Mobile Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a proper technique for preserving mobile device evidence?

   • ATurning the device on and exploring it
   • BPlacing the device in a Faraday bag
   • CCharging the device to ensure it stays on
   • DConnecting the device to a computer to back it up
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst suspects that a corporate-owned Android device is infected with malware that exfiltrates data via SMS. The device is not rooted, and the analyst needs to confirm the infection and identify the malicious app without voiding the warranty or altering the device. Which approach is most appropriate?

   • AUse a network packet capture to monitor SMS traffic in real time.
   • BRoot the device to gain full access to the file system and perform a physical acquisition.
   • CPerform a logical acquisition and analyze the app list, permissions, and SMS database for anomalies.
   • DFactory reset the device to remove the malware and then analyze the backup.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Where does an Android app typically store its private data?

   • A/data/data/<package_name>
   • B/system
   • C/cache
   • D/sdcard
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which file system is commonly used by Android devices?

   • Aext4
   • BHFS+
   • CAPFS
   • DNTFS
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a type of data that can be extracted from a mobile app's cache?

   • AThe operating system's kernel logs
   • BThe device's IMEI number
   • CTemporary files and images
   • DDeleted text messages
   Reveal Solution Discussion Select an answer first