<< Prev Question Next Question >>

Question 4/209

UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?

LEAVE A REPLY

Your email address will not be published. Required fields are marked *

Question List (209q)
Question 1: You work as an IT security auditor hired by a law firm in Bo...
Question 2: Which of the following Windows-based tool displays who is lo...
Question 3: Which of the following standard represents a legal precedent...
Question 4: UEFI is a specification that defines a software interface be...
Question 5: Which of the following is a device monitoring tool?...
Question 6: Consider that you are investigating a machine running an Win...
Question 7: Which ISO Standard enables laboratories to demonstrate that ...
Question 8: Jim performed a vulnerability analysis on his network and fo...
Question 9: One technique for hiding information is to change the file e...
Question 10: Which of the following reports are delivered under oath to a...
Question 11: Paraben Lockdown device uses which operating system to write...
Question 12: Andie, a network administrator, suspects unusual network ser...
Question 13: Daryl, a computer forensics investigator, has just arrived a...
Question 14: When is it appropriate to use computer forensics?...
Question 15: Lynne receives the following email: Dear [email protected]! We...
Question 16: You are running known exploits against your network to test ...
Question 17: When investigating a network that uses DHCP to assign IP add...
Question 18: Steven has been given the task of designing a computer foren...
Question 19: When a file is deleted by Windows Explorer or through the MS...
Question 20: Profiling is a forensics technique for analyzing evidence wi...
Question 21: What advantage does the tool Evidor have over the built-in W...
Question 22: When reviewing web logs, you see an entry for resource not f...
Question 23: Which among the following U.S. laws requires financial insti...
Question 24: With the standard Linux second extended file system (Ext2fs)...
Question 25: What must be obtained before an investigation is carried out...
Question 26: Adam, a forensic analyst, is preparing VMs for analyzing a m...
Question 27: The process of restarting a computer that is already turned ...
Question 28: Why should you note all cable connections for a computer you...
Question 29: Which of the following does Microsoft Exchange E-mail Server...
Question 30: Why would you need to find out the gateway of a device when ...
Question 31: Select the tool appropriate for finding the dynamically link...
Question 32: Jack Smith is a forensics investigator who works for Mason C...
Question 33: An on-site incident response team is called to investigate a...
Question 34: A forensics investigator needs to copy data from a computer ...
Question 35: Which of the following files stores information about local ...
Question 36: What layer of the OSI model do TCP and UDP utilize?...
Question 37: Stephen is checking an image using Compare Files by The Wiza...
Question 38: Bill is the accounting manager for Grummon and Sons LLC in C...
Question 39: Centralized binary logging is a process in which many websit...
Question 40: What TCP/UDP port does the toolkit program netstat use?...
Question 41: Which of the following is NOT a graphics file?...
Question 42: Sectors are pie-shaped regions on a hard disk that store dat...
Question 43: When obtaining a warrant, it is important to:...
Question 44: Which forensic investigating concept trails the whole incide...
Question 45: When should an MD5 hash check be performed when processing e...
Question 46: Bob has encountered a system crash and has lost vital data s...
Question 47: What term is used to describe a cryptographic technique for ...
Question 48: One way to identify the presence of hidden partitions on a s...
Question 49: Steve, a forensic investigator, was asked to investigate an ...
Question 50: Which password cracking technique uses details such as lengt...
Question 51: One technique for hiding information is to change the file e...
Question 52: Bob works as information security analyst for a big finance ...
Question 53: Smith, an employee of a reputed forensic investigation firm,...
Question 54: The following is a log file screenshot from a default instal...
Question 55: To preserve digital evidence, an investigator should _______...
Question 56: John is working on his company policies and guidelines. The ...
Question 57: Before performing a logical or physical search of a drive in...
Question 58: When you carve an image, recovering the image depends on whi...
Question 59: After passively scanning the network of Department of Defens...
Question 60: With Regard to using an Antivirus scanner during a computer ...
Question 61: What system details can an investigator obtain from the NetB...
Question 62: Which list contains the most recent actions performed by a W...
Question 63: At what layer of the OSI model do routers function on?...
Question 64: Using Linux to carry out a forensics investigation, what wou...
Question 65: When investigating a potential e-mail crime, what is your fi...
Question 66: Pagefile.sys is a virtual memory file used to expand the phy...
Question 67: Which of these Windows utility help you to repair logical fi...
Question 68: What should you do when approached by a reporter about a cas...
Question 69: Which among the following laws emphasizes the need for each ...
Question 70: Heather, a computer forensics investigator, is assisting a g...
Question 71: Select the tool appropriate for examining the dynamically li...
Question 72: Which code does the FAT file system use to mark the file as ...
Question 73: Company ABC has employed a firewall, IDS, Antivirus, Domain ...
Question 74: You have used a newly released forensic investigation tool, ...
Question 75: What technique is used by JPEGs for compression?...
Question 76: Which among the following search warrants allows the first r...
Question 77: What must an investigator do before disconnecting an iPod fr...
Question 78: Which of the following is a list of recently used programs o...
Question 79: Jonathan is a network administrator who is currently testing...
Question 80: Jessica works as systems administrator for a large electroni...
Question 81: %3cscript%3ealert("XXXXXXXX")%3c/script%3e is a script obtai...
Question 82: When monitoring for both intrusion and security events betwe...
Question 83: What happens when a file is deleted by a Microsoft operating...
Question 84: Which of the following data structures stores attributes of ...
Question 85: In which implementation of RAID will the image of a Hardware...
Question 86: Which of the following Event Correlation Approach is an adva...
Question 87: You are conducting an investigation of fraudulent claims in ...
Question 88: Which of the following is a database in which information ab...
Question 89: When marking evidence that has been collected with the "aaa/...
Question 90: Windows identifies which application to open a file with by ...
Question 91: How many bits is Source Port Number in TCP Header packet?...
Question 92: A honey pot deployed with the IP 172.16.1.108 was compromise...
Question 93: Harold is a web designer who has completed a website for ght...
Question 94: To make sure the evidence you recover and analyze with compu...
Question 95: If you are concerned about a high level of compression but n...
Question 96: The MAC attributes are timestamps that refer to a time at wh...
Question 97: Where is the default location for Apache access logs on a Li...
Question 98: Madison is on trial for allegedly breaking into her universi...
Question 99: A Linux system is undergoing investigation. In which directo...
Question 100: What binary coding is used most often for e-mail purposes?...
Question 101: A company's policy requires employees to perform file transf...
Question 102: Where should the investigator look for the Edge browser's br...
Question 103: You have been given the task to investigate web attacks on a...
Question 104: You are the security analyst working for a private company o...
Question 105: What does Locard's Exchange Principle state?...
Question 106: Which of the following techniques delete the files permanent...
Question 107: You just passed your ECSA exam and are about to start your f...
Question 108: In a computer that has Dropbox client installed, which of th...
Question 109: What type of attack sends SYN requests to a target system wi...
Question 110: Watson, a forensic investigator, is examining a copy of an I...
Question 111: What is the investigator trying to view by issuing the comma...
Question 112: Michael works for Kimball Construction Company as senior sec...
Question 113: Which of the following Event Correlation Approach checks and...
Question 114: You are called by an author who is writing a book and he wan...
Question 115: The following excerpt is taken from a honeypot log. The log ...
Question 116: Which of the following tool can reverse machine code to asse...
Question 117: Microsoft Outlook maintains email messages in a proprietary ...
Question 118: An Expert witness give an opinion if:...
Question 119: What is the size value of a nibble?...
Question 120: Which of the following Android libraries are used to render ...
Question 121: You are trying to locate Microsoft Outlook Web Access Defaul...
Question 122: Ron, a computer forensics expert, is investigating a case in...
Question 123: You have compromised a lower-level administrator account on ...
Question 124: Identify the term that refers to individuals who, by virtue ...
Question 125: The police believe that Melvin Matthew has been obtaining un...
Question 126: What does the command "C:\&gt;wevtutil gl &lt;log name&gt;" ...
Question 127: James is dealing with a case regarding a cybercrime that has...
Question 128: Which of the following files contains the traces of the appl...
Question 129: How many sectors will a 125 KB file use in a FAT32 file syst...
Question 130: What are the security risks of running a "repair" installati...
Question 131: While collecting Active Transaction Logs using SQL Server Ma...
Question 132: Frank is working on a vulnerability assessment for a company...
Question 133: What type of attack sends spoofed UDP packets (instead of pi...
Question 134: Software firewalls work at which layer of the OSI model?...
Question 135: Which of the following is a non-zero data that an applicatio...
Question 136: In which registry does the system store the Microsoft securi...
Question 137: Jacob is a computer forensics investigator with over 10 year...
Question 138: Which of the following tool creates a bit-by-bit image of an...
Question 139: Which of the following Linux command searches through the cu...
Question 140: Which of the following statements is true regarding SMTP Ser...
Question 141: While searching through a computer under investigation, you ...
Question 142: Richard is extracting volatile data from a system and uses t...
Question 143: When reviewing web logs, you see an entry for resource not f...
Question 144: What is the default IIS log location?...
Question 145: Which of the following registry hive gives the configuration...
Question 146: During an investigation of an XSS attack, the investigator c...
Question 147: Analyze the hex representation of mysql-bin.000013 file in t...
Question 148: A picture file is recovered from a computer under investigat...
Question 149: The investigator wants to examine changes made to the system...
Question 150: When carrying out a forensics investigation, why should you ...
Question 151: After passing her CEH exam, Carol wants to ensure that her n...
Question 152: Which principle states that "anyone or anything, entering a ...
Question 153: Which of the following components within the android archite...
Question 154: In a FAT32 system, a 123 KB file will use how many sectors?...
Question 155: Where is the startup configuration located on a router?...
Question 156: NTFS sets a flag for the file once you encrypt it and create...
Question 157: Which of the following protocols allows non-ASCII files, suc...
Question 158: What is the framework used for application development for i...
Question 159: In both pharming and phishing attacks an attacker can create...
Question 160: How many possible sequence number combinations are there in ...
Question 161: You have been asked to investigate the possibility of comput...
Question 162: What is the primary function of the tool CHKDSK in Windows t...
Question 163: During the course of a corporate investigation, you find tha...
Question 164: Which password cracking technique uses every possible combin...
Question 165: All Blackberry email is eventually sent and received through...
Question 166: An attacker has compromised a cloud environment of a company...
Question 167: Jacky encrypts her documents using a password. It is known t...
Question 168: Checkpoint Firewall logs can be viewed through a Check Point...
Question 169: When a user deletes a file, the system creates a $I file to ...
Question 170: In the following directory listing, (Exhibit) Which file sho...
Question 171: Which U.S. law sets the rules for sending emails for commerc...
Question 172: Self-Monitoring, Analysis, and Reporting Technology (SMART) ...
Question 173: What is the target host IP in the following command?...
Question 174: You are a computer forensics investigator working with local...
Question 175: Office documents (Word, Excel, PowerPoint) contain a code th...
Question 176: An investigator has acquired packed software and needed to a...
Question 177: Which network attack is described by the following statement...
Question 178: You are working on a thesis for your doctorate degree in Com...
Question 179: George is a senior security analyst working for a state agen...
Question 180: During the course of an investigation, you locate evidence t...
Question 181: The Recycle Bin exists as a metaphor for throwing files away...
Question 182: The efforts to obtain information before a trail by demandin...
Question 183: You are asked to build a forensic lab and your manager has s...
Question 184: If the partition size is 4 GB, each cluster will be 32 K. Ev...
Question 185: Identify the file system that uses $BitMap file to keep trac...
Question 186: This organization maintains a database of hash signatures fo...
Question 187: Bob has been trying to penetrate a remote production system ...
Question 188: For what purpose do the investigators use tools like iPhoneB...
Question 189: A forensics investigator is searching the hard drive of a co...
Question 190: Which among the following web application threats is resulte...
Question 191: Gary is checking for the devices connected to USB ports of a...
Question 192: An International Mobile Equipment Identifier (IMEI) is a 15-...
Question 193: You work as a penetration tester for Hammond Security Consul...
Question 194: What is cold boot (hard boot)?
Question 195: Which of the following is a part of a Solid-State Drive (SSD...
Question 196: Harold is a computer forensics investigator working for a co...
Question 197: Which among the following files provides email header inform...
Question 198: Which of the following files store the MySQL database data p...
Question 199: If you discover a criminal act while investigating a corpora...
Question 200: If you plan to startup a suspect's computer, you must modify...
Question 201: What type of flash memory card comes in either Type I or Typ...
Question 202: Which among the following is an act passed by the U.S. Congr...
Question 203: Which of the following files stores information about a loca...
Question 204: Files stored in the Recycle Bin in its physical location are...
Question 205: Sniffers that place NICs in promiscuous mode work at what la...
Question 206: Which component in the hard disk moves over the platter to r...
Question 207: Which of the following examinations refers to the process of...
Question 208: Study the log given below and answer the following question:...
Question 209: Which of the following Perl scripts will help an investigato...