New Year Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: best70

GCFA GIACCertified Forensics Analyst Questions and Answers

Questions 4

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?

Options:

A.

PFR image file

B.

iso image file

C.

RAW image file

D.

EnCase image file

Buy Now
Questions 5

Convention on Cybercrime, created by the Council of Europe, is the treaty seeking to address

Computer crime and Internet crimes by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. Which of the following chapters of Convention of Cybercrime contains the provisions for mutual assistances and extradition rules related to cybercrimes?

Options:

A.

Chapter II

B.

Chapter IV

C.

Chapter III

D.

Chapter I

Buy Now
Questions 6

This type of virus infects programs that can execute and load into memory to perform predefined steps for infecting systems. It infects files with the extensions .EXE, .COM, .BIN, and .SYS. As it can replicate or destroy these types of files, the operating system becomes corrupted and needs reinstallation. This type of virus is known as __________.

Options:

A.

Polymorphic virus

B.

Stealth virus

C.

Boot sector virus

D.

File virus

E.

Multipartite virus

Buy Now
Questions 7

You are responsible for maintaining and troubleshooting PC's at your company. The receptionist reports her screen has gone blue. When you get there you notice the 'blue screen of death' with an error message NTFS_FILE_SYSTEM. What is the most likely cause of this error?

Options:

A.

The hard disk is corrupt

B.

A virus

C.

Windows was installed improperly.

D.

Get the latest patch for Windows.

Buy Now
Questions 8

Which of the following tools is used to restore deleted files from Linux and Mac OS X file system?

Options:

A.

Easy-Undelete

B.

Active@ UNERASER

C.

Active@ UNDELETE

D.

R-Undelete

Buy Now
Questions 9

Which of the following statements best describes the consequences of the disaster recovery plan test?

Options:

A.

If no deficiencies were found during the test, then the plan is probably perfect.

B.

The results of the test should be kept secret.

C.

The plan should not be changed no matter what the results of the test would be.

D.

If no deficiencies were found during the test, then the test was probably flawed.

Buy Now
Questions 10

Which of the following Windows XP system files handles memory management, I/O operations, and interrupts?

Options:

A.

Ntoskrnl.exe

B.

Win32k.sys

C.

Advapi32.dll

D.

Kernel32.dll

Buy Now
Questions 11

Which of the following enables an inventor to legally enforce his right to exclude others from using his invention?

Options:

A.

Artistic license

B.

Phishing

C.

Spam

D.

Patent

Buy Now
Questions 12

Which of the following tools in Helix Windows Live is used to reveal the database password of password protected MDB files created using Microsoft Access or with Jet Database Engine?

Options:

A.

Asterisk logger

B.

FAU

C.

Galleta

D.

Access Pass View

Buy Now
Questions 13

Which of the following describes software technologies that improve portability, manageability, and compatibility of applications by encapsulating them from the underlying operating system on which they are executed?

Options:

A.

Group Policy

B.

System registry

C.

System control

D.

Application virtualization

Buy Now
Questions 14

Adam works as a Computer Hacking Forensic Investigator in a law firm. He has been assigned with his first project. Adam collected all required evidences and clues. He is now required to write an investigative report to present before court for further prosecution of the case. He needs guidelines to write an investigative report for expressing an opinion. Which of the following are the guidelines to write an investigative report in an efficient way?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

All ideas present in the investigative report should flow logically from facts to conclusions.

B.

There should not be any assumptions made about any facts while writing the investigative report.

C.

Opinion of a lay witness should be included in the investigative report.

D.

The investigative report should be understandable by any reader.

Buy Now
Questions 15

Mark works as a Network administrator for SecureEnet Inc. His system runs on Mac OS X. He wants to boot his system from the Network Interface Controller (NIC). Which of the following snag keys will Mark use to perform the required function?

Options:

A.

N

B.

D

C.

C

D.

Z

Buy Now
Questions 16

Which of the following NIST RA process steps has the goal to identify the potential threat-sources and compile a threat statement listing the potential threat-sources that are applicable to the IT system being evaluated?

Options:

A.

Threat Identification

B.

Vulnerability Identification

C.

Impact Analysis

D.

Control Analysis

Buy Now
Questions 17

Peter works as a Technical Representative in a CSIRT for SecureEnet Inc. His team is called to investigate the computer of an employee, who is suspected for classified data theft. Suspect's computer runs on Windows operating system. Peter wants to collect data and evidences for further analysis. He knows that in Windows operating system, the data is searched in pre-defined steps for proper and efficient analysis. Which of the following is the correct order for searching data on a Windows based system?

Options:

A.

Volatile data, file slack, registry, memory dumps, file system, system state backup, internet traces

B.

Volatile data, file slack, registry, system state backup, internet traces, file system, memory dumps

C.

Volatile data, file slack, internet traces, registry, memory dumps, system state backup, file system

D.

Volatile data, file slack, file system, registry, memory dumps, system state backup, internet traces

Buy Now
Questions 18

Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with the project of investigating an iPod, which is suspected to contain some explicit material. Adam wants to connect the compromised iPod to his system, which is running on Windows XP (SP2) operating system. He doubts that connecting the iPod with his computer may change some evidences and settings in the iPod. He wants to set the iPod to read-only mode. This can be done by changing the registry key within the Windows XP (SP2) operating system. Which of the following registry keys will Adam change to accomplish the task?

Options:

A.

HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies

B.

HKEY_LOCAL_MACHINE\CurrentControlset\Control\StorageDevicePolicies

C.

HKEY_LOCAL_MACHINE\System\CurrentControlset\StorageDevicePolicies

D.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

Buy Now
Questions 19

Which of the following methods is used by forensic investigators to acquire an image over the network in a secure manner?

Options:

A.

DOS boot disk

B.

Linux Live CD

C.

Secure Authentication for EnCase (SAFE)

D.

EnCase with a hardware write blocker

Buy Now
Questions 20

You work as a Network Administrator for Net Perfect Inc. The company has a Windows Server 2008 network environment. The network is configured as a Windows Active Directory-based single forest single domain network. The network is configured on IP version 6 protocol. All the computers on the network are connected to a switch device. One day, users complain that they are unable to connect to a file server. You try to ping the client computers from the server, but the pinging fails. You try to ping the server's own loopback address, but it fails to ping. You restart the server, but the problem persists.

What is the most likely cause?

Options:

A.

The cable that connects the server to the switch is broken.

B.

Automatic IP addressing is not working.

C.

The switch device is not working.

D.

The server is configured with unspecified IP address.

E.

The server's NIC is not working.

Buy Now
Questions 21

You work as a Network Administrator for uCertify Inc. You want to edit the MSDOS.SYS file, in your computer, from the DOS prompt. You are unable to find the file. What is the most likely cause?

Options:

A.

It is a read-only file.

B.

It is a built-in command in the COMMAND.COM file.

C.

Someone has deleted the file.

D.

It is a hidden file.

Buy Now
Questions 22

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to fix partitions on a hard drive. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

fdformat

B.

exportfs

C.

fsck

D.

fdisk

Buy Now
Questions 23

Normally, RAM is used for temporary storage of data. But sometimes RAM data is stored in the hard disk, what is this method called?

Options:

A.

Cache memory

B.

Static memory

C.

Virtual memory

D.

Volatile memory

Buy Now
Questions 24

Which of the following Acts enacted in United States allows the FBI to issue National Security Letters (NSLs) to Internet service providers (ISPs) ordering them to disclose records about their customers?

Options:

A.

Wiretap Act

B.

Computer Fraud and Abuse Act

C.

Economic Espionage Act of 1996

D.

Electronic Communications Privacy Act of 1986

Buy Now
Questions 25

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of

Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer. After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do

dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done

Which of the following actions does Adam want to perform by the above command?

Options:

A.

Making a bit stream copy of the entire hard disk for later download.

B.

Deleting all log files present on the system.

C.

Wiping the contents of the hard disk with zeros.

D.

Infecting the hard disk with polymorphic virus strings.

Buy Now
Questions 26

Which of the following is a type of intruder detection that involves logging network events to a file for an administrator to review later?

Options:

A.

Packet detection

B.

Passive detection

C.

Active detection

D.

Event detection

Buy Now
Questions 27

Which of the following is a correct sequence of different layers of Open System Interconnection (OSI) model?

Options:

A.

Physical layer, data link layer, network layer, transport layer, presentation layer, session layer, and application layer

B.

application layer, presentation layer, network layer, transport layer, session layer, data link layer, and physical layer

C.

Physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer

D.

Physical layer, network layer, transport layer, data link layer, session layer, presentation layer, and application layer

Buy Now
Questions 28

Which of the following tools are used for footprinting?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Sam spade

B.

Traceroute

C.

Whois

D.

Brutus

Buy Now
Questions 29

Which of the following switches of the XCOPY command copies attributes while copying files?

Options:

A.

/o

B.

/p

C.

/k

D.

/s

Buy Now
Questions 30

Which of the following directories in Linux operating system contains device files, which refers to physical devices?

Options:

A.

/boot

B.

/etc

C.

/dev

D.

/bin

Buy Now
Questions 31

An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to?

Options:

A.

Network security policy

B.

User password policy

C.

Privacy policy

D.

Backup policy

Buy Now
Questions 32

You are handling technical support calls for an insurance company. A user calls you complaining that he cannot open a file, and that the file name appears in green while opening in Windows Explorer.

What does this mean?

Options:

A.

The file is encrypted.

B.

The file belongs to another user.

C.

The file is infected with virus.

D.

The file is compressed.

Buy Now
Questions 33

Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the above scenario?

Options:

A.

Alternate Data Streams is a feature of Linux operating system.

B.

Adam is using FAT file system.

C.

Adam is using NTFS file system.

D.

Adam's system runs on Microsoft Windows 98 operating system.

Buy Now
Questions 34

Which of the following directories contains administrative commands on a UNIX computer?

Options:

A.

/usr/local

B.

/sbin

C.

/bin

D.

/export

Buy Now
Questions 35

Which of the following encryption methods use the RC4 technology?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

Dynamic WEP

B.

TKIP

C.

Static WEP

D.

CCMP

Buy Now
Questions 36

John works as a Network Security Professional. He is assigned a project to test the security of www.we-are-secure.com. He is working on the Linux operating system and wants to install an Intrusion Detection System on the We-are-secure server so that he can receive alerts about any hacking attempts. Which of the following tools can John use to accomplish the task?

Each correct answer represents a complete solution. Choose all that apply.

Options:

A.

SARA

B.

Snort

C.

Tripwire

D.

Samhain

Buy Now
Questions 37

You are the Security Consultant and have been hired to check security for a client's network. Your client has stated that he has many concerns but the most critical is the security of Web applications on their Web server. What should be your highest priority then in checking his network?

Options:

A.

Vulnerability scanning

B.

Setting up IDS

C.

Port scanning

D.

Setting up a honey pot

Buy Now
Questions 38

Which of the following files in LILO booting process of Linux operating system stores the location of Kernel on the hard drive?

Options:

A.

/boot/map

B.

/boot/boot.b

C.

/etc/lilo.conf

D.

/sbin/lilo

Buy Now
Questions 39

Which of the following tables is formed by NTFS file system to keep the track of files, to store metadata, and their location?

Options:

A.

The Master File Table

B.

The System File Table

C.

The Master Allocation Table

D.

The File Allocation Table

Buy Now
Questions 40

A Web-based credit card company had collected financial and personal details of Mark before issuing him a credit card. The company has now provided Mark's financial and personal details to another company. Which of the following Internet laws has the credit card issuing company violated?

Options:

A.

Security law

B.

Privacy law

C.

Copyright law

D.

Trademark law

Buy Now
Questions 41

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a multimedia enabled mobile phone, which is suspected to be used in a cyber crime. Adam uses a tool, with the help of which he can recover deleted text messages, photos, and call logs of the mobile phone. Which of the following tools is Adam using?

Options:

A.

Galleta

B.

FTK Imager

C.

FAU

D.

Device Seizure

Buy Now
Questions 42

Which of the following statements about SD cards are true?

Each correct answer represents a complete solution. Choose two.

Options:

A.

It is used with mobile phones and digital cameras.

B.

It is a type of non-volatile memory card.

C.

It is a 184-pin memory module.

D.

It is used as RAM on client computers and servers.

Buy Now
Questions 43

You work as the Network Administrator for McNeil Inc. The company has a Unix-based network. You want to set the hard disk geometry parameters, cylinders, heads, and sectors. Which of the following Unix commands can you use to accomplish the task?

Options:

A.

mkfs

B.

mkswap

C.

mke2fs

D.

hdparm

Buy Now
Questions 44

Which of the following file attributes are not available on a FAT32 partition?

Each correct answer represents a complete solution. Choose two.

Options:

A.

Compression

B.

Encryption

C.

Read Only

D.

Hidden

E.

Archive

Buy Now
Questions 45

What is the name of the Secondary IDE slave, fourth partition in Linux operating system according to the Linux naming convention?

Options:

A.

SDB3

B.

HDC4

C.

HDA4

D.

HDD4

Buy Now
Questions 46

Fill in the blank with the appropriate file system.

Alternate Data Streams (ADS) is a feature of the_____ file system, which allows more than one data stream to be associated with a filename.

Options:

A.

NTFS

Buy Now
Questions 47

In a Windows 98 computer, which of the following utilities is used to convert a FAT16 partition to FAT32?

Options:

A.

CVT16.EXE

B.

CVT1.EXE

C.

CONVERT16.EXE

D.

CONVERT.EXE

Buy Now
Exam Code: GCFA
Exam Name: GIACCertified Forensics Analyst
Last Update: Dec 22, 2024
Questions: 318

PDF + Testing Engine

$134.99

Testing Engine

$99.99

PDF (Q&A)

$84.99