Labour Day Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: geek65

GCFA GIACCertified Forensics Analyst Questions and Answers

Questions 4

You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:

What is the IP address of the sender of this email?

Options:

A.

172.16.10.90

B.

209.191.91.180

C.

216.168.54.25

D.

141.1.1.1

Buy Now
Questions 5

Jason, a game lover, owns an Apple's iPod nano. He wants to play games on his iPod. He also wants to improve the quality of the audio recording of his iPod. Which of the following steps can Jason take to accomplish the task?

Options:

A.

Install iPodLinux.

B.

Install third party software.

C.

Upgrade Apple's firmware.

D.

Buy external add-ons.

Buy Now
Questions 6

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Swap files

B.

Unused and hidden partition

C.

Slack spaces

D.

Allocated cluster

Buy Now
Questions 7

What are the purposes of audit records on an information system?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Backup

B.

Investigation

C.

Upgradation

D.

Troubleshooting

Buy Now
Questions 8

You are responsible for all computer security at your company. This includes initial investigation into alleged unauthorized activity. Which of the following are possible results of improperly gathering forensic evidence in an alleged computer crime by an employee?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Your company is sued for defaming the character of an accused party.

B.

You falsely accuse an innocent employee.

C.

Your company is unable to pursue the case against a perpetrator.

D.

You are charged with criminal acts.

Buy Now
Questions 9

Joseph works as a Software Developer for WebTech Inc. He wants to protect the algorithms and the techniques of programming that he uses in developing an application. Which of the following laws are used to protect a part of software?

Options:

A.

Trademark laws

B.

Code Security law

C.

Patent laws

D.

Copyright laws

Buy Now
Questions 10

You work as a Network Administrator for Blue Well Inc. Your company's network has a Windows 2000 server with the FAT file system. This server stores sensitive data. You want to encrypt this data to protect it from unauthorized access. You also have to accomplish the following goals:

Data should be encrypted and secure.

Administrative effort should be minimum.

You should have the ability to recover encrypted files in case the file owner leaves the company.

Other permissions on encrypted files should be unaffected.

File-level security is required on the disk where data is stored.

Encryption or decryption of files should not be the responsibility of the file owner.

You take the following steps to accomplish these goals:

Convert the FAT file system to NTFS file system.

Use third-party data encryption software.

What will happen after taking these steps?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

File-level security will be available on the disk where data is stored.

B.

Data will be encrypted and secure.

C.

Encryption or decryption of files will no longer be the responsibility of the file owner.

D.

Other permissions on encrypted files will remain unaffected.

E.

Administrative effort will be minimum.

Buy Now
Questions 11

John works as a professional Ethical Hacker. He is assigned a project to test the security of www.weare-secure.com. He enters a single quote in the input field of the login page of the We-are-secure Web site and receives the following error message:

Microsoft OLE DB Provider for ODBC Drivers error '0x80040E14'

This error message shows that the We-are-secure Website is vulnerable to __________.

Options:

A.

An XSS attack

B.

A SQL injection attack

C.

A Denial-of-Service attack

D.

A buffer overflow

Buy Now
Questions 12

In Linux, which of the following files describes the processes that are started up during boot up?

Options:

A.

/etc/passwd

B.

/etc/profile

C.

/etc/inittab

D.

/etc/shadow

Buy Now
Questions 13

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a multimedia enabled mobile phone, which is suspected to be used in a cyber crime. Adam uses a tool, with the help of which he can recover deleted text messages, photos, and call logs of the mobile phone. Which of the following tools is Adam using?

Options:

A.

Galleta

B.

FTK Imager

C.

FAU

D.

Device Seizure

Buy Now
Questions 14

Which of the following steps should be performed in order to optimize a system performance?

Each correct answer represents a complete solution. Choose three.

Options:

A.

Run anti-spyware program regularly

B.

Defragment the hard disk drive

C.

Edit registry regularly

D.

Delete the temporary files

Buy Now
Questions 15

Which of the following tools are used to determine the hop counts of an IP packet?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Netstat

B.

TRACERT

C.

IPCONFIG

D.

Ping

Buy Now
Questions 16

Which of the following statutes is enacted in the U.S., which prohibits creditors from collecting data from applicants, such as national origin, caste, religion etc?

Options:

A.

The Electronic Communications Privacy Act

B.

The Privacy Act

C.

The Fair Credit Reporting Act (FCRA)

D.

The Equal Credit Opportunity Act (ECOA)

Buy Now
Questions 17

What is the name of the Secondary IDE slave, fourth partition in Linux operating system according to the Linux naming convention?

Options:

A.

SDB3

B.

HDC4

C.

HDA4

D.

HDD4

Buy Now
Questions 18

You work as a professional Computer Hacking Forensic Investigator. A project has been assigned to you to investigate the DoS attack on a computer network of SecureEnet Inc. Which of the following methods will you perform to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Look for unusual traffic on Internet connections and network segments.

B.

Seize all computers and transfer them to the Forensic lab.

C.

Look for core files or crash dumps on the affected systems.

D.

Sniff network traffic to the failing machine.

Buy Now
Questions 19

Which of the following commands can you use to create an ext3 file system?

Each correct answer represents a complete solution. Choose two.

Options:

A.

mke2fs

B.

mkfs.ext3

C.

mke2fs -j

D.

mkfs.ext2

Buy Now
Questions 20

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that this iphone contains some sensitive information. Adam knows that the storage partition of the iphone is divided into two partitions. The first partition is used for the operating system. Other data of iphone is stored in the second partition. Which of the following is the name with which the second partition is mounted on the iphone?

Options:

A.

/private/var

B.

/var/data

C.

/var/private

D.

/data/var

Buy Now
Questions 21

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to fix partitions on a hard drive. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

fdformat

B.

exportfs

C.

fsck

D.

fdisk

Buy Now
Questions 22

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to allow direct access to the filesystems data structure. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

du

B.

debugfs

C.

df

D.

dosfsck

Buy Now
Questions 23

Adam works as a professional Computer Hacking Forensic Investigator. He has been called by the FBI to examine data of the hard disk, which is seized from the house of a suspected terrorist. Adam decided to acquire an image of the suspected hard drive. He uses a forensic hardware tool, which is capable of capturing data from IDE, Serial ATA, SCSI devices, and flash cards. This tool can also produce MD5 and CRC32 hash while capturing the data. Which of the following tools is Adam using?

Options:

A.

Wipe MASSter

B.

ImageMASSter 4002i

C.

ImageMASSter Solo-3

D.

FireWire DriveDock

Buy Now
Questions 24

John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He receives the following e-mail:

The e-mail that John has received is an example of __________.

Options:

A.

Virus hoaxes

B.

Spambots

C.

Social engineering attacks

D.

Chain letters

Buy Now
Questions 25

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of

Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer. After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do

dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done

Which of the following actions does Adam want to perform by the above command?

Options:

A.

Making a bit stream copy of the entire hard disk for later download.

B.

Deleting all log files present on the system.

C.

Wiping the contents of the hard disk with zeros.

D.

Infecting the hard disk with polymorphic virus strings.

Buy Now
Questions 26

You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company data. Which of the following is the most important step for you to take in preserving the chain of custody?

Options:

A.

Preserve the email server including all logs.

B.

Make copies of that employee's email.

C.

Seize the employee's PC.

D.

Place spyware on the employee's PC to confirm these activities.

Buy Now
Questions 27

Which of the following tools can be used by a user to hide his identity?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Proxy server

B.

Anonymizer

C.

Rootkit

D.

IPchains

E.

War dialer

Buy Now
Questions 28

Adam works as a Computer Hacking Forensic Investigator for a garment company in the United States. A project has been assigned to him to investigate a case of a disloyal employee who is suspected of stealing design of the garments, which belongs to the company and selling those garments of the same design under different brand name. Adam investigated that the company does not have any policy related to the copy of design of the garments. He also investigated that the trademark under which the employee is selling the garments is almost identical to the original trademark of the company. On the grounds of which of the following laws can the employee be prosecuted?

Options:

A.

Trademark law

B.

Cyber law

C.

Copyright law

D.

Espionage law

Buy Now
Questions 29

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

DOS boot disk

B.

Linux Live CD

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Buy Now
Questions 30

Which of the following directories in Linux operating system contains device files, which refers to physical devices?

Options:

A.

/boot

B.

/etc

C.

/dev

D.

/bin

Buy Now
Questions 31

Normally, RAM is used for temporary storage of data. But sometimes RAM data is stored in the hard disk, what is this method called?

Options:

A.

Cache memory

B.

Static memory

C.

Virtual memory

D.

Volatile memory

Buy Now
Questions 32

John works for an Internet Service Provider (ISP) in the United States. He discovered child

pornography material on a Web site hosted by the ISP. John immediately informed law enforcement authorities about this issue. Under which of the following Acts is John bound to take such an action?

Options:

A.

Civil Rights Act of 1991

B.

PROTECT Act

C.

Civil Rights Act of 1964

D.

Sexual Predators Act

Buy Now
Questions 33

Which of the following are the benefits of information classification for an organization?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It ensures that modifications are not made to data by unauthorized personnel or processes.

B.

It helps identify which information is the most sensitive or vital to an organization.

C.

It helps reduce the Total Cost of Ownership (TCO).

D.

It helps identify which protections apply to which information.

Buy Now
Questions 34

What is the name of the group of blocks which contains information used by the operating system in Linux system?

Options:

A.

logblock

B.

Systemblock

C.

Bootblock

D.

Superblock

Buy Now
Questions 35

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a compromised system of a cyber criminal, who hides some information in his computer. This computer runs on Linux operating system. Adam wants to extract the data units of a file, which is specified by its meta-data address. He is using the Sleuth Kit for this purpose. Which of the following commands in the Sleuth kit will he use to accomplish the task?

Options:

A.

dcat

B.

ifind

C.

icat

D.

istat

Buy Now
Questions 36

Adam works as a Computer Hacking Forensic Investigator in a law firm. He has been assigned with his first project. Adam collected all required evidences and clues. He is now required to write an investigative report to present before court for further prosecution of the case. He needs guidelines to write an investigative report for expressing an opinion. Which of the following are the guidelines to write an investigative report in an efficient way?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

All ideas present in the investigative report should flow logically from facts to conclusions.

B.

There should not be any assumptions made about any facts while writing the investigative report.

C.

Opinion of a lay witness should be included in the investigative report.

D.

The investigative report should be understandable by any reader.

Buy Now
Questions 37

Which of the following laws or acts, formed in Australia, enforces prohibition against cyber stalking?

Options:

A.

Stalking by Electronic Communications Act (2001)

B.

Malicious Communications Act (1998)

C.

Anti-Cyber-Stalking law (1999)

D.

Stalking Amendment Act (1999)

Buy Now
Questions 38

Which of the following is the Windows feature on which the file management can be performed by a PC user?

Options:

A.

Activity Monitor

B.

Task Manager

C.

Windows Explorer

D.

Finder

Buy Now
Questions 39

Which of the following Windows XP system files handles memory management, I/O operations, and interrupts?

Options:

A.

Ntoskrnl.exe

B.

Win32k.sys

C.

Advapi32.dll

D.

Kernel32.dll

Buy Now
Questions 40

Joseph works as a Web Designer for WebTech Inc. He creates a Web site and wants to protect it from lawsuits. Which of the following steps will he take to accomplish the task?

Each correct answer represents a part of the solution. Choose all that apply.

Options:

A.

Restrict the access to the site.

B.

Restrict shipping in certain areas.

C.

Restrict the transfer of information.

D.

Restrict customers according to their locations.

Buy Now
Questions 41

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?

Options:

A.

PFR image file

B.

iso image file

C.

RAW image file

D.

EnCase image file

Buy Now
Questions 42

Which of the following is a documentation of guidelines that computer forensics experts use to handle evidences?

Options:

A.

Chain of evidence

B.

Chain of custody

C.

Incident response policy

D.

Evidence access policy

Buy Now
Questions 43

Which of the following diagnostic codes sent by POST to the internal port h80 refers to the system board error?

Options:

A.

200 to 299

B.

100 to 199

C.

400 to 499

D.

300 to 399

Buy Now
Questions 44

In which of the following files does the Linux operating system store passwords?

Options:

A.

Password

B.

Passwd

C.

Shadow

D.

SAM

Buy Now
Questions 45

John, a novice web user, makes a new E-mail account and keeps his password as "apple", his favorite fruit. John's password is vulnerable to which of the following password cracking attacks?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Rule based attack

B.

Brute Force attack

C.

Dictionary attack

D.

Hybrid attack

Buy Now
Questions 46

Which of the following directories contains administrative commands and daemon processes in the Linux operating system?

Options:

A.

/etc

B.

/dev

C.

/usr

D.

/sbin

Buy Now
Questions 47

Which of the following tools is an asterisk password revealer tool?

Options:

A.

Aircrack

B.

SnadBoy

C.

Cain and Abel

D.

Pwdump3

Buy Now
Exam Code: GCFA
Exam Name: GIACCertified Forensics Analyst
Last Update: Apr 27, 2024
Questions: 318
GCFA pdf

GCFA PDF

$28  $80
GCFA Engine

GCFA Testing Engine

$33.25  $95
GCFA PDF + Engine

GCFA PDF + Testing Engine

$45.5  $130