What is static executable file analysis?

• A.It is a process that consists of collecting information about and from an executable file by launching the file under any circumstances
• B.It is a process that consists of collecting information about and from an executable file without actually launching the file under any circumstances
• C.It is a process that consists of collecting information about and from an executable file without actually launching an executable file in a controlled and monitored environment
• D.It is a process that consists of collecting information about and from an executable file by launching an executable file in a controlled and monitored environment

Comment: *

Name: *

Email: *

Verification: *

In the following directory listing,

which file should be used to restore archived email messages for someone using Microsoft Outlook?

• A.Outlook bak
• B.Outlook ost
• C.Outlook NK2
• D.Outlook pst

Comment: *

Name: *

Email: *

Verification: *

In what way do the procedures for dealing with evidence in a criminal case differ from the procedures for dealing with evidence in a civil case?

• A.evidence procedures are not important unless you work for a law enforcement agency
• B.evidence in a criminal case must be secured more tightly than in a civil case
• C.evidence must be handled in the same way regardless of the type of case
• D.evidence in a civil case must be secured more tightly than in a criminal case

Comment: *

Name: *

Email: *

Verification: *

In Linux, what is the smallest possible shellcode?

• A.24 bytes
• B.80 bytes
• C.800 bytes
• D.8 bytes

Comment: *

Name: *

Email: *

Verification: *

You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.
Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

• A.All forms should be placed in an approved secure container because they are now primary evidence in the case
• B.The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file
• C.The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container
• D.All forms should be placed in the report file because they are now primary evidence in the case

Comment: *

Name: *

Email: *

Verification: *