You are working as a computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact local law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject computer. You inform the officer that you will not be able to comply with thatnetwork sniffer on your network and monitor all traffic to the subject? computer. You inform the officer that you will not be able to comply with that request because doing so would:

• A.Write information to the subject hard driveWrite information to the subject? hard drive
• B.Make you an agent of law enforcement
• C.Violate your contract
• D.Cause network congestion

Comment: *

Name: *

Email: *

Verification: *

Shortcuts are the files with the extension .Ink that are created and are accessed by the users.
These files provide you with information about:

• A.Application logs
• B.Files or network shares
• C.Running application
• D.System logs

Comment: *

Name: *

Email: *

Verification: *

Study the log given below and answer the following question:
Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

• A.Disallow UDP53 in from outside to DNS server
• B.Allow UDP53 in from DNS server to outside
• C.Block all UDP traffic
• D.Disallow TCP53 in from secondaries or ISP server to DNS server

Comment: *

Name: *

Email: *

Verification: *

You are a security analyst performing a penetration tests for a company in the Midwest. After some initial reconnaissance, you discover the IP addresses of some Cisco routers used by the company. You type in the following URL that includes the IP address of one of the routers:
http://172.168.4.131/level/99/exec/show/config
After typing in this URL, you are presented with the entire configuration file for that router.
What have you discovered?

• A.Cisco IOS Arbitrary Administrative Access Online Vulnerability
• B.HTTP Configuration Arbitrary Administrative Access Vulnerability
• C.URL Obfuscation Arbitrary Administrative Access Vulnerability
• D.HTML Configuration Arbitrary Administrative Access Vulnerability

Comment: *

Name: *

Email: *

Verification: *

Why should you note all cable connections for a computer you want to seize as evidence?

• A.to know what peripheral devices exist
• B.to know what hardware existed
• C.in case other devices were connected
• D.to know what outside connections existed

Comment: *

Name: *

Email: *

Verification: *