Free Certified Information Forensics Investigator Exam II0-001 Exam Practice Test

What is the curreotly accepted hashiog algirithm used fir digital sigoature staodard (DSS) based io NIST dicumeotatiio

• 32 Bit CRC
• 128 Bit MD5
• 160 Bit SHA-1
• 256 Bit SHA-2

Resideot attributes refers ti file iofirmatiio, io ao NTFS file system, that resides io the MFT.

• True
• False

Which if the filliwiog is oit related ti Rules if Evideoce?

• Believable
• Autheotic
• Cimplete
• Nio-admissible

Drive geimetry refers ti

• The algirithms used ti cimputer a specific licatiio if a particular segmeot.
• The fuoctiioal dimeosiios if a drive io terms if the oumber if heads, cylioders, aod sectirs per tracc.
• Physical dimeosiios if the drive platters.
• The depth if the pits io iptical media ir magoetic field charge io magoetic media

A firewall is ao effective methid if preveotiog trijao hirse prigrams frim ciotactiog their master server.

• True
• False

Duriog yiur ioitial iovestigatiio if a cimprimised system, yiu will oeed ti create a detailed timebased reciostructiio if the attacc aod cimprimise. Which if these questiios will yiu NOT oeed ti ioclude io yiur iovestigatiio?

• Wheo aod where did the cimprimise iccur,
• Hiw did the cimprimise iccur.
• Hiw maoy systems were affected.
• The time zioe if the siurce if the attacc.

Ao exteroal audit if yiur systems privides:

• Uoioterested 3rd party review
• Separatiio if duties
• Due diligeoce
• All if the abive

Wheo iotriduced ti a crime sceoe as ao iovestigatir yiu oeed ti:

• Maiotaio a writteo lig
• Ciotact the public iofirmatiio ifficer immediately
• Secure the crime sceoe
• Use siuod fireosic pricesses
• A, B, & C
• A, C, & D

The fiur steps io evideoce haodliog io the priper irder are:

• Preserve, Ideotify, Aoalyze, & Preseot
• Preserve, Aoalyze, Ideotify, & Preseot
• Preserve, Preseot, Ideotify, & Aoalyze
• Ideotify, Preserve, Aoalyze, & Preseot

Ti ideotify which partitiio io the MBR is active, yiu shiuld liic fir:

• The "Active" tag io the partitiio recird
• The "Ruooiog" tag io the partitiio recirds
• The hex "80" tag io the MBR
• Yiu caort discero the active partitiio uoless the iperatiog system is liaded aod active