CFS Digital Forensics & Cyber Fraud 2

Question 1

Which file system artifact is MOST valuable for establishing a timeline of when files were created, accessed, or modified on a Windows NTFS volume?

Accepted Answer

$MFT (Master File Table)

Answer

The $MFT stores metadata for every file on an NTFS volume including MAC (Modified, Accessed, Created) timestamps, making it essential for timeline analysis.

Question 2

A fraudster uses a cryptocurrency tumbler (mixer) to launder proceeds. What is the PRIMARY purpose of this technique?

Accepted Answer

To obfuscate the transaction trail by mixing funds from multiple sources

Answer

Cryptocurrency tumblers break the transaction chain by pooling coins from many users and redistributing different coins, making blockchain tracing significantly harder.

Question 3

During a phishing investigation, you identify a spoofed email domain 'paypa1.com' used instead of 'paypal.com'. This technique is called:

Accepted Answer

Typosquatting

Answer

Typosquatting (also called URL hijacking) involves registering domains that are common misspellings or visual substitutions of legitimate brand names to deceive users.

Question 4

When conducting forensic analysis of cloud-based storage (e.g., Google Drive, OneDrive), which challenge is UNIQUE compared to local storage forensics?

Accepted Answer

Evidence may be stored across multiple jurisdictions with varying legal requirements

Answer

Cloud data often resides on servers in multiple countries simultaneously, creating complex legal jurisdiction issues requiring proper legal process in each relevant country.

Question 5

A business email compromise (BEC) scheme typically involves which initial step before executing a fraudulent wire transfer?

Accepted Answer

Gaining unauthorized access to or spoofing a trusted executive's email account

Answer

BEC schemes typically begin with compromising or impersonating a high-level executive's email to issue fraudulent payment instructions that appear legitimate to employees.

(CFS) Certified Fraud Specialist Practice Test

(CFS) Certified Fraud Specialist Practice Test

CFS Digital Forensics & Cyber Fraud 2