In confirming an alibi involving an obscure piece of equipment, if no documentation is available, the manufacturer is no longer in business, or the equipment/network is so complicated that nobody fully understands how it works, you should:

contact other investigators and average their opinions

state that the alibi is considered unproven

search the internet for any pertinent information

recreate the events surrounding the alibi

contact other investigators and average their opinions

To demonstrate that someone is lying about an alibi, it is necessary to:

require the suspect to submit to a polygraph

find evidence that clearly demonstrates the lie

require the suspect to submit to a polygraph

interrogate the suspect using a number of methods

show that no evidence confirming the alibi is available

Types of digital evidence that might corroborate an alibi include:

evidence of computer usage when the offense was supposed to occurred

computer records from credit cards, the telephone company, or subway ticket usage

gps information from mobile devices indicating the userâ€™s location and time

It is quite difficult to fabricate an alibi on a network successfully because:

creating an alibi on a network could take months of work.

an offender may not have the proper access.

an offender would need system administrator access level to make the necessary changes.

an individual rarely has the ability to falsify digital evidence on all the computers that are involved.

creating an alibi on a network could take months of work.

The crime scene preservation process includes all but which of the following:

controlling access to the crime scene

protecting against unauthorized alterations

confirming system date and time

controlling access to the crime scene

The first step in applying the scientific method to a digital investigation is to:

form a conclusion based on the results of your findings

form a theory on what may have occurred

experiment or test the available evidence to confirm or refute your prediction

make one or more observations based on events that occurred

form a conclusion based on the results of your findings

Forensic analysis involves the following:

assessment, experimentation, fusion, correlation, and validation

recovery, harvesting, filtering, organization, and search

When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:

whether the evidence was properly secured in transit

whether chain of custody was maintained

whether there are indications that the actual digital evidence was tampered with

whether the evidence was properly secured in transit

whether the evidence media was compatible with forensic machines

The following specializations exist in digital investigations:

first responder (a.k.a. digital crime scene technician)

Computers can play the following roles in a crime:

evidence, instrumentality, contraband, or fruit of crime

symbol, instrumentality, and source of evidence

A digital Signature is

an encrypted signature of sender

a bit string giving identity of a correspondent

a unique identification of a sender

an authentication of an electronic record by trying it uniquely to a key only a sender knows

an encrypted signature of sender

Cybertrails are advantageous because:

they are not connected to the physical world.

nobody can be harmed by crime on the internet.

offenders who are unaware of them leave behind more clues than they otherwise would have.

What are the three general categories of computer systems that can contain digital evidence?

personal computer, internet, mobile telephone

open computer systems, communication systems, embedded systems

A valid definition of digital evidence is:

any digital evidence on a computer

data stored or transmitted using a computer

digital data of probative value

any digital evidence on a computer

How does machine learning benefit IDSes/IPSes?

by helping identify signatures more quickly

by lowering the volume of attacks analyzed

by adding heuristic anomaly detection capabilities

by searching for similar patterns to known attacks

by helping identify signatures more quickly

The features of traditional IPSes are found in all of these modern systems, except:

unified threat management appliances

network behavior analysis systems

A false positive can be defined as:

an alert that indicates nefarious activity on a system that, upon further inspection, turns out to truly be nefarious activity

an alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior

an alert that indicates nefarious activity on a system that, upon further inspection, turns out to truly be nefarious activity

the lack of an alert for nefarious activity

Which is true of a signature-based IDS?

it detects never-before-seen anomalies

it only identifies on known signatures

it detects never-before-seen anomalies

it works best in large enterprises.

Why would HTTP Tunneling be used?

http is a easy protocol to work with

firewall is a program that encrypts all programs that access the internet

firewalls are network based security measures that control the flow of incoming and outgoing traffic

firewall is a program that encrypts all programs that access the internet

a firewall is a program that keeps other programs from using the internet

firewall are the interrupts that automatically disconnect from the internet when a threat appears.

Which component is included in IP security?

encapsulating security payload (esp)

Why would a hacker use a proxy server?

to create a stronger connection with the target.

to create a ghost server on the network.

to obtain a remote access connection

to hide malicious activity on the network.

379 + Mcqs in Information Cyber Security in Computer Science Engineering (CSE) Page 3 McqOptions

101.	Absence of evidence refutes an alibi.
A.	true
B.	false
Answer» C.

Discussion

102.	In confirming an alibi involving an obscure piece of equipment, if no documentation is available, the manufacturer is no longer in business, or the equipment/network is so complicated that nobody fully understands how it works, you should:
A.	state that the alibi is considered unproven
B.	search the internet for any pertinent information
C.	recreate the events surrounding the alibi
D.	contact other investigators and average their opinions
Answer» D. contact other investigators and average their opinions

Discussion

103.	To demonstrate that someone is lying about an alibi, it is necessary to:
A.	find evidence that clearly demonstrates the lie
B.	require the suspect to submit to a polygraph
C.	interrogate the suspect using a number of methods
D.	show that no evidence confirming the alibi is available
Answer» B. require the suspect to submit to a polygraph

Discussion

104.	Types of digital evidence that might corroborate an alibi include:
A.	evidence of computer usage when the offense was supposed to occurred
B.	computer records from credit cards, the telephone company, or subway ticket usage
C.	gps information from mobile devices indicating the userâ€™s location and time
D.	all of the above
Answer» E.

Discussion

105.	It is quite difficult to fabricate an alibi on a network successfully because:
A.	an offender may not have the proper access.
B.	an offender would need system administrator access level to make the necessary changes.
C.	an individual rarely has the ability to falsify digital evidence on all the computers that are involved.
D.	creating an alibi on a network could take months of work.
Answer» D. creating an alibi on a network could take months of work.

Discussion

106.	Investigators should not rely on one piece of digital evidence when examining an alibi â€“ they should look for an associated _______.
A.	cybertrail
B.	piece of physical evidence
C.	statement
D.	none of the above
Answer» B. piece of physical evidence

Discussion

107.	Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?
A.	functional
B.	intentional
C.	relational
D.	temporal
Answer» E.

Discussion

108.	The type of report that is a preliminary summary of findings is known as:
A.	sitrep
B.	threshold assessment report
C.	full investigative report
D.	field notes
Answer» C. full investigative report

Discussion

109.	In crimes against individuals the ______ period leading up to the crime often contains the most important clues regarding the relationship between the offender and the victim.
A.	24-hour
B.	28-hour
C.	60-minute
D.	15-minute
Answer» B. 28-hour

Discussion

110.	Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?
A.	functional
B.	intentional
C.	relational
D.	temporal
Answer» C. relational

Discussion

111.	A ___________ is an extension of an enterpriseâ€™s private intranet across a public network such as the internet, creating a secure private connection.
A.	vnp
B.	vpn
C.	vsn
D.	vspn
Answer» C. vsn

Discussion

112.	The crime scene preservation process includes all but which of the following:
A.	protecting against unauthorized alterations
B.	acquiring digital evidence
C.	confirming system date and time
D.	controlling access to the crime scene
Answer» D. controlling access to the crime scene

Discussion

113.	The process model whose goal is to completely describe the flow of information in a digital investigation is known as:
A.	the physical model
B.	the staircase model
C.	the evidence flow model
D.	the subphase model
Answer» D. the subphase model

Discussion

114.	The first step in applying the scientific method to a digital investigation is to:
A.	form a theory on what may have occurred
B.	experiment or test the available evidence to confirm or refute your prediction
C.	make one or more observations based on events that occurred
D.	form a conclusion based on the results of your findings
Answer» D. form a conclusion based on the results of your findings

Discussion

115.	Forensic analysis involves the following:
A.	assessment, experimentation, fusion, correlation, and validation
B.	seizure and preservation
C.	recovery, harvesting, filtering, organization, and search
D.	all of the above
Answer» B. seizure and preservation

Discussion

116.	An investigation can be hindered by the following:
A.	preconceived theories
B.	improperly handled evidence
C.	offender concealment behavior
D.	all of the above
Answer» E.

Discussion

117.	The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:
A.	best evidence rule
B.	due diligence
C.	quid pro quo
D.	voir dire
Answer» B. due diligence

Discussion

118.	When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:
A.	whether chain of custody was maintained
B.	whether there are indications that the actual digital evidence was tampered with
C.	whether the evidence was properly secured in transit
D.	whether the evidence media was compatible with forensic machines
Answer» C. whether the evidence was properly secured in transit

Discussion

119.	The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:
A.	chain of custody
B.	field notes
C.	interim report
D.	none of the above
Answer» B. field notes

Discussion

120.	The following specializations exist in digital investigations:
A.	first responder (a.k.a. digital crime scene technician)
B.	forensic examiner
C.	digital investigator
D.	all of the above
Answer» E.

Discussion

121.	Computers can play the following roles in a crime:
A.	target, object, and subject
B.	evidence, instrumentality, contraband, or fruit of crime
C.	object, evidence, and tool
D.	symbol, instrumentality, and source of evidence
Answer» C. object, evidence, and tool

Discussion

122.	A digital Signature is
A.	a bit string giving identity of a correspondent
B.	a unique identification of a sender
C.	an authentication of an electronic record by trying it uniquely to a key only a sender knows
D.	an encrypted signature of sender
Answer» D. an encrypted signature of sender

Discussion

123.	Personal computers and networks are often a valuable source of evidence. Those involved with _______ should be comfortable with this technology.
A.	criminal investigation
B.	prosecution
C.	defense work
D.	all of the above
Answer» E.

Discussion

124.	Cybertrails are advantageous because:
A.	they are not connected to the physical world.
B.	nobody can be harmed by crime on the internet.
C.	they are easy to follow.
D.	offenders who are unaware of them leave behind more clues than they otherwise would have.
Answer» E.

Discussion

125.	In terms of digital evidence, the Internet is an example of:
A.	open computer systems
B.	communication systems
C.	embedded computer systems
D.	none of the above
Answer» C. embedded computer systems

Discussion

126.	What are the three general categories of computer systems that can contain digital evidence?
A.	desktop, laptop, server
B.	personal computer, internet, mobile telephone
C.	hardware, software, networks
D.	open computer systems, communication systems, embedded systems
Answer» E.

Discussion

127.	A valid definition of digital evidence is:
A.	none of the below
B.	data stored or transmitted using a computer
C.	digital data of probative value
D.	any digital evidence on a computer
Answer» D. any digital evidence on a computer

Discussion

128.	How does machine learning benefit IDSes/IPSes?
A.	by lowering the volume of attacks analyzed
B.	by adding heuristic anomaly detection capabilities
C.	by searching for similar patterns to known attacks
D.	by helping identify signatures more quickly
Answer» D. by helping identify signatures more quickly

Discussion

129.	The features of traditional IPSes are found in all of these modern systems, except:
A.	next-generation firewalls
B.	antimalware
C.	unified threat management appliances
D.	network behavior analysis systems
Answer» C. unified threat management appliances

Discussion

130.	A false positive can be defined as:
A.	an alert that indicates nefarious activity on a system that, upon further inspection, turns out to represent legitimate network traffic or behavior
B.	an alert that indicates nefarious activity on a system that, upon further inspection, turns out to truly be nefarious activity
C.	the lack of an alert for nefarious activity
D.	all of the above
Answer» B. an alert that indicates nefarious activity on a system that, upon further inspection, turns out to truly be nefarious activity

Discussion

131.	Which is true of a signature-based IDS?
A.	it cannot work with an ips
B.	it only identifies on known signatures
C.	it detects never-before-seen anomalies
D.	it works best in large enterprises.
Answer» C. it detects never-before-seen anomalies

Discussion

132.	What port does Telnet use?
A.	22
B.	80
C.	20
D.	23
Answer» E.

Discussion

133.	A full domain name is sequence of lables seperated by____
A.	semicolons
B.	dots
C.	colons
D.	none
Answer» C. colons

Discussion

134.	The root of DNS tree is____
A.	a string of characters
B.	a string of 63 characters
C.	an empty string
D.	none
Answer» D. none

Discussion

135.	In the DNS the names are defined in _____ sturucture
A.	a linear list
B.	an invertred tree
C.	a graph
D.	none
Answer» C. a graph

Discussion

136.	DNS can use services of________using the well known port 53
A.	udp
B.	tcp
C.	either (a) or (b)
D.	none of the above
Answer» D. none of the above

Discussion

137.	The _____domains define registered hosts according to their generic behaviour.
A.	generic
B.	country
C.	inverse
D.	none
Answer» B. country

Discussion

138.	The domain name space (tree) is devided into---------different sections
A.	3
B.	2
C.	4
D.	none
Answer» B. 2

Discussion

139.	Why would HTTP Tunneling be used?
A.	to identify proxy servers
B.	web activity is not scanned
C.	to bypass a firewall
D.	http is a easy protocol to work with
Answer» D. http is a easy protocol to work with

Discussion

140.	What is the most important activity in system hacking?
A.	information gathering
B.	cracking passwords
C.	escalating privileges
D.	covering tracks
Answer» C. escalating privileges

Discussion

141.	SSL stands for?
A.	secured socket layer
B.	secured shell layer
C.	system socket layer
D.	system secured layer
Answer» B. secured shell layer

Discussion

142.	What is Firewall?
A.	firewalls are network based security measures that control the flow of incoming and outgoing traffic
B.	firewall is a program that encrypts all programs that access the internet
C.	a firewall is a program that keeps other programs from using the internet
D.	firewall are the interrupts that automatically disconnect from the internet when a threat appears.
Answer» B. firewall is a program that encrypts all programs that access the internet

Discussion

143.	An HTTP connection uses port _________ whereas HTTPS uses port ____________ and invokes SSL
A.	40; 80
B.	60; 620
C.	80; 443
D.	620; 80
Answer» D. 620; 80

Discussion

144.	Which component is included in IP security?
A.	authentication header (ah)
B.	encapsulating security payload (esp)
C.	internet key exchange (ike)
D.	all of the mentioned
Answer» E.

Discussion

145.	IPSec is designed to provide security at the _________
A.	transport layer
B.	network layer
C.	application layer
D.	session layer
Answer» C. application layer

Discussion

146.	Why would a hacker use a proxy server?
A.	to create a stronger connection with the target.
B.	to create a ghost server on the network.
C.	to obtain a remote access connection
D.	to hide malicious activity on the network.
Answer» E.

Discussion

147.	Imagine a social networking web app (like Twitter) that allows users to post short blurbs of text.
A.	cross-site scripting
B.	sql injection
C.	packet sniffing
D.	a and b
Answer» E.

Discussion

148.	Section 79 of the Indian IT Act declares that any 3rd party information or personal data leakage in corporate firms or organizations will be a punishable offense.
A.	true
B.	false
Answer» B. false

Discussion

149.	Using spy cameras in malls and shops to capture private parts of any person comes under section 67 of IT Act, 2008 and is punished with a fine of Rs. 5 Lacs.
A.	true
B.	false
Answer» B. false

Discussion

150.	Stealing of digital files comes under __________ of the Indian IT Act.
A.	section 66-a
B.	section 66-b
C.	section 66-c
D.	section 66-d
Answer» D. section 66-d

Discussion

Explore topic-wise MCQs in Computer Science Engineering (CSE).

Absence of evidence refutes an alibi.

In confirming an alibi involving an obscure piece of equipment, if no documentation is available, the manufacturer is no longer in business, or the equipment/network is so complicated that nobody fully understands how it works, you should:

To demonstrate that someone is lying about an alibi, it is necessary to:

Types of digital evidence that might corroborate an alibi include:

It is quite difficult to fabricate an alibi on a network successfully because:

Investigators should not rely on one piece of digital evidence when examining an alibi â€“ they should look for an associated _______.

Creating a histogram of times to reveal periods of high activity is an example of which form of investigative reconstruction?

The type of report that is a preliminary summary of findings is known as:

In crimes against individuals the ______ period leading up to the crime often contains the most important clues regarding the relationship between the offender and the victim.

Investigative reconstruction is composed of three different forms. Which of the following is NOT one of those three forms?

A ___________ is an extension of an enterpriseâ€™s private intranet across a public network such as the internet, creating a secure private connection.

The crime scene preservation process includes all but which of the following:

The process model whose goal is to completely describe the flow of information in a digital investigation is known as:

The first step in applying the scientific method to a digital investigation is to:

Forensic analysis involves the following:

An investigation can be hindered by the following:

The fact that with modern technology, a photocopy of a document has become acceptable in place of the original is known as:

When assessing the reliability of digital evidence, the investigator is concerned with whether the computer that generated the evidence was functioning normally, and:

The process of documenting the seizure of digital evidence and, in particular, when that evidence changes hands, is known as:

The following specializations exist in digital investigations:

Computers can play the following roles in a crime:

A digital Signature is

Personal computers and networks are often a valuable source of evidence. Those involved with _______ should be comfortable with this technology.

Cybertrails are advantageous because:

In terms of digital evidence, the Internet is an example of:

What are the three general categories of computer systems that can contain digital evidence?

A valid definition of digital evidence is:

How does machine learning benefit IDSes/IPSes?

The features of traditional IPSes are found in all of these modern systems, except:

A false positive can be defined as:

Which is true of a signature-based IDS?

What port does Telnet use?

A full domain name is sequence of lables seperated by____

The root of DNS tree is____

In the DNS the names are defined in _____ sturucture

DNS can use services of________using the well known port 53

The _____domains define registered hosts according to their generic behaviour.

The domain name space (tree) is devided into---------different sections

Why would HTTP Tunneling be used?

What is the most important activity in system hacking?

SSL stands for?

What is Firewall?

An HTTP connection uses port _________ whereas HTTPS uses port ____________ and invokes SSL

Which component is included in IP security?

IPSec is designed to provide security at the _________

Why would a hacker use a proxy server?

Imagine a social networking web app (like Twitter) that allows users to post short blurbs of text.

Section 79 of the Indian IT Act declares that any 3rd party information or personal data leakage in corporate firms or organizations will be a punishable offense.

Using spy cameras in malls and shops to capture private parts of any person comes under section 67 of IT Act, 2008 and is punished with a fine of Rs. 5 Lacs.

Stealing of digital files comes under __________ of the Indian IT Act.

An HTTP connection uses port _ whereas HTTPS uses port ____ and invokes SSL