A.The U.S. National Institute of Standards and Technology
Special Publication 800-86
defines ____________ phases for the forensic process.
a. Two.
b. Three.
c. Four.
d. None of the above.
B. Fraud auditors are concerned with ____________
a. Inquiry instead of interviewing.
b. Confirmation instead of alternative sources.
c. Observation versus surveillance.
d. None of the above.
C. Computers store files in disk clusters but generally don’t put two files in the same cluster. This leads to ____________.
a. Unallocated space.
b. Free space.
c. Slack space.
d. None of the above.
D. Putting together pieces of deleted files is called ____________.
a. Registry filtering.
b. Registry extraction.
c. Registry assembly.
d. None of the above.
E. Wear leveling applies to ____________.
a. Hard drives.
b. Solid state drives.
c. Both hard drives and solid state drives.
d. Neither hard drives nor solid state drives.
F. Fraud auditors are likely to use ____________.
a. CATS.
b. CAATs.
c. CASTS.
d. None of the above.
G. Denial of service attacks may be against ____________.
a. Individual websites.
b. Domain name servers.
c. Either a or b.
d. None of the above.
H. The computer forensics examiner may remove an entire computer from a crime scene and take it to a forensics lab. This approach involves ____________.
a. Live acquisition.
b. Static acquisition.
c. Network acquisition.
d. None of the above.
I. IAFIS is an FBI system for looking up ____________.
a. DNA.
b. Handwriting.
c. Fingerprints.
d. All of the above.
J. FINCEN is useful in ____________ investigations.
a. Terrorist.
b. Money laundering.
c. Both terrorist and money laundering.
d. None of the above.