312-49v9 Practice Test

Which of the following statement is not correct when dealing with a powered-on computer
at the crime scene?

A.

If a computer is switched on and the screen is viewable, record the programs running on
screen and photograph the screen

B.

If a computer is on and the monitor shows some picture or screen saver, move the
mouse slowly without depressing any mouse button and take a photograph of the screen
and record the information displayed

C.

If a monitor is powered on and the display is blank, move the mouse slowly without
depressing any mouse button and take a photograph

D.

If the computer is switched off. power on the computer to take screenshot of the desktop

Damaged portions of a disk on which no read/Write operation can be performed is known
as ______________.

A.

Lost sector

B.

Bad sector

C.

Empty sector

D.

Unused sector

Which of the following statements is incorrect related to acquiring electronic evidence at
crime scene?

A.

Sample banners are used to record the system activities when used by the unauthorized
user

B.

In warning banners, organizations give clear and unequivocal notice to intruders that by
signing onto the system they are expressly consenting to such monitoring

C.

The equipment is seized which is connected to the case, knowing the role of the
computer which will indicate what should be taken

D.

At the time of seizing process, you need to shut down the computer immediately

Email archiving is a systematic approach to save and protect the data contained in emails
so that it can tie easily accessed at a later date.

A.

True

B.

False 

Which of the following password cracking techniques works like a dictionary attack, but
adds some numbers and symbols to the words from the dictionary and tries to crack the
password?

A.

Brute forcing attack

B.

Hybrid attack

C.

Syllable attack

D.

Rule-based attack