Computer Forensics
Final Exam Questions
Course Introduction
Computer Forensics is an interdisciplinary course that introduces students to the principles and practices used in the identification, preservation, analysis, and presentation of digital evidence. Covering both theoretical foundations and practical techniques, the course explores topics such as data recovery, forensic imaging, file system analysis, and the legal and ethical considerations of digital investigations. Through hands-on labs and case studies, students gain experience using specialized forensics tools to uncover and analyze evidence from computers and digital devices, preparing them for roles in cybersecurity, law enforcement, and digital investigation.
Recommended Textbook
Computer Forensics Principles and Practices 1st Edition by Linda Volonino
Available Study Resources on Quizplus
13 Chapters
600 Verified Questions
600 Flashcards
Source URL: https://quizplus.com/study-set/2159
Page 2
Chapter 1: Forensic Evidence and Crime Investigation
Available Study Resources on Quizplus for this Chatper
33 Verified Questions
33 Flashcards
Source URL: https://quizplus.com/quiz/43035
Sample Questions
Q1) ________ evidence is that type that could incorrectly lead an investigator to believe the evidence is related to the crime.
Answer: Artifact
Q2) Criminal statutes define crimes in terms of required acts and a required state of mind,typically referred to as
A)The person's motivation
B)The person's psychological makeup
C)The person's needs at the time
D)The person's intent
Answer: D
Q3) ________ left by Internet and e-mail usage and digital devices may be the only way to collect enough evidence to solve a crime.
Answer: Cybertrails
Q4) What piece of legislation makes it a crime to send e-mail using false headers?
A)CAN-SPAM Act
B)CFAA
C)FERPA
D)USA PATRIOT Act
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Computer Forensics Anddigital Detective Work
Available Study Resources on Quizplus for this Chatper
28 Verified Questions
28 Flashcards
Source URL: https://quizplus.com/quiz/43036
Sample Questions
Q1) Robert Hanssen stored documents he was stealing from the FBI and selling to the Russians on a(n)
A)MP3 player
B)Palm III PDA
C)Laptop computer
D)Cell phone
Answer: B
Q2) One of the more popular theories is that a person could actually commit ________ by changing a patient's medication data.
Answer: murder
Q3) Criminal trials are often preceded by a(n)________ at which the admissibility of evidence is determined.
Answer: suppression hearing
Q4) The chain of custody must include which of the following items?
A)Where the evidence was stored
B)The size of the containers used to store the evidence
C)How heavy the evidence was when acquired
D)The relevance of the evidence
Answer: A
To view all questions and flashcards with answers, click on the resource link above. Page 4
Chapter 3: Tools, Environments, Equipment, and Certifications
Available Study Resources on Quizplus for this Chatper
48 Verified Questions
48 Flashcards
Source URL: https://quizplus.com/quiz/43037
Sample Questions
Q1) If volatile data must be acquired,you may need to do your analysis in a(n)
A)Trusted environment
B)Postmortem environment
C)Untrusted environment
D)Dead environment
Answer: C
Q2) Which of the following tasks should be performed to maximize search results?
A)Confirm the objective of the investigation.
B)Identify relevant time periods.
C)Identify relevant types of data.
D)All are correct.
Answer: D
Q3) Documentation of the evidence can include which of the following?
A)Name of the suspect's supervisor
B)Status of the computer
C)Name of the investigating officer
D)All the above
Answer: B
Q4) ________ data can include spreadsheets,databases,and word processing files.
Answer: Active
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Policies and Procedures
Available Study Resources on Quizplus for this Chatper
63 Verified Questions
63 Flashcards
Source URL: https://quizplus.com/quiz/43038
Sample Questions
Q1) The system BIOS can tell you
A)Hard drive geometry settings
B)What Web sites the user has visited recently
C)The computer's operating system
D)What applications are installed on the computer
Q2) Summary
A)Uses an algorithm to make readable
B)Needs a word or phrase to unlock the file
C)Data hides in another file
D)Usually mail files
Q3) Which of the following is NOT one of the areas to be considered when selecting members of a forensic unit?
A)Experience
B)Team player
C)Mental agility
D)Works well under pressure
Q4) A(n)________ needs to be completed when reviewing a potential case and determining whether to accept it.
Q5) A(n)________ examination is where most of the computer forensic work is performed.
6
To view all questions and flashcards with answers, click on the resource link above.
Chapter 5: Data, PDA, and Cell Phone Forensics
Available Study Resources on Quizplus for this Chatper
45 Verified Questions
45 Flashcards
Source URL: https://quizplus.com/quiz/43039
Sample Questions
Q1) ATAPI
A)Allows up to four ATA devices
B)Allows a CD to use ATA connections
C)The umbrella standard
D)The standard is no longer used
Q2) Most PDA memory is constructed of which type of memory?
A)Permanent RAM
B)Permanent ROM
C)Flash-type RAM
D)Flash-type ROM
Q3) POSE
A)Can do Blackberry devices
B)Completely emulates Palm
C)Cannot generate a hash of the Palm OS
D)Doesn't support Linux
Q4) A primary function of a SIM card is to
A)Control a cell phone's memory
B)Track the power usage of the phone
C)Identify the subscriber to the phone network
D)Display user information during a call
To view all questions and flashcards with answers, click on the resource link above.
Chapter 6: Operating Systems and Data Transmission
Basics for Digital Investigations
Available Study Resources on Quizplus for this Chatper
52 Verified Questions
52 Flashcards
Source URL: https://quizplus.com/quiz/43040
Sample Questions
Q1) The TCP/IP model has ________ layers.
Q2) Internet
A)Uses IP as its transmission protocol
B)The reliability layer
C)Handles physical aspects of a network
D)Routes packets over a network
Q3) One approach Apple took in designing the Macintosh was to make ________ a standard feature from the beginning.
Q4) Presentation
A)Translates logical to physical addresses
B)Creates and maintains the communications link
C)Performs protocol conversion
D)Transmits raw data
Q5) Which of the following factors has NOT contributed to the popularity of Linux?
A)Linux is free or inexpensive.
B)Linux is stable.
C)Linux is fast.
D)Linux can run only on new,state-of-the-art equipment.
Q6) ________ is the method of travel whereby data is sent via multiple paths to its final destination. Page 8
To view all questions and flashcards with answers, click on the resource link above.
Page 9
Chapter 7: Investigating Windows, linux, and Graphic Files
Available Study Resources on Quizplus for this Chatper
57 Verified Questions
57 Flashcards
Source URL: https://quizplus.com/quiz/43041
Sample Questions
Q1) Which of the following is one of the default directories created when installing Linux?
A)/setup
B)/default
C)/bin
D)/swap
Q2) /lost+found
A)Where files with no names are placed
B)Contains information on printers, log files, and transient data
C)Could be a rich source of evidence if not recently cleaned
D)Library files
E)Contains shadow password files
Q3) Temp files
A)Internet history files
B)Installed applications
C)Though used only briefly, they are not deleted
D)Data created by a user
Q4) In Linux,everything-including all devices,partitions,and folders-is seen as a unified
Q5) A(n)________ is designed as a hierarchical listing of folders and files.
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 8: E-Mail and Webmail Forensics
Available Study Resources on Quizplus for this Chatper
47 Verified Questions
47 Flashcards
Source URL: https://quizplus.com/quiz/43042
Sample Questions
Q1) To handle attachments now being included in e-mail,________ ,a new standard,was introduced.
Q2) POP3
A)Dependant upon Internet
B)Accessible from anywhere
C)Special software required
Q3) Where is the best place to look for evidence that a person has been using webmail?
A)\Documents and Settings\Windowsuserid\Local Settings\Temp
B)\Documents and Settings\Windowsuserid\Local Settings\Temporary Internet Files
C)\Documents and Settings\Windowsuserid\Local Settings\Temporary Files
D)\Documents and Settings\Windowsuserid\Local Settings\Internet Files
Q4) Content-Type
A)Used if sender requests an automated confirmation of the recipient having read the e-mail
B)Easily spoofed by hackers
C)Nonstandard heading sometimes used when encountering a mailing list
D)Deals with non-text items such as photos
Q5) The tool often used for quick communications without resorting to e-mail is________ .
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 9: Internet and Network Forensics and Intrusion Detection
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43043
Sample Questions
Q1) NFAT tools discussed in this chapter include all of the following features EXCEPT
A)Real-time network data capture
B)Command-line interface
C)Content analysis
D)Reporting
Q2) Which of the following data-capture methods uses a filtering system approach?
A)Stop,look,and listen
B)Catch it as you can
C)Filter as you scan
D)Detect and filter
Q3) What is considered to be the first line of defense for networks?
A)IDSs
B)Firewalls
C)Routers
D)Switches
Q4) NFAT systems generally require large amounts of storage space,such as a(n)________ system.
Q5) Software clients called ________ installed on network devices are designed to collect information from the host.
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 10: Tracking Down Those Who Intend to Do Harm
on a Large Scale
Available Study Resources on Quizplus for this Chatper
39 Verified Questions
39 Flashcards
Source URL: https://quizplus.com/quiz/43044
Sample Questions
Q1) Cybercriminals are using hijacked computers to perform which of the following feats?
A)Spy on people
B)Spam people
C)Steal identities
D)All are being performed
Q2) Fourth
A)A spammer (or criminal) buys access to the botnet from the botmaster
B)The botmaster or spammer sends instructions to the infected PCs using the IRC server, which triggers them to send out spam messages to other servers
C)A botmaster sends out viruses to infect computers
D)Infected PCs follow instructions to log in to an IRC server
Q3) A(n)________ program reads from one port and writes to another.
Q4) Which of the following is NOT considered a tactic used by hackers to hijack a computer?
A)DoS attacks
B)Spamming activities
C)Phishing scams
D)Breaking and entering
13
To view all questions and flashcards with answers, click on the resource link above.
Chapter 11: Fraud and Forensic Accounting Investigation
Available Study Resources on Quizplus for this Chatper
40 Verified Questions
40 Flashcards
Source URL: https://quizplus.com/quiz/43045
Sample Questions
Q1) What is considered as the number one reason people feel pressured to commit fraud?
A)Financial problems
B)Health-related problems
C)The feeling of power in getting away with the deed
D)All of the above
Q2) Which of the following is a specific element required to prove fraud?
A)A misleading statement
B)A victim's reliance on a false statement
C)Physical injury
D)A negative effect that did not cause damages
Q3) San Diego city employees
A)Involved a $ 1.4 billion pension deficit
B)Employees received 34 months jail sentence for illegally gained company stock
C)Incriminating e-mail revealed senior management perpetrated fraud and received inflated bonuses
D)Database administrator copied employee information and attempted to sell it over the Internet
Q4) The law of ________ holds that some information is protected by law from being released.
To view all questions and flashcards with answers, click on the resource link above. Page 14
Chapter 12: Federal Rules and Criminal Codes
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/43046
Sample Questions
Q1) A motion by a lawyer before trial to determine whether or not evidence is admissible is called a(n)________.
Q2) Which of the following acts greatly broadened the FBI's authority to gather evidence from telephone conversations,e-mail,pagers,and other forms of electronic communication?
A)Electronic Communications Privacy Act
B)USA PATRIOT Act
C)Computer Fraud and Abuse Act
D)Pen/Trap Statute
Q3) What are laws?
A)Regulations that govern legal conduct
B)Regulations that govern the conduct of the people
C)Regulations that govern a society
D)Expectations of the people for a decent society
Q4) Federal Wiretap Statute
A)Requires that recordings be handed over to a judge
B)Forces ISPs to turn over names of suspected music pirates upon subpoena
C)Includes new guidance relating to computer crime and eevidence
D)Permits an ISP to look through stored e-mail messages
Q5) The ________ is the judge or the jury who will decide a case.
Page 15
To view all questions and flashcards with answers, click on the resource link above.
Chapter 13: Ethical and Professional Responsibility in Testimony
Available Study Resources on Quizplus for this Chatper
30 Verified Questions
30 Flashcards
Source URL: https://quizplus.com/quiz/43047
Sample Questions
Q1) Preparation for testifying in court can include
A)Preparation of data
B)Personal training
C)Phone calls
D)All may be included
Q2) Who may write the expert report?
A)The lawyer handling the case
B)The lawyer's secretary
C)The expert's secretary
D)Only the expert investigating the case
Q3) As an expert witness,what should you NOT do while in court?
A)Be patient.
B)Try to be relaxed and look at the jury when answering.
C)Be truthful,careful,and precise.
D)Dress casually and comfortably.
Q4) Opposing counsel will do their best to ________ or discredit your testimony.
Q5) ________ is also used to examine jurors to make sure they are fair and impartial.
Page 16
Q6) A common trap used by lawyers is to ask you to offer opinions outside ________.
Q7) ________ is intentionally making a false statement under oath.
To view all questions and flashcards with answers, click on the resource link above.