Exam 2: Certified Network Defender

What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

The efforts to obtain information before a trail by demanding documents, depositions, questioned and answers written under oath, written requests for admissions of fact and examination of the scene is a description of what legal term?

The remediation of a specific audit finding is deemed too expensive and will not be implemented. Which of the following is a TRUE statement?

In order for a CISO to have true situational awareness there is a need to deploy technology that can give a real-time view of security events across the enterprise. Which of the following tools represents the BEST choice to achieve this awareness?

Which of the following backup sites takes the longest recovery time?

Which of the following activities results in change requests?

Which of the following is the MAIN security concern for public cloud computing?

An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

Physical security measures typically include which of the following components?

Which type of scan is used on the eye to measure the layer of blood vessels?

The PRIMARY objective of security awareness is to:

While working for a prosecutor, what do you think you should do if the evidence you found appears to be exculpatory and is not being released to the defense?

What TCP/UDP port does the toolkit program netstat use?

A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company's building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform?

Which legal document allows law enforcement to search an office, place of business, or other locale for evidence relating to an alleged crime?

Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?

Involvement of senior management is MOST important in the development of:

Bob has been trying to penetrate a remote production system for the past two weeks. This time however, he is able to get into the system. He was able to use the System for a period of three weeks. However, law enforcement agencies were recoding his every activity and this was later presented as evidence. The organization had used a Virtual Environment to trap Bob. What is a Virtual Environment?

Which is a standard procedure to perform during all computer forensics investigations?

What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message?