Anti-Forensics Countermeasures DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a common indicator that data wiping has been performed on a storage device?

   • AA high number of deleted files in the recycle bin
   • BAn increase in system uptime
   • CA decrease in network bandwidth usage
   • DPresence of a large amount of zero-filled or random data in unallocated space
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which countermeasure strategy is most effective in detecting anti-forensics activities such as log tampering or unauthorized data wiping?

   • ADisabling all user accounts
   • BProactive monitoring and logging
   • CEncrypting all network traffic
   • DPerforming forensic analysis only after an incident
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a legal and technical approach to accessing data encrypted by a suspect during a forensic investigation?

   • AObtaining a court order to compel the suspect to provide the decryption key
   • BBrute-forcing the encryption key without any legal authorization
   • CUsing a keylogger to capture the password without the suspect's knowledge
   • DThreatening the suspect to reveal the password
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common anti-forensics technique that involves placing data in areas of the filesystem not normally indexed or displayed by the operating system?

   • AEvidence preservation
   • BMemory dumping
   • CLog analysis
   • DData hiding
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   During a forensic investigation, you need to analyze a drive image for hidden data in slack space and signs of data wiping. You have limited time and must prioritize actions to preserve evidence integrity. Which sequence of actions should you follow?

   • ABegin with slack space analysis on the original image, then proceed to wiping pattern analysis, and finally create a hash.
   • BUse a write-blocker to connect the original drive and perform analysis directly on it, avoiding the need for a copy.
   • CRun wiping pattern analysis first, then slack space analysis, and create a hash only if time permits.
   • DFirst, create a cryptographic hash of the original image, then work on a copy for all analysis, and document every step taken.
   Reveal Solution Discussion Select an answer first