Pass the GIAC Forensics GCFA Questions and answers with CertsForce

Viewing page 7 out of 10 pages
Viewing questions 61-70 out of questions
Questions # 61:

You want to retrieve information whether your system is in promiscuous mode or not. Which of the following commands will you use?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

grep Promisc /var/log/messages


B.

ip link


C.

ifconfig | grep PROMISC


D.

show promisc


Expert Solution
Questions # 62:

Which of the following is a documentation of guidelines that computer forensics experts use to handle evidences?

Options:

A.

Chain of evidence


B.

Chain of custody


C.

Incident response policy


D.

Evidence access policy


Expert Solution
Questions # 63:

Which of the following statements about the HKEY_LOCAL_MACHINE registry hive is true?

Options:

A.

It contains the user profile for the user who is currently logged on to the computer.


B.

It contains information about the local computer system, including hardware and operating system data, such as bus type, system memory, device drivers, and startup control parameters.


C.

It contains configuration data for the current hardware profile.


D.

It contains data that associates file types with programs and configuration data for COM objects, Visual Basic programs, or other automation.


Expert Solution
Questions # 64:

Which of the following wireless network standards operates on the 5 GHz band and transfers data at a rate of 54 Mbps?

Options:

A.

802.11a


B.

802.11u


C.

802.11g


D.

802.11b


Expert Solution
Questions # 65:

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate the BlackBerry, which is suspected to be used to hide some important information. Which of the following is the first step taken to preserve the information in forensic investigation of the BlackBerry?

Options:

A.

Keep BlackBerry in 'ON' state.


B.

Remove the storage media.


C.

Eliminate the ability of the device to receive the push data.


D.

Turn off the BlackBerry.


Expert Solution
Questions # 66:

The incident response team has turned the evidence over to the forensic team. Now, it is the time to begin looking for the ways to improve the incident response process for next time. What are the typical areas for improvement?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Information dissemination policy


B.

Additional personnel security controls


C.

Incident response plan


D.

Electronic monitoring statement


Expert Solution
Questions # 67:

Normally, RAM is used for temporary storage of data. But sometimes RAM data is stored in the hard disk, what is this method called?

Options:

A.

Cache memory


B.

Static memory


C.

Virtual memory


D.

Volatile memory


Expert Solution
Questions # 68:

You work as a Web developer for ABC Inc. You want to investigate the Cross-Site Scripting attack on your company's Web site. Which of the following methods of investigation can you use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Review the source of any HTML-formatted e-mail messages for embedded scripts or links in the URL to the company's site.


B.

Look at the Web server's logs and normal traffic logging.


C.

Use Wireshark to capture traffic going to the server and then searching for the requests going to the input page, which may give log of the malicious traffic and the IP address of the source.


D.

Use a Web proxy to view the Web server transactions in real time and investigate any communication with outside servers.


Expert Solution
Questions # 69:

Which of the following Acts enacted in United States allows the FBI to issue National Security Letters (NSLs) to Internet service providers (ISPs) ordering them to disclose records about their customers?

Options:

A.

Wiretap Act


B.

Computer Fraud and Abuse Act


C.

Economic Espionage Act of 1996


D.

Electronic Communications Privacy Act of 1986


Expert Solution
Questions # 70:

Which of the following standard file formats is used by Apple's iPod to store contact information?

Options:

A.

HFS+


B.

hCard


C.

vCard


D.

FAT32


Expert Solution
Viewing page 7 out of 10 pages
Viewing questions 61-70 out of questions