Practice Test Geeks(CSX) Cybersecurity Nexus Certification Practice Test
← All CSX Flashcard Decks

Forensic Science & Analysis Flashcards

7 cards from real CSX practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Forensic Science & Analysis flashcards as text

  1. Which type of steganography hides data by altering the least significant bit of pixel color values in an image?

    Answer: LSB (Least Significant Bit) steganography

    LSB steganography embeds hidden data by replacing the least significant bit of each pixel's color channel, causing imperceptible visual changes while hiding information.

  2. What is a 'dead box' forensic examination?

    Answer: Analysis of a powered-off system where the storage media is examined externally

    Dead box forensics involves analyzing a powered-off system, typically by removing the storage media and examining it in a controlled lab environment with write blockers.

  3. An investigator recovers a file from unallocated disk space. What process was used to find this file?

    Answer: File carving

    File carving is the process of recovering files from unallocated space by searching for file header and footer signatures without relying on file system metadata.

  4. In the context of email forensics, what does the 'Received' header field reveal?

    Answer: The hop-by-hop path the email traveled through mail servers

    Each 'Received' header is appended by every mail server that handles the email, creating a traceable path from sender to recipient that can reveal the message's origin.

  5. What Windows artifact tracks the last 10 files opened per application and is stored in the user's AppData folder?

    Answer: Jump Lists

    Jump Lists are Windows artifacts stored in AppData that record recently and frequently accessed files per application, providing evidence of user file access activity.

  6. During malware analysis, what is the purpose of running a sample in a 'sandbox' environment?

    Answer: To observe malware behavior in an isolated environment without risking production systems

    A sandbox provides an isolated, monitored environment where malware can execute safely, allowing analysts to observe its behavior, network connections, and system modifications.

  7. What is the significance of the 'MZ' magic bytes found at the beginning of a file?

    Answer: The file is a Windows Portable Executable (PE) file

    The 'MZ' signature (0x4D 0x5A) marks the start of a Windows Portable Executable file, named after Mark Zbikowski, one of the DOS architects who designed the format.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. isaca.org — Test delivery, eligibility, fees, passing score, registration deadline, renewal, retake fee, retake policy, score release, time limit · verified Oct 2026