- (Exam Topic 1)
Before you are called to testify as an expert, what must an attorney do first?

1. A. engage in damage control
2. B. prove that the tools you used to conduct your examination are perfect
3. C. read your curriculum vitae to the jury
4. D. qualify you as an expert witness

Correct Answer: D

- (Exam Topic 2)
Tyler is setting up a wireless network for his business that he runs out of his home. He has followed all the directions from the ISP as well as the wireless router manual. He does not have any encryption set and the SSID is being broadcast. On his laptop, he can pick up the wireless signal for short periods of time, but then the connection drops and the signal goes away.
Eventually the wireless signal shows back up, but drops intermittently. What could be Tyler issue with his home wireless network?

1. A. Computers on his wired network
2. B. Satellite television
3. C. 2.4Ghz Cordless phones
4. D. CB radio

Correct Answer: C

- (Exam Topic 3)
What does the 56.58.152.114(445) denote in a Cisco router log?
Jun 19 23:25:46.125 EST: %SEC-4-IPACCESSLOGP: list internet-inbound denied udp 67.124.115.35(8084)
-> 56.58.152.114(445), 1 packet

1. A. Source IP address
2. B. None of the above
3. C. Login IP address
4. D. Destination IP address

Correct Answer: D

- (Exam Topic 4)
Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?

1. A. Coreography
2. B. Datagrab
3. C. Ethereal
4. D. Helix

Correct Answer: D

- (Exam Topic 2)
What does the part of the log, “% SEC-6-IPACCESSLOGP”, extracted from a Cisco router represent?

1. A. The system was not able to process the packet because there was not enough room for all of the desired IP header options
2. B. Immediate action required messages
3. C. Some packet-matching logs were missed because the access list log messages were rate limited, or no access list log buffers were available
4. D. A packet matching the log criteria for the given access list has been detected (TCP or UDP)

Correct Answer: D