Password Protection and Encryption Techniques DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner has recovered a password hash from a system. The examiner knows the password policy requires at least 8 characters, including uppercase, lowercase, digits, and special characters. Which cracking strategy is most likely to succeed in a reasonable time?

   • AUse a simple dictionary attack with only common words.
   • BUse a pure brute-force attack over the full 8-character keyspace.
   • CUse a hybrid attack combining a dictionary wordlist with rule-based mutations.
   • DUse a rainbow table for the specific hash algorithm.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic examiner has imaged a laptop that uses BitLocker full-disk encryption. The user's password is unknown, but the examiner has a memory dump taken from the laptop while it was running. Which approach is most likely to recover the encryption key and allow access to the image?

   • ARun a dictionary attack against the BitLocker password using the memory dump as a wordlist.
   • BPerform a brute-force attack on the AES key directly from the encrypted image.
   • CExtract the BitLocker volume master key from the memory dump using a tool like Volatility.
   • DUse a rainbow table to reverse the BitLocker password hash extracted from the image.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic examiner has obtained a court order to search a suspect's computer. The computer is protected by a password, and the examiner wants to bypass it to access the data. Which action is legally and ethically appropriate?

   • AUse password cracking tools to gain access, as authorized by the court order.
   • BUse a hardware keylogger to capture the password when the suspect types it.
   • CAttempt to guess the password using personal information from social media.
   • DAsk the suspect for the password, but if refused, respect their privacy and stop the investigation.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which method is used to recover encryption keys from a running system by analyzing the contents of RAM?

   • ANetwork sniffing
   • BDisk imaging
   • CFile carving
   • DMemory analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is migrating to full-disk encryption on all laptops. They are concerned about the impact on forensic investigations if a laptop is seized. What should they do to prepare?

   • AStore the encryption keys on a USB drive attached to each laptop.
   • BImplement a key escrow system and document the process for authorized forensic access.
   • CDisable full-disk encryption to avoid any forensic challenges.
   • DUse a single password for all laptops and share it with the forensic team.
   Reveal Solution Discussion Select an answer first