212-89 Free Practice Test

Digital evidence must:

1. A. Be Authentic, complete and reliable
2. B. Not prove the attackers actions
3. C. Be Volatile
4. D. Cast doubt on the authenticity and veracity of the evidence

Correct Answer: A

A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved:

1. A. Analysis
2. B. Preparation
3. C. Examination
4. D. Collection

Correct Answer: C

Bit stream image copy of the digital evidence must be performed in order to:

1. A. Prevent alteration to the original disk
2. B. Copy the FAT table
3. C. Copy all disk sectors including slack space
4. D. All the above

Correct Answer: C

US-CERT and Federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 Federal Agency category?

1. A. Weekly
2. B. Within four (4) hours of discovery/detection if the successful attack is still ongoing and agency is unable to successfully mitigate activity
3. C. Within two (2) hours of discovery/detection
4. D. Monthly

Correct Answer: A

An active vulnerability scanner featuring high speed discovery, configuration auditing, asset profiling, sensitive data discovery, and vulnerability analysis is called:

1. A. Nessus
2. B. CyberCop
3. C. EtherApe
4. D. nmap

Correct Answer: A