Computer Hacking Forensic Investigator Practice Questions

Where is the startup configuration located on a router?

When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?

Why is it a good idea to perform a penetration test from the inside?

Jones had been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the system for a period of three weeks. However law enforcement agencies were recording his every activity and this was later presented as evidence. The organization had used a virtual environment to trap Jones.

What is a virtual environment?

Harold is a computer forensics investigator working for a consulting firm out ofAtlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material.

What type of steganography did these two suspects use?

When should an MD5 hash check be performed when processing evidence?

You are running through a series oftests on your network to check for any security vulnerabilities. After normal working hours, you initiate a DoS attack against your external firewall. The firewall Quickly freezes up and becomes unusable. You then initiate an FTP connection from an external IP into your internal network. The connection is successful even though you have FTP blocked at the external firewall.

What has happened?

Which of the following is NOT a graphics file?

Michael works for Kimball Construction Company as senior security analyst. As part ofyearly security audit, Michael scans his network for vulnerabilities. Using Nmap, Michael conducts XMAS scan and most of the ports scanned do not give a response. In what state are these ports?

What is a good security method to prevent unauthorized users from 'tailgating'?