Password Protection and Encryption Techniques DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · hard

   An examiner is investigating a laptop that uses BitLocker full-disk encryption. The laptop is in sleep mode and the examiner has physical access. The examiner wants to acquire the decryption keys. Which method is most likely to succeed?

   • APerform a cold boot attack by quickly rebooting the system and capturing memory before it is wiped.
   • BUse a write-blocker and boot the system from a USB forensic toolkit.
   • CRemove the hard drive and connect it to a forensic workstation to image it.
   • DTry to reset the Windows password using a password reset disk.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of using a password hash extraction tool like Mimikatz in a forensic context?

   • ATo reset the password to a known value
   • BTo decrypt the password hash and recover the plaintext password
   • CTo extract password hashes from memory or the SAM database for offline cracking
   • DTo bypass the login screen by injecting a fake password
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which principle is fundamental to the effective use of passwords in protecting digital evidence?

   • APasswords should be shared among team members for redundancy
   • BPasswords should be stored in plain text on the system for recovery
   • CPasswords should be simple and easy to remember to avoid lockouts
   • DPasswords should be unique and not reused across different systems
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a primary impact of full-disk encryption on a digital forensic investigation?

   • AIt only encrypts individual files, leaving the file system metadata visible
   • BIt slows down the forensic examination but does not prevent data extraction
   • CIt makes the entire disk content unreadable without the decryption key, potentially preventing data acquisition
   • DIt has no impact because forensic tools can bypass encryption
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software developer needs to implement encryption for a mobile app that stores user data locally. The app must be fast and use minimal battery. Which encryption algorithm is most suitable?

   • AUse Blowfish with a 64-bit block size.
   • BUse AES-128 in GCM mode.
   • CUse RSA-2048 to encrypt all local data.
   • DUse a custom encryption algorithm designed by the developer.
   Reveal Solution Discussion Select an answer first