Digital Forensics Assessment

 

Digital Forensics Assessment

#cybersecurity #coursera #quiz #solution #network

1.

Question 1

Digital forensics is commonly applied to which of the following activities?

1 / 1 point

Criminal investigation

Incident handling

Data recovery

All of the above

Correct

Correct!

2.

Question 2

NIST includes which three (3) as steps in collecting data? (Select 3)

1 / 1 point

Develop a plan to aquire the data

Correct

Partially correct!

Normalize the data

Acquire the data

Correct

Partially correct!

Verify the integrity of the data

Correct

Partially correct!

3.

Question 3

What is the primary purpose of maintaining a chain of custody?

1 / 1 point

To allow for accurate client billing

To keep valuable hardware securely locked to tables or floors.

To avoid allegations of mishandling or tampering of evidence.

So a person in possession of evidence will know who they are allowed to give it to next

Correct

Correct!

4.

Question 4

True or False. Digital forensics had been used to solve a number of high-profile violent crimes.

1 / 1 point

True

False

Correct

Correct!

5.

Question 5

True or False. Digital forensics report is a summary of your findings. If your case goes to trial, your testimony can, and usually does, involve far more detail than is in the report.

1 / 1 point

True

False

Correct

Correct!

6.

Question 6

Which section of a digital forensics report would include using the best practices of taking lots of screenshots, use built-in logging options of your digital forensics tools, and exporting key data items into a .csv or .txt file?

1 / 1 point

Overview & Case Summary

Forensic Acquisition & Examination Preparation

Findings & Analysis

Conclusion

Correct

Correct!

7.

Question 7

Which types of files are appropriate subjects for forensic analysis?

1 / 1 point

Data files

Image and video files

Application files

All of the above

Correct

Correct!

8.

Question 8

Deleting a file results in what action by most operating systems?

1 / 1 point

The file is copied to a trash or recycle folder and the original memory registers are erased.

Random data is immediately copied into the memory registers used by the file to obfuscate the previous contents.

The memory registers used by the file are marked as available for new storage but are otherwise not changed.

The memory registers used by the file are erased and marked as available for new storage.

Correct

Correct!

9.

Question 9

Forensic analysis should always be conducted on a copy of the original data. What type of copying is appropriate for getting data from a live system that cannot be taken offline?

1 / 1 point

A disk-to-disk backup

An incremental backup

A disk-to-file backup

A logical backup

Correct

Correct!

10.

Question 10

How does a forensic analysis use hash sets acquired from NIST's Software Reference Library project?

1 / 1 point

They are useful in identifying files that were created outside the United States.

They provide a record of known encrypted malware.

They can quickly eliminate known good operating system and application files from consideration.

Hashes will help you quickly zero in on deleted files.

Correct

Correct!

11.

Question 11

Which three (3) of the following data types are considered non-volatile? (Select 3)

1 / 1 point

Logs

Correct

Partially correct!

Free space

Swap files

Correct

Partially correct!

Dump files

Correct

Partially correct!

12.

Question 12

Configuration files are considered which data type?

1 / 1 point

Dynamic

Static

Volatile

Non-volatile

Correct

Correct!

13.

Question 13

True or False. When collecting forensic data from a running system, you should always attempt to collect non-volatile data first.

1 / 1 point

True

False

Correct

Correct!

14.

Question 14

Which three (3) of the following are application components? (Select 3)

1 / 1 point

Authentication mechanisms

Correct

Partially correct!

Application architecture

Correct

Partially correct!

OSI Application Layer protocols

Data files

Correct

Partially correct!

15.

Question 15

Which of these applications would likely be of the least interest in a forensic analysis?

1 / 1 point

Web host data

Email

Chat

Patch files

Correct

Correct!

16.

Question 16

The Internet layer of the TCP/IP stack, also known as the Network layer in the OSI model, contains which two (2) protocols that are very useful to a forensic investigation? (Select 2)

1 / 1 point

IPv4 / IPv6

Correct

Partially correct!

UDP

LDAP

ICMP

Correct

Partially correct!

17.

Question 17

Which device would you inspect if you were looking for event data correlated across a number of different network devices?

1 / 1 point

Firewall

Packet sniffer

Intrusion detection system

Remote access server

Correct

Correct!

18.

Question 18

Which of these sources might require a court order in order to obtain the data for forensic analysis?

1 / 1 point

Intrusion detection systems

System Event Management systems

ISP records

Firewalls

Correct

Correct!