Anti-Forensics Countermeasures DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A suspect's smartphone is seized, and the device is encrypted with a strong passphrase. The device is powered off. Which legal and technical approach should be used to access the encrypted data?

   • AConnect the device to a computer and use a data recovery tool to extract the encryption key from the device's storage.
   • BObtain a search warrant and use a forensic tool that performs a brute-force attack on the device's lock screen, while preserving the device in a Faraday bag to prevent remote wiping.
   • CContact the cloud service provider and request the decryption key, assuming that the provider retains a copy of all user keys.
   • DPower on the device and immediately attempt to bypass the lock screen using a known exploit, without preserving the device state.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization is designing a forensic readiness program to counter anti-forensics techniques. The program must balance proactive monitoring with legal and privacy constraints. Which approach best achieves this balance?

   • AImplement monitoring that focuses on security-relevant events, with clear policies on data collection, retention, and access, and ensure compliance with applicable privacy laws.
   • BFocus monitoring only on high-risk employees, assuming that anti-forensics activities are limited to a few individuals.
   • CDeploy monitoring tools without informing employees, to avoid tipping off potential suspects.
   • DMonitor all user activity indiscriminately to ensure no anti-forensics technique goes undetected.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which forensic technique is specifically used to recover encryption keys from a system's volatile memory?

   • ANetwork sniffing
   • BDisk imaging
   • CMemory analysis
   • DFile carving
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of implementing comprehensive logging and monitoring systems as a countermeasure to anti-forensics techniques?

   • ATo encrypt all data on the network
   • BTo prevent users from accessing the internet
   • CTo automatically delete logs after a certain period
   • DTo detect and document suspicious activities in real time
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization wants to detect anti-forensics activities such as log tampering and data wiping. You need to implement a monitoring solution that provides early warning and preserves evidence. Which strategy should you adopt?

   • ASchedule daily backups of all critical files and rely on the backups to restore any data that is wiped or altered.
   • BEnable verbose logging on all servers and store logs locally on each machine to avoid network overhead.
   • CDeploy a centralized logging system with write-once, read-many (WORM) storage and real-time alerting for suspicious events like mass file deletion or log clearing.
   • DUse a network intrusion detection system (NIDS) that monitors only inbound traffic for known attack signatures.
   Reveal Solution Discussion Select an answer first