Password Protection and Encryption Techniques DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is trying to crack a password hash that is known to be unsalted. The examiner has a large precomputed table of hash-to-password mappings. Which technique should they use?

   • AUse a keylogger to capture the password from the user.
   • BUse a dictionary attack with a wordlist of common passwords.
   • CUse a brute-force attack to try all possible passwords.
   • DUse a rainbow table to look up the hash and retrieve the password.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner has acquired an image of a suspect's laptop. The user account is protected by a password, and the examiner needs to access the files for analysis. The examiner has a list of common passwords and wants to try them in a systematic way. Which approach is most appropriate for this situation?

   • AUse a rainbow table to reverse the password hash directly without any guessing.
   • BReset the password using a password reset disk to gain access to the account.
   • CPerform a dictionary attack using the list of common passwords against the user account.
   • DPerform a brute-force attack trying every possible character combination until the password is found.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner has a memory dump from a system that uses full-disk encryption (FDE). The examiner needs to decrypt the disk image. Which approach is most likely to yield the encryption key?

   • ASearch the memory dump for the user's password in plaintext.
   • BAnalyze the memory dump for the master key or volume key using memory forensics tools.
   • CPerform a brute-force attack on the disk image's encryption algorithm.
   • DUse a cold boot attack on the memory dump.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which countermeasure is most effective in preventing an attacker from using a cold boot attack to recover encryption keys?

   • AEnabling full-disk encryption with a strong password
   • BUsing a solid-state drive instead of a hard disk
   • CConfiguring the system to overwrite memory on shutdown
   • DUsing a longer encryption key
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company needs to securely transfer a large file to a partner. They want to use encryption that is fast for bulk data and uses a shared secret key. Which encryption algorithm is most appropriate?

   • AUse Blowfish with a public key infrastructure.
   • BUse AES with a pre-shared key.
   • CUse RSA to encrypt the entire file.
   • DUse a hash function like SHA-256 to encrypt the file.
   Reveal Solution Discussion Select an answer first