312-49v9 Free Practice Test

- (Topic 3)
You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all
traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would:

1. A. Violate your contract
2. B. Cause network congestion
3. C. Make you an agent of law enforcement
4. D. Write information to the subject hard driveWrite information to the subject? hard drive

Correct Answer: C

- (Topic 1)
Which of the following statements is incorrect related to acquiring electronic evidence at crime scene?

1. A. Sample banners are used to record the system activities when used by the unauthorized user
2. B. In warning banners, organizations give clear and unequivocal notice to intruders that by signing onto the system they are expressly consenting to such monitoring
3. C. The equipment is seized which is connected to the case, knowing the role of the computer which will indicate what should be taken
4. D. At the time of seizing process, you need to shut down the computer immediately

Correct Answer: D

- (Topic 1)
First responder is a person who arrives first at the crime scene and accesses the victim's computer system after the incident. He or She is responsible for protecting, integrating, and preserving the evidence obtained from the crime scene. Which of the following is not a role of first responder?

1. A. Identify and analyze the crime scene
2. B. Protect and secure the crime scene
3. C. Package and transport the electronic evidence to forensics lab
4. D. Prosecute the suspect in court of law

Correct Answer: D

- (Topic 1)
Damaged portions of a disk on which no read/Write operation can be performed is known as ____ .

1. A. Lost sector
2. B. Bad sector
3. C. Empty sector
4. D. Unused sector

Correct Answer: B

- (Topic 1)
A forensic investigator is a person who handles the complete Investigation process, that is, the preservation, identification, extraction, and documentation of the evidence. The investigator has many roles and responsibilities relating to the cybercrime analysis. The role of the forensic investigator is to:

1. A. Take permission from all employees of the organization for investigation
2. B. Harden organization network security
3. C. Create an image backup of the original evidence without tampering with potential evidence
4. D. Keep the evidence a highly confidential and hide the evidence from law enforcement agencies

Correct Answer: C