Computer Forensics CCT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When testifying in court, what should a forensic investigator do?

   • AExplain the findings clearly and objectively, and acknowledge any limitations
   • BRefuse to answer questions that might weaken the case
   • CPresent only the evidence that supports the prosecution's case
   • DUse complex technical jargon to demonstrate expertise
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An incident responder is analyzing a memory dump from a compromised Windows server. The responder finds a process that is injecting code into another legitimate process. The injected code is encrypted in memory. What is the most effective way to analyze the injected code?

   • ADump the injected memory region and attempt to decrypt it using keys found in the same memory dump.
   • BAnalyze the parent process's executable on disk.
   • CSearch the memory dump for strings related to the injected code.
   • DRun the injected code in a sandbox to observe its behavior.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary goal of computer forensics?

   • ATo remove malicious software from compromised systems
   • BTo monitor network traffic for potential intrusions
   • CTo recover deleted files from a suspect's computer
   • DTo identify, preserve, analyze, and present digital evidence in a legally acceptable manner
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic examiner needs to extract data from a seized smartphone that is locked with a PIN. The device is powered on and the examiner wants to preserve evidence. Which approach is most appropriate?

   • ARemove the SIM card and microSD card and analyze them separately.
   • BConnect the device to a computer and perform a logical backup via USB debugging.
   • CPower off the device immediately to prevent remote wiping.
   • DPlace the device in a Faraday bag and attempt to bypass the lock using forensic tools.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An examiner is analyzing a Linux system (ext4 filesystem) involved in a policy violation. The examiner needs to determine when a specific file was last modified and when it was deleted. Which source provides the MOST reliable metadata for these events?

   • AThe file's creation time (crtime) from the inode.
   • BThe output of the 'ls -l' command on the current directory.
   • CThe file's access time (atime) from the inode.
   • DThe file's modification time (mtime) and the journal entries.
   Reveal Solution Discussion Select an answer first