Free Practice Questions for IISFA II0-001 Exam

Question 1

A well rounded information security program should include:

AUnderstanding on how to prevent events

BA security awareness program

CUnderstanding on how viruses work

DAll of the above

Correct Answer: B. A security awareness program

Question 2

Active shunting is the process in which an malicious attack is detected and the traffic is:

Ais routed, dynamically, through a CVP server for content filtering

Bis a automatically squelched at the source of the attack using protocol squelching.

Cis illegal due to its intrusive nature.

Dis blocked via dynamic ACLs in firewall or infrastructure divides.

Correct Answer: D. is blocked via dynamic ACLs in firewall or infrastructure divides.

Question 3

The investigator needs to think about reporting

AWhile the examination is in progress

BAt the end of the investigation

CTo Law Enforcement

DTo the attorney

Correct Answer: A. While the examination is in progress

Question 4

An effective method of remotely collecting logs (as evidence) is to TFTP the files and then hash them.

ATrue

BFalse

Correct Answer: B. False

Question 5

The following tool output example can be used in a dynamic investigation. What will it demonstrate?

Active Connections

Proto Local Address Foreign Address StateTCP local:epmap 90.21.1.4:0 LISTENING

TCP local:1036 baym-cs17.msgr.hotmail.com:1863 ESTABLISHED

TCP local:4925 mail.infoforensics.org:pop3 TIME_WAIT

TCP local:4926 mail.in

AAll machines on the local network

BThe local ARP table

CAll port services used to attack the host

DAll connection states to foreign hosts

Correct Answer: D. All connection states to foreign hosts

Question 6

Electronic evidence is easily

ACollected

BSeen

CChanged

DDocumented

Correct Answer: C. Changed

Question 7

Stream comparison used as a Traceback technique focuses on what two factors?

Athe IP address and victim port

Bthe packet contents and audit logs

Cinter-packet timing and the victim port

Dthe packet contents and inter-packet timing

Correct Answer: D. the packet contents and inter-packet timing

Question 8

In Microsoft's security architecture, the "SID" refers to:

ASecurity Intermodular Design

BSecurity Intramodular Design

CSecurity Identifier

DSecurity Identification Design

Correct Answer: C. Security Identifier

Question 9

A syslog server and a protocol sniffer perform the same basic function.

ATrue

BFalse

Correct Answer: B. False

Question 10

The measure of a magnetic media's ability to retain data is the media's:

AMagnetic Field

BCoercivity

COrientation

DStatic Force

Correct Answer: B. Coercivity

Question 11

Expertise in a team leader should include:

AStrong process background

BMinor technical knowledge

CSupervisor with at least 2 years experience

DAbility to work with peers

EBrief understanding of legal issues

Correct Answer: A. Strong process background

Question 12

A subject machine may have evidence in the clipboard if

AThe Pagefile has not been enlarged

BThe clipboard feature is active

CThe machine has not been restarted

DClipboard cache is dynamic and therefore is NOT categorized as evidence.

Correct Answer: C. The machine has not been restarted

Question 13

An effective counter measure to prevent unauthorized viewing of sensitive data is to:

AProvide security classifications on all security subjects

BInstall a packet analyzer to monitor traffic patterns with a watch for malicious activity

CEncrypt data with strong encryption techniques

DHoney pots with falsified sensitive data

Correct Answer: C. Encrypt data with strong encryption techniques

Question 14

During a message processing, headers will be added to the message at all times except?

Acomposition time

Bwhen an email client hands control to outgoing server

Cat the time of transfer from sending to receiving server

DAt time message is opened by recipient

Correct Answer: D. At time message is opened by recipient

Question 15

Challenges to the authenticity of computer records often take on one of three forms. Please select the statement that best describes one of the three challenges.

AParties may question the accountability of computer-generated records by challenging the authenticity of the computer program that generated the records.

BParties may challenge the authenticity of computer-stored records by questioning the authority of their author.

CParties may challenge the authenticity of both computer-generated and computerstored records by questioning whether the records were altered, manipulated, or damaged after they were created.

DParties may challenge the authenticity of both computer-generated and computerstored records by questioning whether the records were altered, manipulated, or damaged before they were created.

Correct Answer: C. Parties may challenge the authenticity of both computer-generated and computerstored records by questioning whether the records were altered, manipulated, or damaged after they were created.