CFS Digital Forensics & Cyber Fraud 3 — Questions and Answers
Question 1: Which type of malware encrypts a victim's files and demands payment for the decryption key, and has been increasingly used to extort businesses into paying fraudulently obtained funds?
- Spyware
- Adware
- Ransomware (Correct answer)
- Rootkit
Correct answer: Ransomware
Ransomware encrypts victim data and demands a ransom (often in cryptocurrency) for the decryption key, making it a powerful cyber extortion tool.
Question 2: In digital forensics, 'write blockers' are used to:
- Prevent suspects from deleting files during a search
- Prevent any writes to the evidence drive during acquisition, preserving its integrity (Correct answer)
- Block encrypted writes to external storage devices
- Prevent cloud synchronization during evidence collection
Correct answer: Prevent any writes to the evidence drive during acquisition, preserving its integrity
Write blockers are hardware or software devices that allow forensic examiners to read data from a storage medium while preventing any modifications to the original evidence.
Question 3: An employee is suspected of exfiltrating trade secrets via personal email. Which digital artifact would BEST confirm the specific files sent?
- Browser cookies from the company laptop
- Email server logs combined with attachment metadata from the sent folder (Correct answer)
- The company's firewall logs alone
- Windows Event Log ID 4624 (logon events)
Correct answer: Email server logs combined with attachment metadata from the sent folder
Email server logs capture message metadata including sender, recipient, timestamps, and attachment names, while the sent folder retains actual content, together providing the strongest evidence.
Question 4: Which federal law primarily governs unauthorized access to computers and networks in the United States, making cyber fraud activities prosecutable?
- Sarbanes-Oxley Act (SOX)
- Computer Fraud and Abuse Act (CFAA) (Correct answer)
- Electronic Communications Privacy Act (ECPA)
- Gramm-Leach-Bliley Act (GLBA)
Correct answer: Computer Fraud and Abuse Act (CFAA)
The Computer Fraud and Abuse Act (CFAA) is the primary U.S. federal statute criminalizing unauthorized computer access, hacking, and related cyber fraud activities.
Question 5: A fraud examiner discovers that a suspect used Tor browser for all communications. What is the PRIMARY investigative challenge this presents?
- Tor traffic cannot be captured by network monitoring tools
- Tor anonymizes internet traffic by routing it through multiple encrypted relays, obscuring the user's IP (Correct answer)
- All Tor traffic is automatically deleted from ISP servers
- Tor browsers do not leave any artifacts on the local machine
Correct answer: Tor anonymizes internet traffic by routing it through multiple encrypted relays, obscuring the user's IP
Tor routes internet traffic through multiple volunteer-operated nodes, each knowing only the previous and next hop, making it extremely difficult to trace traffic back to its origin.
Question 6: 'Pharming' attacks differ from standard phishing attacks in that pharming:
- Requires the user to click a malicious link in an email
- Redirects users to fraudulent websites by corrupting DNS resolution, without requiring any user click (Correct answer)
- Uses agricultural metaphors in social engineering messages
- Targets only mobile device users through SMS messages
Correct answer: Redirects users to fraudulent websites by corrupting DNS resolution, without requiring any user click
Pharming attacks compromise DNS servers or local host files to redirect legitimate website requests to fraudulent sites, bypassing the need for users to click malicious links.
Question 7: When analyzing network packet captures (PCAP files) for fraud evidence, which protocol would most likely contain plaintext credentials if an attacker used a legacy system?
- HTTPS (port 443)
- SSH (port 22)
- FTP (port 21) (Correct answer)
- SFTP (port 115)
Correct answer: FTP (port 21)
FTP transmits usernames, passwords, and file data in cleartext, making it a prime target for credential harvesting via packet capture analysis.
CFS Digital Forensics & Cyber Fraud 3
Which type of malware encrypts a victim's files and demands payment for the decryption key, and has been increasingly used to extort businesses into paying fraudulently obtained funds?