Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: netdisc

GIAC GCFA GIACCertified Forensics Analyst Exam Practice Test

Page: 1 / 32
Total 318 questions

GIACCertified Forensics Analyst Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$43.75  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$38.5  $109.99
Question 1

Maria works as a professional Ethical Hacker. She recently got a project to test the security of Arrange the three pre-test phases of the attack to test the security of weare-secure.

Options:

A.

Question 2

Sandra, a novice computer user, works on Windows environment. She experiences some problem regarding bad sectors formed in a hard disk of her computer. She wants to run CHKDSK command to check the hard disk for bad sectors and to fix the errors, if any, occurred. Which of the following switches will she use with CHKDSK command to accomplish the task?

Options:

A.

CHKDSK /I

B.

CHKDSK /C /L

C.

CHKDSK /V /X

D.

CHKDSK /R /F

Question 3

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to fix partitions on a hard drive. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

fdformat

B.

exportfs

C.

fsck

D.

fdisk

Question 4

Which of the following two cryptography methods are used by NTFS Encrypting File System (EFS) to encrypt the data stored on a disk on a file-by-file basis?

Options:

A.

Digital certificates

B.

Public key

C.

RSA

D.

Twofish

Question 5

Nathan works as a professional Ethical Hacker. He wants to see all open TCP/IP and UDP ports of his computer. Nathan uses the netstat command for this purpose but he is still unable to map open ports to the running process with PID, process name, and path. Which of the following commands will Nathan use to accomplish the task?

Options:

A.

ping

B.

Psloggedon

C.

Pslist

D.

fport

Question 6

Which of the following is a file management tool?

Options:

A.

Defrag

B.

MSCONFIG

C.

Device Manager

D.

Windows Explorer

Question 7

Normally, RAM is used for temporary storage of data. But sometimes RAM data is stored in the hard disk, what is this method called?

Options:

A.

Cache memory

B.

Static memory

C.

Virtual memory

D.

Volatile memory

Question 8

Mark works as a security manager for SofTech Inc. He is using a technique for monitoring what the employees are doing with corporate resources. Which of the following techniques is being used by Mark to gather evidence of an ongoing computer crime if a member of the staff is e-mailing company's secrets to an opponent?

Options:

A.

Electronic surveillance

B.

Civil investigation

C.

Physical surveillance

D.

Criminal investigation

Question 9

Which of the following type of file systems is not supported by Linux kernel?

Options:

A.

vFAT

B.

NTFS

C.

HFS

D.

FAT32

Question 10

An executive in your company reports odd behavior on her PDA. After investigation you discover that a trusted device is actually copying data off the PDA. The executive tells you that the behavior started shortly after accepting an e-business card from an unknown person. What type of attack is this?

Options:

A.

Session Hijacking

B.

Bluesnarfing

C.

PDA Hijacking

D.

Privilege Escalation

Question 11

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

DOS boot disk

B.

Linux Live CD

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Question 12

Which of the following is the correct order of digital investigations Standard Operating Procedure (SOP)?

Options:

A.

Initial analysis, request for service, data collection, data analysis, data reporting

B.

Initial analysis, request for service, data collection, data reporting, data analysis

C.

Request for service, initial analysis, data collection, data reporting, data analysis

D.

Request for service, initial analysis, data collection, data analysis, data reporting

Question 13

Adam works as a Computer Hacking Forensic Investigator for a garment company in the United States. A project has been assigned to him to investigate a case of a disloyal employee who is suspected of stealing design of the garments, which belongs to the company and selling those garments of the same design under different brand name. Adam investigated that the company does not have any policy related to the copy of design of the garments. He also investigated that the trademark under which the employee is selling the garments is almost identical to the original trademark of the company. On the grounds of which of the following laws can the employee be prosecuted?

Options:

A.

Trademark law

B.

Cyber law

C.

Copyright law

D.

Espionage law

Question 14

Which of the following tools can be used to perform tasks such as Windows password cracking, Windows enumeration, and VoIP session sniffing?

Options:

A.

John the Ripper

B.

L0phtcrack

C.

Obiwan

D.

Cain

Question 15

The MBR of a hard disk is a collection of boot records that contain disk information such as disk architecture, cluster size, and so on. The main work of the MBR is to locate and run necessary operating system files that are required to run a hard disk. In the context of the operating system, MBR is also known as the boot loader. Which of the following viruses can infect the MBR of a hard disk?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Stealth

B.

Boot sector

C.

Multipartite

D.

File

Question 16

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate the main server of SecureEnet Inc. The server runs on Debian Linux operating system. Adam wants to investigate and review the GRUB configuration file of the server system.

Which of the following files will Adam investigate to accomplish the task?

Options:

A.

/boot/grub/menu.lst

B.

/boot/grub/grub.conf

C.

/boot/boot.conf

D.

/grub/grub.com

Question 17

You are a professional Computer Hacking forensic investigator. You have been called to collect the evidences of Buffer Overflows or Cookie snooping attack. Which of the following logs will you review to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

System logs

B.

Event logs

C.

Web server logs

D.

Program logs

Question 18

This type of virus infects programs that can execute and load into memory to perform predefined steps for infecting systems. It infects files with the extensions .EXE, .COM, .BIN, and .SYS. As it can replicate or destroy these types of files, the operating system becomes corrupted and needs reinstallation. This type of virus is known as __________.

Options:

A.

Polymorphic virus

B.

Stealth virus

C.

Boot sector virus

D.

File virus

E.

Multipartite virus

Question 19

Which of the following statements about the HKEY_LOCAL_MACHINE registry hive is true?

Options:

A.

It contains the user profile for the user who is currently logged on to the computer.

B.

It contains information about the local computer system, including hardware and operating system data, such as bus type, system memory, device drivers, and startup control parameters.

C.

It contains configuration data for the current hardware profile.

D.

It contains data that associates file types with programs and configuration data for COM objects, Visual Basic programs, or other automation.

Question 20

Which of the following wireless network standards operates on the 5 GHz band and transfers data at a rate of 54 Mbps?

Options:

A.

802.11a

B.

802.11u

C.

802.11g

D.

802.11b

Question 21

Which of the following tools is an asterisk password revealer tool?

Options:

A.

Aircrack

B.

SnadBoy

C.

Cain and Abel

D.

Pwdump3

Question 22

Which of the following representatives of incident response team takes forensic backups of the systems that are the focus of the incident?

Options:

A.

Technical representative

B.

Information security representative

C.

Legal representative

D.

Lead investigator

Question 23

Which of the following statements is true for a file in the UNIX operating system?

Options:

A.

It is a collection of information, which cannot be data or documents.

B.

It is a directory entry that points to an original file somewhere else.

C.

It is a collection of information, which can be data, an application, or documents.

D.

It is a collection of information, which can be only documents.

Question 24

In 2001, the Council of Europe passed a convention on cybercrime. It was the first international treaty seeking to address computer crime and Internet crimes by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. On 1 March 2006, the Additional Protocol to the Convention on Cybercrime came into force. Which of the following statements clearly describes this protocol?

Options:

A.

The convention of cybercrime is only applied within Europe.

B.

It requires participating states to criminalize the dissemination of racist and xenophobic material through computer systems.

C.

The convention of cybercrime should immediately be put on hold until there is an inclusion of a new or amended article.

D.

English speaking states in Europe such as Ireland and the United Kingdom should sign the convention.

Question 25

Which of the following graphical tools is used to navigate through directory structures?

Options:

A.

Disk Cleanup

B.

System Information

C.

Disk Management

D.

Windows Explorer

Question 26

Which of the following is the Windows feature on which the file management can be performed by a PC user?

Options:

A.

Activity Monitor

B.

Task Manager

C.

Windows Explorer

D.

Finder

Question 27

Which of the following is used for remote file access by UNIX/Linux systems?

Options:

A.

NetWare Core Protocol (NCP)

B.

Common Internet File System (CIFS)

C.

Server Message Block (SMB)

D.

Network File System (NFS)

Question 28

Which of the following tools is used to locate lost files and partitions to restore data from a formatted, damaged, or lost partition in Windows and Apple Macintosh computers?

Options:

A.

Easy-Undelete

B.

File Scavenger

C.

Recover4all Professional

D.

VirtualLab

Question 29

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

Options:

A.

Recovery phase

B.

Eradication phase

C.

Identification phase

D.

Containment phase

E.

Preparation phase

Question 30

Which of the following registry hives stores configuration information specific to a particular user who is currently logged on to the computer?

Options:

A.

HKEY_USERS

B.

HKEY_CURRENT_USER

C.

HKEY_LOCAL_MACHINE

D.

HKEY_CLASSES_ROOT

Question 31

Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with a project to investigate a computer in the network of SecureEnet Inc. The compromised system runs on Windows operating system. Adam decides to use Helix Live for Windows to gather data and electronic evidences starting with retrieving volatile data and transferring it to server component via TCP/IP. Which of the following application software in Helix Windows Live will he use to retrieve volatile data and transfer it to the server component via TCP/IP?

Options:

A.

FSP

B.

Drive Manager

C.

FTK imager

D.

FAU

Question 32

Which of the following file systems supports disk quotas?

Options:

A.

FAT32

B.

NTFS

C.

FAT

D.

CDFS

Question 33

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that this iphone contains some sensitive information. Adam knows that the storage partition of the iphone is divided into two partitions. The first partition is used for the operating system. Other data of iphone is stored in the second partition. Which of the following is the name with which the second partition is mounted on the iphone?

Options:

A.

/private/var

B.

/var/data

C.

/var/private

D.

/data/var

Question 34

What is the name of the Secondary IDE slave, fourth partition in Linux operating system according to the Linux naming convention?

Options:

A.

SDB3

B.

HDC4

C.

HDA4

D.

HDD4

Question 35

You want to perform passive footprinting against we-are-secure Inc. Web server. Which of the following tools will you use?

Options:

A.

Netcraft

B.

Ettercap

C.

Ethereal

D.

Nmap

Question 36

A customer comes to you stating that his hard drive has crashed. He had backed up the hard drive, but some files on it were encrypted with Windows Encrypted File System (EFS). What do you need to do to be able to give him access to those restored encrypted files?

Options:

A.

Nothing, they are unrecoverable.

B.

You need the encryption key. If that was not saved/backed up, then there is no chance of recovery.

C.

Nothing, when you restore, he will have access.

D.

You need to make sure that when you restore, you give the new machine the same user account so that he can open the encrypted files.

Question 37

Which of the following commands can you use to create an ext3 file system?

Each correct answer represents a complete solution. Choose two.

Options:

A.

mke2fs

B.

mkfs.ext3

C.

mke2fs -j

D.

mkfs.ext2

Question 38

Which of the following registry hives contains information about all users who have logged on to the system?

Options:

A.

HKEY_CLASSES_ROOT

B.

HKEY_CURRENT_USERS

C.

HKEY_USERS

D.

HKEY_CURRENT_CONFIG

Question 39

Which of the following types of attacks cannot be prevented by technical measures only?

Options:

A.

Ping flood attack

B.

Brute force

C.

Smurf DoS

D.

Social engineering

Question 40

Which of the following components are usually found in an Intrusion detection system (IDS)?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Sensor

B.

Firewall

C.

Modem

D.

Gateway

E.

Console

Question 41

You want to change the attribute of a file named ACE.TXT to Hidden. Which command line will enable you to set the attribute?

Options:

A.

ATTRIB ACE.TXT -H

B.

ATTRIB ACE.TXT /HR

C.

ATTRIB ACE.TXT +H

D.

ATTRIB ACE.TXT /H

Question 42

John works as a professional Ethical Hacker. He has been assigned a project to test the security of He enters the following command on the Linux terminal:

chmod 741 secure.c

Considering the above scenario, which of the following statements are true?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

By the octal representation of the file access permission, John is restricting the group members to only read the secure.c file.

B.

The textual representation of the file access permission of 741 will be -rwxr--rw-.

C.

John is restricting a guest to only write or execute the secure.c file.

D.

John is providing all rights to the owner of the file.

Question 43

You work as a Network Administrator for NetTech Inc. The company's network is connected to the Internet. For security, you want to restrict unauthorized access to the network with minimum administrative effort. You want to implement a hardware-based solution. What will you do to accomplish this?

Options:

A.

Connect a brouter to the network.

B.

Implement firewall on the network.

C.

Connect a router to the network.

D.

Implement a proxy server on the network.

Question 44

Which of the following articles defines illegal access to the computer or network in Chapter 2 of Section 1, i.e., Substantive criminal law of the Convention on Cybercrime passed by the Council of Europe?

Options:

A.

Article 2

B.

Article 5

C.

Article 16

D.

Article 3

Question 45

Joseph works as a Software Developer for WebTech Inc. He wants to protect the algorithms and the techniques of programming that he uses in developing an application. Which of the following laws are used to protect a part of software?

Options:

A.

Trademark laws

B.

Code Security law

C.

Patent laws

D.

Copyright laws

Question 46

You use the FAT16 file system on your Windows 98 computer. You want to upgrade to the FAT32 file system. What is the advantage of the FAT32 file system over FAT16 file system?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It allocates disk space more efficiently.

B.

On startup failure, you can start the computer by using an MS-DOS or Windows 95 bootable floppy disk.

C.

It uses larger cluster sizes.

D.

It supports drives up to 2 terabytes (TB) in size.

Question 47

John works as a Technical Support Executive in ABC Inc. The company's network consists of ten computers with Windows XP professional installed on all of them. John is working with a computer on which he has enabled hibernation. He shuts down his computer using hibernation mode. Which of the following will happen to the data after powering off the system using hibernation?

Options:

A.

Data will be saved automatically before the system is switched off.

B.

Data will be stored on the ROM.

C.

Data will be saved before the system is switched off if you have configured hibernation to save data.

D.

Unsaved data will be lost when hibernation switches off the system.

Page: 1 / 32
Total 318 questions