Exam 4: EC-Council Certified CISO

Where does Encase search to recover NTFS files and folders?

When using an iPod and the host computer is running Windows, what file system will be used?

An investigator is searching through the firewall logs of a company and notices ICMP packets that are larger than 65,536 bytes. What type of activity is the investigator seeing?

What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

Jonathan is a network administrator who is currently testing the internal security of his network. He is attempting to hijack a session, using Ettercap, of a user connected to his Web server. Why will Jonathan not succeed?

Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them within other pictures. What technique did the accused criminal employ?

A packet is sent to a router that does not have the packet destination address in its route table. How will the packet get to its proper destination?

Where are files temporarily written in Unix when printing?

To check for POP3 traffic using Ethereal, what port should an investigator search by?

You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?

Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus. He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?  

What layer of the OSI model do TCP and UDP utilize?

What advantage does the tool Evidor have over the built-in Windows search?

Sniffers that place NICs in promiscuous mode work at what layer of the OSI model?

Harold is a web designer who has completed a website for ghttech.net. As part of the maintenance agreement he signed with the client, Harold is performing research online and seeing how much exposure the site has received so far. Harold navigates to google.com and types in the following search. link:www.ghttech.net What will this search produce?

What is one method of bypassing a system BIOS password?

John is working on his company policies and guidelines. The section he is currently working on covers company documents; how they should be handled, stored, and eventually destroyed. John is concerned about the process whereby outdated documents are destroyed. What type of shredder should John write in the guidelines to be used when destroying documents?

What must an investigator do before disconnecting an iPod from any type of computer?

When searching through file headers for picture file formats, what should be searched to find a JPEG file in hexadecimal format?

If you are concerned about a high level of compression but not concerned about any possible data loss, what type of compression would you use?