QUESTION 229
The information security manager at a national legal firm has received several alerts from the intrusion detection system that a known attack signature was detected against the organization’s file server. What should the information security manager do first?

QUESTION 230
Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the described hard drive?
22,164 cylinders/disk
80 heads/cylinder
63 sectors/track

QUESTION 231
Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to Instructions written in assembly language. Which tool should he use for this purpose?

QUESTION 232
During an Investigation, the first responders stored mobile devices In specific containers to provide network Isolation. All the following are examples of such pieces of equipment, except for:

QUESTION 233
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?

QUESTION 234
In Linux, what is the smallest possible shellcode?

QUESTION 235
The Recycle Bin exists as a metaphor for throwing files away, but it also allows a user to retrieve and restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

QUESTION 236
When conducting computer forensic analysis, you must guard against ______________ So that you remain focused on the primary job and insure that the level of work does not increase beyond what was originally expected.

QUESTION 237
Which tool allows dumping the contents of process memory without stopping the process?

QUESTION 238
On Linux/Unix based Web servers, what privilege should the daemon service be run under?

QUESTION 239
Raw data acquisition format creates _________ of a data set or suspect drive.

QUESTION 240
In the following directory listing,

Which file should be used to restore archived email messages for someone using Microsoft Outlook?

QUESTION 241
An investigator Is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

QUESTION 242
Robert needs to copy an OS disk snapshot of a compromised VM to a storage account in different region for further investigation. Which of the following should he use in this scenario?

QUESTION 243
A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file. What kind of picture is this file?

QUESTION 244
Which federal computer crime law specifically refers to fraud and related activity in connection with access devices like routers?