CSI Cybersecurity & Digital Evidence Handling 5

Question 1

In digital forensics, what does the term 'anti-forensics' refer to?

Accepted Answer

Methods suspects use to destroy, hide, or obfuscate digital evidence

Answer

Anti-forensics encompasses techniques like data wiping, encryption, timestomping, and steganography used to hinder forensic investigations.

Question 2

Which of the following is an example of a 'watering hole' attack that a CSI investigator might encounter?

Accepted Answer

Compromising a website frequented by a target group to infect their systems

Answer

A watering hole attack compromises websites that the target group regularly visits, passively infecting them when they browse to the site.

Question 3

When testifying about digital evidence findings, a CSI investigator should characterize their role as a:

Accepted Answer

Neutral expert witness who presents factual findings regardless of which party they favor

Answer

A digital forensics expert witness must remain objective and impartial, presenting accurate findings that support truth regardless of which side retained them.

Question 4

A forensic analyst is examining Windows event logs and finds Event ID 4624 followed by 4672 for the same logon session. What does this combination indicate?

Accepted Answer

A successful logon where the account was also assigned special/elevated privileges

Answer

Event ID 4624 is a successful logon; Event ID 4672 indicates special privileges (often administrative) were assigned to that session.

Question 5

What is 'timestomping' and why is it significant in a digital forensic investigation?

Accepted Answer

Deliberately altering file system timestamps to mislead investigators about when files were created or modified

Answer

Timestomping changes MACB (Modified, Accessed, Changed, Born) timestamps to conceal when malicious files were placed on a system.

(CSI) Certified Security Investigator Practice Test

(CSI) Certified Security Investigator Practice Test

CSI Cybersecurity & Digital Evidence Handling 5