Jack Smith is a forensics investigator who works for Mason Computer Investigation
Services. He is investigating a computer that was infected by Ramen Virus.

He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?

• A.Those connections are in closed/waiting mode
• B.Those connections are in listening mode
• C.Those connections are in timed out/waiting mode
• D.Those connections are established

Comment: *

Name: *

Email: *

Verification: *

You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would:

• A.Write information to the subject hard driveWrite information to the subject? hard drive
• B.Violate your contract
• C.Cause network congestion
• D.Make you an agent of law enforcement

Comment: *

Name: *

Email: *

Verification: *

Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

• A.A simple DOS copy will not include deleted files, file slack and other information
• B.There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector
• C.A disk imaging tool would check for CRC32s for internal self checking and validation and have MD5 checksum
• D.Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file

Comment: *

Name: *

Email: *

Verification: *

Office Documents (Word, Excel and PowerPoint) contain a code that allows tracking the MAC or unique identifier of the machine that created the document. What is that code called?

• A.Globally unique ID
• B.Individual ASCII string
• C.Microsoft Virtual Machine Identifier
• D.Personal Application Protocol

Comment: *

Name: *

Email: *

Verification: *

Which response organization tracks hoaxes as well as viruses?

• A.CERT
• B.CIAC
• C.NIPC
• D.FEDCIRC

Comment: *

Name: *

Email: *

Verification: *