Free CFA-001 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The first step in any dictionary-based password cracking attack is to prepare the list of potential passwords to be tested. This list, known as a wordlist or dictionary, is the foundation of the attack. It can be sourced from pre-compiled lists or generated using specialized tools. Subsequent steps, such as hashing the words in the list and comparing them against the target hash, are entirely dependent on the initial creation or acquisition of this wordlist. Without it, the attack cannot commence.

B. The list of dictionary words is hashed or encrypted: This is a subsequent step that occurs only after the wordlist has been created or obtained.

C. The hashed wordlist is compared against the target hashed password, generally one word at a time: This comparison phase happens after the wordlist is created (Step 1) and the words are hashed (Step 2).

D. If it matches, that password has been cracked and the password cracker displays the unencrypted version of the password: This is the final outcome of a successful comparison, not the first step of the process.

1. Goodrich, M. T., & Tamassia, R. (2011). Introduction to Computer Security. Pearson Education. In Chapter 9, Section 9.3 "Password Security and Cracking," the text describes offline dictionary attacks, which begin with the attacker obtaining the password file and a large dictionary of likely passwords.

2. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 5, "Authentication," details password cracking methods. The description of a dictionary attack explicitly starts with the attacker compiling a dictionary of common words and likely passwords to test.

3. University of California, Berkeley. (n.d.). CS 161: Computer Security, Lecture 9: Authentication. Retrieved from course materials. The lecture notes outline the process for a dictionary attack, stating the first steps are to "Get a copy of the password file" and "Get a big dictionary of words." This establishes the acquisition of the wordlist as a primary, initial action. (Specific reference: Slide on "Dictionary Attacks").

Event logs are the primary records of occurrences within an operating system. Specifically, logs categorized as "System" logs (a common type of event log, e.g., in Windows) are designed to record events logged by the operating system's components. These include operational actions such as the failure of a driver to load or a service starting or stopping successfully. This makes them the most direct source for investigating the operational behavior of the OS itself, which is crucial for identifying anomalies or suspicious activities at the host level.

B. Audit logs: These are a subset of event logs focused specifically on security-relevant actions, such as user logon/logoff or file access attempts, as defined by an audit policy.

C. Firewall logs: These logs exclusively record information about network traffic that is permitted or denied by the host's firewall, not general OS component actions.

D. IDS logs: These are generated by a separate Intrusion Detection System application to alert on potential malicious activity, not by the core OS components about their operational status.

1. National Institute of Standards and Technology (NIST). (2006). Guide to Computer Security Log Management (Special Publication 800-92).

Section 2.2, "Log Categories," and Table 2-1, "Sources of Logs," differentiate between various log types. It describes system event logs as recording OS-level events, including system errors and operational information, distinct from security-specific audit logs or network device logs.

2. Microsoft Corporation. (2021). Event Logging - Win32 apps. Microsoft Docs.

In the section "Event Logs," the documentation specifies the purpose of the System log: "The System log contains events logged by Windows system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log." This directly aligns with the question's focus on "operational actions performed by OS components."

3. Carnegie Mellon University, Software Engineering Institute. (2004). The CERT Guide to System and Network Security Practices. Addison-Wesley.

Chapter 12, "Respond to Incidents," discusses the importance of various log sources. It clarifies that operating system logs (event logs) provide detailed information about system processes, errors, and operational status, which is fundamental for host-level incident investigation.

A deposition is a formal, adversarial component of the pre-trial discovery process. Standard legal practice dictates that attorneys for all represented parties are present. The deposing attorney questions the witness, while the witness's own counsel is present to protect their client, make objections, and ensure procedural rules are followed. The presence of only one attorney would be highly irregular, as it would leave the deponent without legal protection or prevent the opposing side from conducting its examination, thereby defeating the purpose of the deposition.

A. The presence of attorneys representing both the deponent and the questioning party is the standard and expected procedure.

C. Depositions are conducted outside of court as a discovery mechanism; therefore, a judge and jury are not present.

D. The fundamental purpose of a deposition is for the opposing counsel to ask questions and obtain sworn testimony from a witness.

1. Federal Rules of Civil Procedure (FRCP), Rule 30. Depositions by Oral Examination. This rule governs the process of depositions in U.S. federal courts. The structure of the rule, particularly sections on notice to other parties (30(b)), conduct of the examination, and objections (30(c)), inherently presumes the attendance and participation of counsel for all involved parties.

2. Cornell Law School, Legal Information Institute (LII). In its definition of "Deposition," the LII describes it as a proceeding where "one party's attorney asks questions of the other party or of a witness for the other party." This description establishes the standard involvement of at least two opposing attorneys. (Source: Cornell Law School, LII Wex Legal Dictionary, "Deposition").

3. American Bar Association (ABA). In "How Courts Work," the ABA describes the deposition process: "In a deposition, a witness is required to answer questions from the lawyers for each of the parties in the presence of a court reporter." This confirms the standard practice involves lawyers for each party. (Source: American Bar Association, Public Education, "How Courts Work," section on Discovery).

The statement provides an accurate definition of email archiving. It is a systematic process designed to move email data from primary storage (e.g., a live mail server) to a separate, secure, and indexed repository. The primary goals are long-term preservation and protection of data. This ensures that historical email communications can be efficiently searched, retrieved, and produced for various purposes, including regulatory compliance, legal e-discovery, and internal audits. The system is built specifically for easy and rapid access to historical data, which is a core function.

B. False: This option is incorrect. The provided statement is a standard and widely accepted definition of email archiving, accurately capturing its systematic nature and its core functions of saving, protecting, and enabling easy retrieval of email data.

1. Al-Haj, A., & Al-Zoube, M. (2011). A comparative study of email archiving solutions. International Journal of Computer Science and Information Security, 9(4), 133-139. In the introduction (Section 1, Paragraph 2), the authors define the process: "Email archiving is the process of capturing, preserving, and making easily searchable all email traffic to and from an individual, a group of individuals, or an entire organization." This aligns directly with the question's statement.

2. Giaretta, D. (2011). Advanced Digital Preservation. Springer. In Chapter 3, "The Threat," Section 3.2.1 "Email," the text discusses the necessity of archiving email for long-term value and legal admissibility, stating, "The need for email archiving is driven by the need to preserve information... and by the need for litigation support and e-Discovery" (p. 36). This supports the "save and protect" and "access at a later date" aspects of the definition.

3. Cornell University IT. (n.d.). Email Archiving. In the service description, it states, "Email Archiving... moves email and attachments from your Exchange account to an online archive. This service is intended to help you manage your mailbox storage quotas and to retain email for business or legal reasons." This university documentation confirms the systematic approach to saving data for later access.

The net use command is the correct tool for this task. When executed on a Windows system, it displays a list of the computer's active connections to shared resources on other systems. In a forensic investigation, this is critical for identifying which remote servers or shares the subject machine has connected to. This information can reveal potential data exfiltration points, connections to command-and-control (C2) servers, or lateral movement within the network by an attacker. It specifically shows the outgoing sessions initiated by the local machine.

A. Net sessions: This command lists incoming sessions to the local server from other computers, not the outgoing sessions from the server as required by the question.

C. Net config: This command is used to display or modify the configuration of the "Server" or "Workstation" services, not to view active network sessions.

D. Net share: This command lists the shared resources (e.g., folders, printers) on the local machine that are available to other systems on the network.

---

1. Microsoft Corporation. (n.d.). net use. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-use

Reference Detail: The official documentation states, "Used without parameters, net use retrieves a list of network connections." This confirms its function to display outgoing connections to remote resources.

2. Microsoft Corporation. (n.d.). net sessions. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-sessions

Reference Detail: The documentation specifies that net sessions is used to "list or disconnect sessions between a local computer and the clients connected to it," confirming it shows incoming, not outgoing, sessions.

3. Carnegie Mellon University, Software Engineering Institute. (2008). The CERT Guide to Coordinated Vulnerability Disclosure. (Report No. CMU/SEI-2017-SR-022).

Reference Detail: While not a direct command reference, forensic guides from reputable institutions often detail standard procedures. Incident response methodologies taught in such contexts differentiate between commands for incoming (net sessions) and outgoing (net use) connections as a fundamental step in live system analysis.

4. Al-Sabea, H., & Al-Dhaqm, A. (2021). Digital forensic investigation of windows live system. Journal of Physics: Conference Series, 1892(1), 012021. https://doi.org/10.1088/1742-6596/1892/1/012021

Reference Detail: In Table 1, "Volatile Data Collection from Windows System," the paper lists the net use command with the description "To display the list of network connections," validating its use in live forensic investigations to identify outgoing connections.

Client mis-association is an attack where an attacker sets up a malicious access point (AP), often referred to as an "evil twin," that appears to be a legitimate one. This is typically done by using the same SSID as the trusted corporate network. By broadcasting a stronger signal than the legitimate AP, the attacker's device can lure or trick client devices into automatically connecting (associating) with it. Once the client mis-associates with the malicious AP, the attacker can intercept traffic, steal credentials, or launch further attacks against the user's device.

A. War driving: This is the practice of searching for and mapping Wi-Fi networks from a moving vehicle; it is a reconnaissance technique, not an attack that lures users.

B. Rogue access points: While the attack uses a rogue access point, this term broadly refers to any unauthorized AP. "Client mis-association" specifically describes the attack of luring clients to connect to it.

C. MAC spoofing: This is a technique used to change a device's MAC address to impersonate a legitimate, authorized device, primarily to bypass MAC filtering controls, not to lure clients.

1. National Institute of Standards and Technology (NIST) Special Publication 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs), February 2012.

Section 3.3.1, "Rogue APs", discusses "Evil Twin APs," which are the mechanism for this attack: "An evil twin AP is a rogue AP that is configured to impersonate a legitimate AP... The evil twin AP can then be used to eavesdrop on traffic from the clients that associate with it." This process of clients connecting to the evil twin is client mis-association.

2. Bellardo, J., & Savage, S. (2003). 802.11 Denial-of-Service Attacks: Real Vulnerabilities and Practical Solutions. In Proceedings of the 12th USENIX Security Symposium.

Section 3.2, "AP and Client Mis-association", explicitly details this attack vector, describing how an attacker can force a client to deauthenticate from its legitimate AP and re-associate with an attacker-controlled AP.

3. Holt, A., & Huang, C. Y. (2010). 802.11 Wireless Networks: Security and Analysis. Springer.

Chapter 5, "Wireless Attacks and Threat Assessment", describes mis-association attacks where a client is tricked into associating with a malicious AP, often through an evil twin setup, allowing for man-in-the-middle attacks. (Specific reference in section on "Evil Twin Access Points").

The TCP/IP model's Transport Layer is responsible for end-to-end communication services for applications. The two primary protocols operating at this layer are the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). UDP provides a connectionless datagram service, which offers minimal overhead but does not guarantee delivery, order, or duplicate protection. It is a fundamental protocol of the Transport Layer, used by applications like DNS, DHCP, and various streaming media services. The other protocols listed operate at the Application Layer, utilizing the services of Transport Layer protocols like TCP or UDP.

B. HTTP (Hypertext Transfer Protocol) is an Application Layer protocol used for transmitting hypermedia documents, such as HTML. It relies on TCP for transport services.

C. FTP (File Transfer Protocol) is an Application Layer protocol designed for transferring files between a client and a server. It uses TCP for its control and data connections.

D. SNMP (Simple Network Management Protocol) is an Application Layer protocol for managing devices on IP networks. It typically uses UDP for its transport services.

1. Postel, J. (1980). RFC 768: User Datagram Protocol. Internet Engineering Task Force (IETF). Retrieved from https://doi.org/10.17487/RFC0768. The document abstract and introduction define UDP and its role as a transport protocol on top of the Internet Protocol (IP).

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 2, "Application Layer," protocols such as HTTP (Section 2.2), FTP (Section 2.4), and SNMP are detailed. Chapter 3, "Transport Layer," focuses exclusively on TCP and UDP as the core protocols of this layer.

3. Braden, R. (Ed.). (1989). RFC 1122: Requirements for Internet Hosts -- Communication Layers. Internet Engineering Task Force (IETF). Section 1.3.3, "The Layering Model," outlines the TCP/IP stack, and Section 4, "TRANSPORT LAYER," explicitly discusses TCP and UDP as the protocols for this layer.

The maximum size of a FAT32 volume is practically limited to 2 terabytes (TB). This limitation is not inherent to the FAT32 file system architecture itself, which can theoretically support volumes up to 8 TB. Instead, the 2 TB limit arises from the widespread use of the Master Boot Record (MBR) partitioning scheme on which FAT32 volumes are typically created. MBR uses 32-bit addresses for disk sectors. With a standard sector size of 512 bytes, the maximum addressable space is 2^32 sectors 512 bytes/sector, which equals 2 TB.

A. 1 terabytes: This is an arbitrary value and is significantly lower than the actual limit imposed by the MBR partitioning scheme.

C. 3 terabytes: This size exceeds the 2 TB addressing capability of the MBR partition table when using standard 512-byte sectors.

D. 4 terabytes: This size also exceeds the 2 TB addressing capability of the MBR partition table with 512-byte sectors.

1. Official Vendor Documentation: Microsoft Corporation. (2021). FAT32 file system specification. Microsoft Docs. In the "FAT32 On-Disk Layout" section, the document describes the architectural components. The practical limit is discussed in related support articles, such as "Limitations of the FAT32 File System in Windows XP," which notes the 2 TB partition limit due to MBR constraints.

2. Academic Publication: Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "FAT Concepts and Analysis," it is stated: "With a 512-byte sector size, the MBR partition table can support partitions up to only 2 TB in size. Therefore, the maximum size of a FAT file system on a PC is typically 2 TB." (p. 258).

3. University Courseware: O'Hallaron, D. R., & Bryant, R. E. (2015). Computer Systems: A Programmer's Perspective (3rd ed.). Carnegie Mellon University. Chapter 10, "System-Level I/O," discusses disk structures and partitioning, explaining the 32-bit LBA (Logical Block Addressing) in MBR which, with 512-byte blocks (sectors), leads to the ~2 TB maximum disk size.

RS232 (Recommended Standard 232) is a long-established and widely used standard for serial communication. It defines the electrical characteristics and signal timing for communication between data terminal equipment (DTE), like a computer, and data communication equipment (DCE), such as a modem or data acquisition unit. In the context of data acquisition systems, RS232 is frequently used for low-speed, short-distance connections where a single device is connected directly to a computer's COM port. While standards like RS422 offer longer distance capabilities, RS232 remains a fundamental and common protocol for many serial-based data acquisition tasks.

A. RS422 is a standard for longer-distance (up to 1200m) and higher-speed serial communication using differential signals, typically for industrial environments and multi-drop networks.

B. RS423 is an unbalanced (single-ended) serial standard that offers better distance and speed than RS232 but is far less common than RS232 or RS422.

D. RS231 is not a recognized EIA/TIA (Electronic Industries Alliance/Telecommunications Industry Association) standard for serial data communication in this context and is an invalid option.

1. Northrop, R. B. (2014). Introduction to Instrumentation and Measurements (3rd ed.). CRC Press. In Chapter 11, "Data Acquisition and Communication Systems," Section 11.5.1 discusses serial data communication standards, identifying RS-232-C as a primary standard for interfacing instruments with computers.

2. National Instruments. (2023). Serial Communication Overview. NI. Retrieved from ni.com. Document ID: 4222. This official vendor documentation details serial standards, explaining, "RS-232 is a popular serial communication standard... it is limited to point-to-point connections... at relatively low data rates (up to 20 kb/s) and short distances (up to 50 ft)."

3. Karris, S. T. (2004). Serial Port Complete: COM Ports, USB Virtual COM Ports, and Ports for Embedded Systems (2nd ed.). Cengage Learning. Chapter 2, "The RS-232 Standard," provides a comprehensive overview of RS232 as the foundational serial interface for personal computers and associated peripherals.

Mail bombing is a specific type of denial-of-service (DoS) attack where an attacker sends a massive volume of emails to a single email address or domain. The primary intent is to overwhelm the mail server's resources (e.g., storage, processing power) or completely fill the victim's mailbox storage quota. This prevents the target from receiving legitimate email and can render the email service unusable. The attack's definition directly matches the scenario described in the question, focusing on volume to cause a service outage.

A. Email spamming: This involves sending unsolicited bulk messages to numerous recipients, typically for commercial or malicious advertisement, not a targeted DoS attack on one system.

C. Phishing: This is a form of social engineering that uses deceptive emails to trick users into revealing sensitive information, not to overwhelm a server.

D. Email spoofing: This is a technique of forging the sender's address in an email, often used in phishing or spam, but it is not the volume-based attack itself.

1. National Institute of Standards and Technology (NIST). (n.d.). Mail Bomb. In CSRC Glossary. Retrieved from https://csrc.nist.gov/glossary/term/mailbomb. The definition states: "An attack in which a large quantity of messages are sent to a user or system to try and cause a denial of service."

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 7, "Denial-of-Service Attacks," the text distinguishes between spam and targeted DoS attacks like email bombing, which aims to overwhelm a specific target.

3. Schuba, C. L., Krsul, I. V., Kuhn, M. G., Spafford, E. H., Sundaram, A., & Zamboni, D. (1997). Analysis of a denial of service attack on TCP. Proceedings of the 1997 IEEE Symposium on Security and Privacy, 208-223. https://doi.org/10.1109/SECPRI.1997.601338. This foundational paper discusses various DoS mechanisms, including resource exhaustion attacks at the application layer, of which mail bombing is a classic example.

The primary purpose of a digital forensic investigative report is to clearly and accurately communicate findings to a varied audience, which may include non-technical stakeholders like lawyers, judges, and juries. Consistency in terminology, data representation, and the logical flow of the analysis is paramount to prevent ambiguity and ensure the report is understandable and credible. While a structured format is beneficial, rigid adherence to a specific format is less important than the report's internal consistency. An inconsistent report, even in a perfect format, can create confusion and undermine the entire investigation's validity.

B. False: This is incorrect. A report can adhere to a strict format but be rendered confusing and unreliable by inconsistent use of terms, references, or data presentation, making consistency the more critical factor for clarity.

1. Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to Integrating Forensic Techniques into Incident Response (NIST Special Publication 800-86).

Section 4.3, Reporting (Page 4-10): This section emphasizes that reports should be "thorough, accurate, and impartial" and tailored to the needs of the audience. This principle supports prioritizing clarity and understandability—achieved through consistency—over strict adherence to a single format. The content's quality is the focus.

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press.

Chapter 17, Reporting and Presenting Evidence, Section: "General Guidelines for Report Content" (pp. 589-590): The text stresses that a report must be a "stand-alone document" that is clear, concise, and unambiguous. It states, "Consistency is also important to avoid confusion... For instance, use consistent terminology and units of measure throughout the report." This directly highlights the importance of consistency for avoiding confusion.

3. Maras, M. H. (2014). Computer Forensics: Cybercriminals, Laws, and Evidence (2nd ed.). Jones & Bartlett Learning.

Chapter 10, The Computer Forensics Report, Section: "The Written Report" (p. 314): This university-level textbook explains that the report must be written with the audience in mind and avoid jargon. It notes, "The report should be a cohesive document... The report should be consistent." This reinforces that cohesion and consistency are fundamental attributes of a professionally written forensic report, essential for it to be understood and accepted.

The swap file (e.g., pagefile.sys in Windows) is a critical source of evidence that originates from Random Access Memory (RAM). Operating systems use the swap file as virtual memory, moving less-frequently used memory "pages" from physical RAM to this file on the hard disk to free up RAM for active processes. As a result, the swap file can contain remnants of running processes, network connections, user credentials, and other volatile data that was once resident in RAM. Forensic investigators analyze the swap file to recover this transient information, which may not be present in a live memory dump or may have been paged out before acquisition.

B. SAM file: This is the Security Account Manager file, which stores local user account password hashes, not a general cache for RAM data.

C. Data file: This term is too generic; it does not refer to a specific system file or location used for storing paged-out RAM contents.

D. Log file: Log files are used for recording system, service, or application events, not for storing the contents of physical memory.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response. Section 3.2.2, "Volatile Data Collection and Examination," states, "...hibernation files (e.g., hiberfil.sys) and page files (e.g., pagefile.sys) on a hard drive can contain a wealth of information, because they are used to store the contents of RAM at a particular point in time."

2. Ligh, M. H., Case, A., Levy, J., & Walters, A. (2014). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Wiley. Chapter 1, "Introduction to Memory Forensics," p. 4, explains how virtual memory systems use a paging file on disk to store memory pages that are not currently in physical RAM.

3. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Chapter 13, "Content-Based Analysis," discusses how swap space can contain data from memory, including passwords and other sensitive information that has been paged out of RAM.

The file system of a Subscriber Identity Module (SIM) card, which stores critical and persistent data such as the International Mobile Subscriber Identity (IMSI), security keys, contacts, and SMS messages, resides in non-volatile memory. This type of memory, typically Electrically Erasable Programmable Read-Only Memory (EEPROM), retains its data even when power is removed from the SIM card. While a SIM also contains volatile memory (RAM) for temporary data processing and application execution, the permanent file structure must be stored in a non-volatile medium to ensure data integrity and persistence across power cycles.

A. Volatile: Volatile memory, such as RAM, loses all stored information when power is disconnected, making it fundamentally unsuitable for storing the permanent file system of a SIM card.

1. ETSI TS 102 221 V16.5.0 (2021-04), Smart Cards; UICC-Terminal interface; Physical and logical characteristics. Section 4.2, "UICC Architecture," describes the presence of a CPU, ROM, RAM, and Non-Volatile Memory (NVM), specifying that the NVM (e.g., EEPROM) is used for storing the file system and associated data.

2. Rasjid, Z. E., Wibisono, W., & Hori, Y. (2012). SIM Card File System and Its Forensic Analysis. International Journal of Computer Science and Information Security, 10(2), 109-114. In Section II.B, "SIM Card Architecture," the paper explicitly states, "The SIM card has its own file system which is stored in an EEPROM." EEPROM is a type of non-volatile memory.

3. Rankl, W., & Effing, W. (2010). Smart Card Handbook (4th ed.). John Wiley & Sons. Chapter 4, "Smart Card ICs," Section 4.2.3, "Memory," details that the file system and user data in a smart card (like a SIM) are stored in non-volatile EEPROM or Flash memory.

The Network Time Protocol (NTP) uses a hierarchical system of stratum levels to define the distance from a reference clock. Stratum 0 devices are the primary reference time sources, such as atomic or GPS clocks. Stratum 1 servers are directly connected to Stratum 0 devices. Each subsequent stratum level represents an additional network hop away from the reference clock. A Stratum 2 server synchronizes its time over the network from a Stratum 1 server. Following this logic, a Stratum 3 server gets its time over a network link, via NTP, from a Stratum 2 server, and this pattern continues for higher strata.

A. Stratum 0 devices are reference clocks (e.g., GPS), not servers on the network, and they are directly connected to the computers that become Stratum 1 servers.

B. A Stratum 1 server is directly attached to a UTC source; it does not use a network path for this primary synchronization.

C. This statement describes a Stratum 1 server. A Stratum 2 server gets its time from a Stratum 1 server over a network path.

1. Mills, D. (2010). Network Time Protocol Version 4: Protocol and Algorithms Specification. IETF. RFC 5905. Section 2.2, "Clock Discipline Algorithm", Page 11. "The stratum of a local clock is a number from 0 to 15... By convention, the stratum of a reference clock is 0... The stratum of a secondary server is one greater than the stratum of its synchronization source." https://doi.org/10.17487/RFC5905

2. National Institute of Standards and Technology (NIST). (n.d.). Questions about the Internet Time Service (ITS). Time and Frequency Division. "Stratum 1 servers are attached directly to a time source such as a cesium clock or a GPS receiver. Stratum 2 servers get their time from stratum 1 servers, and so on."

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Section 7.3, "Network Time Protocol (NTP)", describes the hierarchical nature where a server at stratum k+1 synchronizes with a server at stratum k.

Static executable file analysis is a fundamental technique in computer forensics and malware analysis. It involves examining an executable file to understand its structure, code, and potential functionality without running the program. This method is considered safe as the potentially malicious code is never executed. Analysts inspect elements like the file header, embedded strings, imported and exported functions, and the disassembled code to gather intelligence about the file's purpose and origin.

B. This describes dynamic analysis, which is the opposite of static analysis, as it requires the file to be launched to observe its behavior.

C. While static analysis is done "without launching," the phrase "in a controlled and monitored environment" is characteristic of dynamic analysis (sandboxing), making this option confusing and less accurate than A.

D. This is the precise definition of dynamic analysis, where a file is executed within a secure, isolated environment (a sandbox) to monitor its actions safely.

1. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. In Chapter 3, "Basic Static Analysis," the concept is introduced: "Basic static analysis consists of examining the executable file without viewing the actual instructions." (p. 41).

2. National Institute of Standards and Technology (NIST). (2005). Special Publication 800-83: Guide to Malware Incident Prevention and Handling. Section 3.3.2, "Analyzing Malware," states, "Static analysis is the process of analyzing a file without executing it." (p. 24).

3. Eilam, E. (2011). Reversing: Secrets of Reverse Engineering. Wiley. Chapter 1, "Foundations," distinguishes between the two primary analysis methods: "Static analysis... is based on analyzing code without actually executing it... Dynamic analysis is based on information gathered during program execution." (p. 18).

The Automated Field Correlation approach is a data analysis technique used in exploratory data analysis and digital forensics. It involves systematically applying statistical methods, such as calculating Pearson or Spearman correlation coefficients, to every pair of fields (variables) within a dataset. This process automatically identifies the strength and direction (positive or negative) of linear or monotonic relationships between variables. The goal is to uncover significant patterns and dependencies across single or multiple fields without prior hypotheses, which directly matches the method described in the question.

A. Graph-based approach: This method models relationships as nodes and edges, focusing on network structure, paths, and connectivity rather than systematically calculating statistical correlation coefficients between all data fields.

B. Neural network-based approach: This approach learns complex, often non-linear relationships implicitly through its layered structure and weights during training. It does not perform an explicit, systematic check of pairwise correlations.

C. Rule-based approach: This approach applies a set of predefined "if-then" rules to data. It is used for classification or decision-making based on known conditions, not for discovering unknown statistical correlations.

1. James, G., Witten, D., Hastie, T., & Tibshirani, R. (2021). An Introduction to Statistical Learning: with Applications in R (2nd ed.). Springer. In Chapter 3, Section 3.3.3, the concept of the correlation matrix is discussed as a tool to systematically examine the pairwise correlations between all variables in a dataset. This forms the basis of an automated field correlation approach. (Available via Stanford University: https://web.stanford.edu/~hastie/ISLRv2website.pdf)

2. Guttag, J. V. (2016). 6.0002 Introduction to Computational Thinking and Data Science. MIT OpenCourseWare. Lecture 9, "Statistical Thinking," covers the computation of correlations between variables in a dataset as a fundamental step in data analysis. The accompanying code demonstrates the automation of this process to systematically compare fields. (See Lecture 9 notes and code examples).

3. Beebe, N. L. (2009). Digital Forensic Triage: An Application of Automated Forensic Hypothesis Generation and Testing. University of Texas at San Antonio, Department of Information Systems and Technology Management. This dissertation discusses the automation of forensic analysis, including "automated correlation" (Chapter 4, Section 4.2.2) to systematically identify relationships between different data artifacts, aligning with the principles of the automated field correlation approach.

A bit-stream copy, also known as a forensic image or physical acquisition, is a fundamental process in digital forensics. It involves creating an exact, bit-for-bit duplicate of a source storage medium, such as a hard drive or USB stick. This method captures all data on the device, including active files, deleted files that have not yet been overwritten, hidden partitions, and data in unallocated and slack space. The resulting copy is a forensically sound replica of the original evidence, ensuring that the integrity of the original medium is preserved while allowing for in-depth analysis on the copy.

B. This is incorrect because a bit-stream copy is file-system independent and captures more than just active NTFS files and folders.

C. This is incorrect because a bit-stream copy is not limited to the FAT32 file system; it applies to any file system or even raw, unformatted media.

D. This describes a logical acquisition, which only copies active files, not a bit-stream copy that captures all data including deleted files.

1. Nelson, B., Phillips, A., & Steuart, C. (2015). Guide to Computer Forensics and Investigations (5th ed.). Cengage Learning. In Chapter 3, "The Investigator’s Office and Laboratory," the text defines a bit-stream copy as a "bit-by-bit copy of the original storage medium that creates an exact copy of the original disk."

2. Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to Integrating Forensic Techniques into Incident Response (NIST Special Publication 800-86). National Institute of Standards and Technology. Section 3.2.1, "Imaging," states: "Imaging creates a bit-for-bit copy of the media... This is also known as a physical acquisition."

3. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 3, "Volume Analysis," the author describes physical acquisition as reading the raw data from the sectors of a disk, which is the essence of a bit-stream copy. He states, "The raw image file is a sequential, flat file that contains the raw data from the original disk."

A computer forensic report is the formal, written culmination of a digital investigation. Its fundamental purpose is to provide a complete, accurate, and objective account of the entire process. This includes detailing the initial request, the legal authority, the chain of custody for all evidence, the methods and tools used for acquisition and analysis, and the findings and conclusions drawn from the evidence. The report must be sufficiently detailed to allow another qualified examiner to reproduce the results and for non-technical stakeholders, such as courts or management, to understand the investigation's outcome.

B. False: This is incorrect because the statement accurately describes the primary function and required content of a computer forensic report, which is to serve as a comprehensive record of the investigation.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response. Section 4.4, "Reporting," states, "The reporting phase involves reporting the results of the analysis, which may include describing the actions performed, explaining how tools and procedures were selected, determining what other actions need to be performed... The report should be written with the target audience in mind." This confirms the report's role in detailing the complete process.

2. Scientific Working Group on Digital Evidence (SWGDE). (2017). SWGDE Best Practices for Digital Forensics (Version 3.1). Section 5.3, "Reporting," specifies that a report should contain, at a minimum, administrative and case information, a list of evidence examined, the tools used, and a detailed explanation of the examination steps and findings. This underscores the requirement for detailed information on the complete process.

3. Palmer, G. L. (2001). A Road Map for Digital Forensic Research. Report from the First Digital Forensic Research Workshop (DFRWS). Section 6, "Presentation," discusses the need for forensic reports to present a "complete and accurate accounting of the actions taken and conclusions drawn." This foundational academic report establishes the principle of comprehensive documentation. (Available through DFRWS archives and cited in numerous academic curricula).

The statement is false. System software password cracking is the specific process of recovering passwords for system-level software, such as operating system accounts, BIOS/UEFI, or other system utilities. The provided definition incorrectly equates this specific technique with the general act of "cracking the operating system." Compromising an operating system is a broad outcome that can be achieved through various methods, including exploiting software vulnerabilities or social engineering, not just by cracking passwords. The definition presented is a categorical error, confusing a specific method with a general goal.

A. True: This option is incorrect because the statement provides an imprecise and overly broad definition, conflating a specific technique (password cracking) with a general outcome (compromising the system).

1. Al-Sultan, S., Al-Shehri, S., & Al-Harbi, S. (2021). A Comprehensive Survey on Password Cracking: Taxonomy, Tools, and Future Directions. IEEE Access, 9, 34318-34343. In Section I (Introduction), the paper defines password cracking as "the process of recovering passwords from their stored or transmitted forms," highlighting it as a specific process, not the general act of compromising a system. (DOI: https://doi.org/10.1109/ACCESS.2021.3060098)

2. Anderson, R. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems (2nd ed.). Wiley. In Chapter 3.2, "Passwords" (p. 49), password cracking is described as an attack to guess passwords, typically by obtaining a copy of the password file and running guessing algorithms against it. This defines it as a specific attack on authentication credentials, not on the system as a whole.

3. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 5, "Authentication," details password cracking as a method to attack a password-based authentication mechanism, distinguishing it from other types of attacks on a system, such as exploiting software flaws.

The fundamental principle of digital forensics is the preservation of original evidence. All forensic analysis must be conducted on a forensically sound copy (a bit-stream image) of the original data, not on the original evidence itself. This practice prevents any alteration, corruption, or contamination of the source evidence, which could compromise its integrity and render it inadmissible in legal proceedings. The process involves creating a bit-for-bit duplicate of the original media and verifying its authenticity with cryptographic hashes (e.g., SHA-256). Working on a copy ensures that the original evidence remains in its pristine, unaltered state.

A. True: This is incorrect because directly analyzing original evidence violates the core forensic principle of evidence preservation. Any interaction, even viewing files, can alter metadata and compromise the integrity of the evidence.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.

Section 3.2, Collection, Page 14: "Create an exact copy of the original media before performing analysis. The analysis should be performed on the copy." This document explicitly states that analysis is to be done on a copy, not the original.

2. Carrier, B. D. (2003). A hypothesis-based approach to digital forensic investigations. (Doctoral dissertation, Purdue University).

Section 3.2.1, Preservation, Page 31: "The preservation phase is where data from the crime scene is saved. This is typically done by making a bit-by-bit copy of the original media... The original media is then stored in a secure location and the investigation continues with the copy." This academic source reinforces the standard procedure of copying evidence for analysis to preserve the original.

3. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press.

Chapter 7, Digital Evidence Acquisition, Page 239: "A fundamental rule in digital forensics is to make a copy of the original evidence and to perform the examination and analysis on the copy. This is to avoid altering the original evidence and to be able to produce the original evidence in its pristine state in court." This foundational text highlights the rule as essential for legal admissibility.