Password Protection and Encryption Techniques DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic team is investigating a case where the suspect used encryption to hide evidence. The team has a valid warrant, but the suspect refuses to provide the password. The team is considering using a key extraction tool that requires physical access to the running system. Which factor is most important to consider?

   • AWhether the tool's use is authorized by the warrant and complies with local laws.
   • BWhether the tool is fast enough to complete before the system shuts down.
   • CWhether the tool can extract the key without leaving traces.
   • DWhether the suspect's cooperation is required for the tool to work.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a key characteristic of symmetric encryption?

   • AIt uses two different keys, one for encryption and one for decryption
   • BIt requires a public key infrastructure to distribute keys
   • CIt is slower than asymmetric encryption due to complex mathematics
   • DIt uses the same key for both encryption and decryption
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which technique is commonly used to bypass password protection on a Windows system by resetting the password to a known value?

   • AUsing a keylogger to capture the password
   • BUsing a password reset disk
   • CPerforming a brute force attack on the login screen
   • DBooting from a Linux live CD and clearing the SAM file
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic investigator is examining a file that was encrypted with a symmetric algorithm. The investigator has the encryption key. Which statement is true about decrypting the file?

   • AA different key is required for decryption.
   • BThe file must be decrypted using a public key.
   • CThe key must be derived from the file's metadata.
   • DThe same key can be used to decrypt the file.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic team is investigating a suspect's laptop that has an encrypted hard drive. The suspect is cooperating but claims to have forgotten the password. The team has a legal warrant to search the laptop. Which action is most appropriate from a legal and ethical standpoint?

   • AAttempt to recover the password using password-cracking tools, as authorized by the warrant.
   • BUse a hardware backdoor to bypass the encryption without documenting the method.
   • CRefuse to examine the encrypted drive because the suspect forgot the password.
   • DAsk the suspect to provide the password, but do not use any cracking tools without a separate court order.
   Reveal Solution Discussion Select an answer first