- (Topic 3)
An employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the employee computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to astored on the employee? computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the employee before he leaves the building and recover the floppy disk and secure his computer. Will you be able to break the encryption so that you can verify that the employee was in possession of the proprietary information?

1. A. EFS uses a 128-bit key that cannot be cracked, so you will not be able to recover the information
2. B. The EFS Revoked Key Agent can be used on the computer to recover the information
3. C. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information
4. D. When the encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover theinformation

Correct Answer: C

- (Topic 1)
Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.

1. A. True
2. B. False

Correct Answer: A

- (Topic 3)
When examining the log files from a Windows IIS Web Server, how often is a new log file created?

1. A. the same log is used at all times
2. B. a new log file is created everyday
3. C. a new log file is created each week
4. D. a new log is created each time the Web Server is started

Correct Answer: B
Wecannot tell if the question is referring to the httperr.log file (IIS 6.0) or is it referring to the logfiles for the website. If IIS is the case, “a new log file is created every day” should be the correct answer. Microsoft creates the log files in the following format: exYYMMdd.log format and rotates them daily.

- (Topic 3)
Meyer Electronics Systems just recently had a number of laptops stolen out of their office. On these laptops contained sensitive corporate information regarding patents and company strategies. A month after the laptops were stolen, a competing company was found to have just developed products that almost exactly duplicated products that Meyer produces. What could have prevented this information from being stolen from the laptops?

1. A. DFS Encryption
2. B. EFS Encryption
3. C. SDW Encryption
4. D. IPS Encryption

Correct Answer: B

- (Topic 2)
What type of equipment would a forensics investigator store in a StrongHold bag?

1. A. PDAPDA?
2. B. Backup tapes
3. C. Hard drives
4. D. Wireless cards

Correct Answer: D