in
Hackers can do the use. This can D. Physically
49 following, except: happen when administrators destroy a
forget to disconnect an ex- network.
employee’s system
from the modem or network.
C. Target data on a less-
protected off-site machine that
stores backups.
D. Physically destroy a
network.
In order for a double tier A. A defined methodology
A. A defined
approach to work it is B. Civil control
50 methodology
necessary to have: C. A breach of contract
D. Asset recovery