Free Computer Hacking Forensic Investigator Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Computer Hacking Forensic Investigator practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A forged banking email directs recipients to a look-alike login page to obtain their account credentials. Which attack does this describe?

   1. A. Phishing
   2. B. Packet sniffing
   3. C. Port scanning
   4. D. DNS amplification

   Answer: A

   Explanation: NIST defines phishing as "use of deceptive computer-based means to trick individuals into disclosing sensitive personal information." The forged message and login page deceive the recipient into disclosing credentials.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops — Section 2.1, p. 3

2. 2In a federal proceeding governed by the Federal Rules of Evidence, what does Rule 1002 generally require to prove the content of a writing, recording, or photograph?

   1. A. An original, unless the rules or a federal statute provide otherwise.
   2. B. The physical storage device, even when the rules permit other proof.
   3. C. A witness's description, regardless of whether an original is available.
   4. D. A summary prepared by counsel, regardless of the underlying material.

   Answer: A

   Explanation: Rule 1002 states, "An original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise." This content-proof rule has exceptions; it neither invariably demands a physical device nor substitutes any description or summary.

   Reference: Federal Rules of Evidence — Rule 1002, p. 27

3. 3A filesystem uses 4,096-byte allocation units. A 6,000-byte file occupies two units. How much space within those allocated units is file slack?

   1. A. 1,904 bytes
   2. B. 4,096 bytes
   3. C. 6,000 bytes
   4. D. 2,192 bytes

   Answer: D

   Explanation: NIST explains that "an entire file allocation unit is still reserved for the file" and calls its unused portion file slack. Two units reserve 8,192 bytes; subtracting 6,000 leaves 2,192 bytes. The other values confuse the partial-unit content, unit size, or file size with unused allocated space.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 4.1.3, p. 4-5, Slack Space

4. 4An examiner processes collected data to extract files of interest while preserving integrity. In NIST's four-phase forensic process, which phase is this?

   1. A. Collection
   2. B. Reporting
   3. C. Examination
   4. D. Analysis

   Answer: C

   Explanation: NIST describes examination as processing collected data "to assess and extract data of particular interest, while preserving the integrity of the data." Collection acquires data, analysis interprets findings, and reporting communicates results.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 2.1, p. 2-2, Examination

5. 5On a conventional hard disk, a file has been logically deleted but its former data sectors have not been overwritten. Why may its contents still be recoverable?

   1. A. Logical deletion always zero-fills the sectors before releasing them.
   2. B. Deletion removes the file's content because its name is no longer listed.
   3. C. Releasing allocation units necessarily destroys their previous contents.
   4. D. Deleting the file's reference need not erase the underlying stored bytes.

   Answer: D

   Explanation: NIST explains, "When a file is deleted, it is typically not erased from the media". Removing a filesystem reference or marking allocation available is different from overwriting its bytes. Under the stated conventional-HDD and no-overwrite conditions, residual content may remain recoverable; deletion and deallocation alone do not establish erasure.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 4.1.3, p. 4-4, Deleted Files

6. 6Which Sysinternals utility is designed to enumerate configured Windows autostart locations, including logon entries, services, and scheduled tasks?

   1. A. Process Explorer
   2. B. Autoruns
   3. C. Process Monitor
   4. D. TCPView

   Answer: B

   Explanation: Microsoft says Autoruns "shows you the currently configured auto-start applications as well as the full list of Registry and file system locations available for auto-start configuration." It enumerates autostart configuration, rather than limiting the investigation to running processes, observed runtime events, or network endpoints.

   Reference: Autoruns — Usage

7. 7A user visits a compromised website that exploits a browser vulnerability to install attacker tools. Which delivery mechanism fits this evidence?

   1. A. A password-spraying attempt
   2. B. A drive-by download
   3. C. A network-service worm
   4. D. A credential-stuffing attempt

   Answer: B

   Explanation: NIST describes "web-based malware, also known as drive-by-download" and states that the infected site "attempts to exploit vulnerabilities on the user’s host". Exploiting the browser during the visit is this web delivery mechanism; the other options involve credential guessing or autonomous network propagation.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops — Section 2.1, p. 3

8. 8A digital duplicate accurately reproduces an original record. No genuine authenticity question or unfairness is present. Under Federal Rule of Evidence 1003, how is the duplicate treated?

   1. A. It needs the original's creator to consent before it can be admitted.
   2. B. It is admissible to the same extent as the original under that rule.
   3. C. It is usable only after every original copy has been destroyed.
   4. D. It must be converted to a sworn oral account to prove its content.

   Answer: B

   Explanation: Rule 1003 states, "A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate." The stated facts remove those exceptions. Creator consent, destruction, and oral conversion are not conditions of this rule.

   Reference: Federal Rules of Evidence — Rule 1003, p. 27

9. 9In disk and filesystem terminology, which description identifies a logical volume?

   1. A. A single physical sector that stores a disk's boot instructions.
   2. B. A partition or set of partitions formatted as one filesystem entity.
   3. C. The unused portion of the final allocation unit of a file.
   4. D. A named secondary data stream attached to an NTFS file.

   Answer: B

   Explanation: NIST states, "A logical volume is a partition or a collection of partitions acting as a single entity that has been formatted with a filesystem." A sector, slack region, and named stream are different storage structures.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 4.1.2, p. 4-3

10. 10An investigator evaluates extracted records to determine whether they support the suspected sequence of events. Which phase of NIST's forensic process is primarily involved?

    1. A. Analyzing the results of examination
    2. B. Identifying and collecting source data
    3. C. Reporting the methods and findings
    4. D. Examining data to extract relevant items

    Answer: A

    Explanation: NIST describes analysis as using the examination results "to derive useful information that addresses the questions" motivating the investigation. Evaluating what the records mean is analysis rather than acquiring, extracting, or reporting them.

    Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 2.1, p. 2-2, Analysis