GAQM cfa-001 practice test

Certified Forensic Analyst Exam


Question 1

BMP (Bitmap) is a standard file format for computers running the Windows operating system. BMP
images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors). Each
bitmap file contains header, the RGBQUAD array, information header, and image data. Which of the
following element specifies the dimensions, compression type, and color format for the bitmap?

  • A. Header
  • B. The RGBQUAD array
  • C. Information header
  • D. Image data
Answer:

B

Discussions

Question 2

Damaged portions of a disk on which no read/Write operation can be performed is known as
______________.

  • A. Lost sector
  • B. Bad sector
  • C. Empty sector
  • D. Unused sector
Answer:

B

Discussions

Question 3

Wireless network discovery tools use two different methodologies to detect, monitor and log a
WLAN device (i.e. active scanning and passive scanning). Active scanning methodology involves
____________and waiting for responses from available wireless networks.

  • A. Broadcasting a probe request frame
  • B. Sniffing the packets from the airwave
  • C. Scanning the network
  • D. Inspecting WLAN and surrounding networks
Answer:

A

Discussions

Question 4

An intrusion detection system (IDS) gathers and analyzes information from within a computer or a
network to identify any possible violations of security policy, including unauthorized access, as well
as misuse.
Which of the following intrusion detection systems audit events that occur on a specific host?

  • A. Network-based intrusion detection
  • B. Host-based intrusion detection
  • C. Log file monitoring
  • D. File integrity checking
Answer:

B

Discussions

Question 5

Digital evidence validation involves using a hashing algorithm utility to create a binary or
hexadecimal number that represents the uniqueness of a data set, such as a disk drive or file.
Which of the following hash algorithms produces a message digest that is 128 bits long?

  • A. CRC-32
  • B. MD5
  • C. SHA-1
  • D. SHA-512
Answer:

B

Discussions

Question 6

A mobile operating system is the operating system that operates a mobile device like a mobile
phone, smartphone, PDA, etc. It determines the functions and features available on mobile devices
such as keyboards, applications, email, text messaging, etc. Which of the following mobile operating
systems is free and open source?

  • A. Web OS
  • B. Android
  • C. Apple IOS
  • D. Symbian OS
Answer:

B

Discussions

Question 7

The evolution of web services and their increasing use in business offers new attack vectors in an
application framework. Web services are based on XML protocols such as web Services Definition
Language (WSDL) for describing the connection points, Universal Description, Discovery, and
Integration (UDDI) for the description and discovery of Web services and Simple Object Access
Protocol (SOAP) for communication between Web services that are vulnerable to various web
application threats. Which of the following layer in web services stack is vulnerable to fault code
leaks?

  • A. Presentation Layer
  • B. Security Layer
  • C. Discovery Layer
  • D. Access Layer
Answer:

C

Discussions

Question 8

The IIS log file format is a fixed (cannot be customized) ASCII text-based format. The IIS format
includes basic items, such as client IP address, user name, date and time, service and instance, server
name and IP address, request type, target of operation, etc. Identify the service status code from the
following IIS log.
192.168.100.150, -, 03/6/11, 8:45:30, W3SVC2, SERVER, 172.15.10.30, 4210, 125, 3524, 100, 0, GET,
/dollerlogo.gif,

  • A. W3SVC2
  • B. 4210
  • C. 3524
  • D. 100
Answer:

D

Discussions

Question 9

International Mobile Equipment Identifier (IMEI) is a 15-dlgit number that indicates the
manufacturer, model type, and country of approval for GSM devices. The first eight digits of an IMEI
number that provide information about the model and origin of the mobile device is also known as:

  • A. Type Allocation Code (TAC)
  • B. Device Origin Code (DOC)
  • C. Manufacturer identification Code (MIC)
  • D. Integrated Circuit Code (ICC)
Answer:

A

Discussions

Question 10

Netstat is a tool for collecting Information regarding network connections. It provides a simple view
of TCP and UDP connections, and their state and network traffic statistics.
Which of the following commands shows you the TCP and UDP network connections, listening ports,
and the identifiers?

  • A. netstat -ano
  • B. netstat -b
  • C. netstat -r
  • D. netstat -s
Answer:

A

Discussions
To page 2