Question 1

Adam, a forensic analyst, is preparing VMs for analyzing a malware. Which of the following is NOT a best

practice?

Options :

A :

Isolating the host device

B :

Installing malware analysis tools

C :

Using network simulation tools

D :

Enabling shared folders

Answer: D

Question 2

Amelia has got an email from a well-reputed company stating in the subject line that she has won a prize

money, whereas the email body says that she has to pay a certain amount for being eligible for the contest.

Which of the following acts does the email breach?

Options :

A :

CAN-SPAM Act

B : HIPAA

C : GLBA

D : SOX

Answer: A

Question 3

Examination of a computer by a technically unauthorized person will almost always result in:

Options :

A : Rendering any evidence found inadmissible in a court of law

B : Completely accurate results of the examination

C : The chain of custody being fully maintained

D : Rendering any evidence found admissible in a court of law

Answer: A

Question 4

When monitoring for both intrusion and security events between multiple computers, it is essential that the computers' clocks are synchronized. Synchronized time allows an administrator to reconstruct what took place during an attack against multiple computers. Without synchronized time, it is very difficult to determine exactly when specific events took place, and how events interlace. What is the name of the service used to synchronize time among multiple computers?

Options :

A : Universal Time Set

B : Network Time Protocol

C : SyncTime Service

D : Time-Sync Protocol

Answer: B

Question 5

Which cloud model allows an investigator to acquire the instance of a virtual machine and initiate the forensics examination process?

Options :

A : PaaS model

B : IaaS model

C : SaaS model

D : SecaaS model

Answer: B

Higher Test Marks with Free Online 312-49 Exam Practice

Buying Options: