Which of the following network protocols creates secure tunneling through which content obfuscation can be achieved?
Sam is working as a loan agent for a financial institution. He frequently receives a number of emails from clients providing their personal details for loan approval. As these emails contain sensitive data, Sam had set up a feature that directly downloads the emails on his device without storing a copy on the mail server. Which of the following protocols provides the above-discussed email features?
Bob, a forensic investigator, is investigating a live Windows system found at a crime scene. In this process, Bob extracted subkeys containing information such as SAM, Security, and software using an automated tool called FTK Imager.
Which of the following Windows Registry hives’ subkeys provide the above information to Bob?
Bob, a forensic specialist at a newly established NGO, discovered a security loophole in the NGO’s web application, which unintentionally reveals early enrolled NGO members’ biodata to attackers. Bob immediately employed a content filtering mechanism to protect all the NGO’s data sources and prevent further damage.
Identify the web application threat identified by Bob in the above scenario.
Which of the following data acquisition formats supports the Lempel-Ziv–Markov chain (LZMA) algorithm for compression?
Bob, a forensic investigator, was instructed to review a Windows machine and identify any anonymous activities performed using it. In this process, Bob used the command “netstat -ano” to view all the active connections in the system and determined that the connections established by the Tor browser were closed.
Which of the following states of the connections established by Tor indicates that the Tor browser is closed?
Identify the investigation team member who is responsible for evidence gathered at the crime scene and maintains a record of the evidence, making it admissible in a court of law.
John, a forensic officer, was working on a criminal case. He employed imaging software to create a copy of data from the suspect device on a storage medium for further investigation. For developing an image of the original data, John used a software application that does not allow an unauthorized user to alter the image content on storage media, thereby retaining an unaltered image copy.
Identify the data acquisition step performed by John in the above scenario.
Which of the following file systems of Windows replaces the first letter of a deleted file name with the hex byte code “e5h”?
Bob, a security specialist at an organization, extracted the following IIS log from a Windows-based server:
“2019-12-12 06:11:41 192.168.0.10 GET /images/content/bg_body1.jpg - 80 - 192.168.0.27 Mozilla/5.0+(Windows+NT+6.3;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/48.0.2564.103+Safari/537.36 http://www.moviescope.com/css/style.css 200 0 0 365”
Identify the element in the above IIS log entry that indicates the request was fulfilled without error.
