Question 1

Which of the following commands shows you the names of all open shared files on a server and number of file locks on each file?

Accepted Answer

B

Explanation: The net file command is a standard Windows command-line utility used for network administration and live system analysis. Its specific function is to display a list of all shared files that are currently open on a server by remote users. The output includes the file's unique identification number, its full path, the name of the user who has it open, and, crucially, the number of locks currently placed on the file. This command provides a real-time snapshot of file access activity over the network, which is essential for both administration and forensic investigation.

Question 2

Billy, a computer forensics expert, has recovered a large number of DBX files during forensic investigation of a laptop. Which of the following email clients he can use to analyze the DBX files?

Accepted Answer

B

Explanation: The .dbx file extension is the native format used by Microsoft Outlook Express for storing email folders. Each folder within the email client, such as the Inbox, Sent Items, or user-created folders, is saved as a separate .dbx file (e.g., Inbox.dbx, Sent Items.dbx). Therefore, to analyze these files within their native application environment, a forensics expert would use Microsoft Outlook Express. While modern forensic tools can parse .dbx files, the question specifically asks for the email client that uses this format.

Question 3

Hash injection attack allows attackers to inject a compromised hash into a local session and use the hash to validate network resources.

Accepted Answer

A

Explanation: The statement accurately describes a credential access and lateral movement technique commonly known as a Pass-the-Hash (PtH) attack. In this attack, an adversary compromises a system and extracts a user's password hash (e.g., an NTLM hash) from memory or the Security Account Manager (SAM) database. The attacker then uses this hash to authenticate to other systems or services on the network as that user. This is achieved by "injecting" the stolen hash into a new logon session, bypassing the need for the original plaintext password. The authentication protocol uses the hash directly, making the attack successful.

Question 4

The Apache server saves diagnostic information and error messages that it encounters while
processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify
the Apache error log from the following logs.

Accepted Answer

B

Explanation: The Apache error log format is distinct from the access log. A typical error log entry includes a timestamp, the module and severity level (e.g., [error]), process and thread IDs, client information (e.g., [client 127.0.0.1]), and a descriptive message explaining the error. Option B is the only entry that precisely matches this standard structure, indicating a server-side issue—in this case, access denial due to server configuration. The other options represent different types of data or malformed entries.

Question 5

First response to an incident may involve three different groups of people, and each will have
differing skills and need to carry out differing tasks based on the incident. Who is responsible for
collecting, preserving, and packaging electronic evidence?

Accepted Answer

C

Explanation: Forensic laboratory staff are the designated professionals with the specialized training, methodologies, and tools required to correctly collect, preserve, and package electronic evidence. Their role is crucial for maintaining the integrity of the digital evidence and ensuring a legally defensible chain of custody. While other groups are involved in an incident response, the specific, technical tasks of evidence handling fall to forensic specialists to prevent spoliation (alteration or destruction of evidence) and ensure its admissibility in legal or disciplinary proceedings.

Question 6

The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to retrieve and
restore files. Once the file is moved to the recycle bin, a record is added to the log file that exists in
the Recycle Bin.
Which of the following files contains records that correspond to each deleted file in the Recycle Bin?

Accepted Answer

A

Explanation: In Windows operating systems prior to Vista (e.g., Windows XP, 2000, and 2003), the INFO2 file serves as the index or database for the Recycle Bin. This hidden system file, located in the RECYCLER directory, maintains a record for every item sent to the Recycle Bin. Each record contains crucial metadata, including the original full path of the deleted file, its size, and the timestamp of its deletion. This information is essential for the operating system to manage the contents of the Recycle Bin and to facilitate the restoration of files to their original locations.

Question 7

The need for computer forensics is highlighted by an exponential increase in the number of
cybercrimes and litigations where large organizations were involved. Computer forensics plays an
important role in tracking the cyber criminals. The main role of computer forensics is to:

Accepted Answer

D

Explanation: The fundamental role of computer forensics is to apply scientifically sound and legally accepted methodologies to investigate digital incidents. This involves the identification, preservation, extraction, analysis, and interpretation of digital data to reconstruct events. The ultimate goal is to produce factual, unbiased evidence that can be presented in a court of law or other formal proceedings to substantiate or refute claims about an attacker's actions. This process ensures that the findings are both reliable and admissible, serving as the factual basis for legal or disciplinary action.

Question 8

Netstat is a tool for collecting Information regarding network connections. It provides a simple view
of TCP and UDP connections, and their state and network traffic statistics.
Which of the following commands shows you the TCP and UDP network connections, listening ports,
and the identifiers?

Accepted Answer

A

Explanation: The command netstat -ano is the correct choice as it combines multiple flags to meet all the specified requirements. The -a flag displays all active TCP/UDP connections and listening ports. The -n flag displays addresses and port numbers in numerical form, preventing delays from DNS lookups. Most importantly, the -o flag includes the process identifier (PID) for each connection, which is the "identifier" referred to in the question. This combination provides a comprehensive snapshot of network activity and the processes responsible for it.

Question 9

Log management includes all the processes and techniques used to collect, aggregate, and analyze
computer-generated log messages. It consists of the hardware, software, network and media used to
generate, transmit, store, analyze, and dispose of log data.

Accepted Answer

A

Explanation: The statement provides a comprehensive and accurate definition of log management. It correctly identifies the core processes—collection, aggregation, and analysis—and encompasses the entire log data lifecycle, from generation and transmission to storage, analysis, and final disposal. Furthermore, it correctly includes the technological infrastructure (hardware, software, network, media) that underpins these activities. This definition aligns with established frameworks and best practices in computer security and forensics, which view log management as a holistic system involving both processes and technology to ensure data integrity, availability, and confidentiality for security monitoring and incident response.

Question 10

Raw data acquisition format creates ____________of a data set or suspect drive.

Accepted Answer

A

Explanation: A raw data acquisition format creates a bit-for-bit copy of the source media (e.g., a suspect drive) and saves it as a single file. This file is a direct, sequential representation of the original data, containing no additional metadata, compression, or internal structure. This type of image is often referred to as a "dd image" or a "flat file" because it is a simple, unstructured stream of bytes identical to the source from beginning to end.

Question 11

Which root folder (hive) of registry editor contains a vast array of configuration information for the system, including hardware settings and software settings?

Accepted Answer

C

Explanation: The HKEYLOCALMACHINE (HKLM) hive contains configuration data specific to the local computer, which is applied globally to all users. It serves as the central repository for a vast array of system information, including the hardware configuration (detected devices, drivers, and resources under the HARDWARE and SYSTEM subkeys) and system-wide software settings (under the SOFTWARE subkey). This information is critical for the boot process and system operation, independent of which user is logged on. The settings stored here define the machine's behavior and resources.

Question 12

Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.

Accepted Answer

A

Explanation: The provided statement is a correct and comprehensive definition of network forensics. This discipline involves the systematic capture, recording, and analysis of network traffic and associated data, such as event logs. The primary objective is to investigate security incidents, identify attack vectors, determine the extent of a compromise, and gather evidence for potential legal action. The terms "sniffing," "recording," and "acquisition" accurately describe the data collection phase, while "analysis" refers to the examination of that data to reconstruct events.

Question 13

BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP
images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each
bitmap file contains header, the RGBQUAD array, information header, and image data. Which of the
following element specifies the dimensions, compression type, and color format for the bitmap?

Accepted Answer

C

Explanation: The BMP file format contains a metadata structure called the Information Header (specifically, the BITMAPINFOHEADER structure). This header provides detailed information about the image itself. It includes essential attributes such as the bitmap's width and height (dimensions), the number of bits per pixel (which defines the color format), and the type of compression being used (e.g., BIRGB for uncompressed). The application reading the file uses this information to correctly interpret and display the subsequent image data.

Question 14

What is a chain of custody?

Accepted Answer

A

Explanation: The chain of custody is a critical legal and procedural document that provides a chronological record of the handling of evidence. It meticulously tracks the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. The primary purpose is to establish the integrity of the evidence by demonstrating that it has not been tampered with, altered, or substituted from the moment of its collection at the original location (e.g., crime scene) through its analysis at a forensic laboratory and its eventual presentation in court. This unbroken and documented trail is essential for the evidence to be considered admissible in legal proceedings.

Question 15

What is cold boot (hard boot)?

Accepted Answer

A

Explanation: A cold boot, also known as a hard boot, is the process of starting a computer from a state of being completely unpowered. When the power button is pressed, the system initiates a full startup sequence, beginning with the Power-On Self-Test (POST) conducted by the firmware (BIOS/UEFI). This test verifies that core hardware components are functional before the operating system is loaded from storage into memory. This is the standard method for turning on a computer that has been shut down.

Free GAQM CFA-001 Actual Exam Questions