1.
A subset of business continuity planning and testing is disaster recovery, also known as IT recovery planning.
Correct Answer
B. False
Explanation
The statement is false because disaster recovery, also known as IT recovery planning, is not a subset of business continuity planning and testing. Instead, it is a separate process that focuses specifically on the recovery of IT systems and infrastructure in the event of a disaster or disruption. Business continuity planning, on the other hand, encompasses a broader range of activities and strategies that aim to ensure the overall resilience and continuity of an organization's operations in the face of various threats and risks.
2.
System availability is often expressed as a percentage of uptime in a year.
Correct Answer
A. True
Explanation
System availability is commonly measured by the percentage of time that a system is operational or "up" in a given year. This measure is often expressed as a percentage, indicating the amount of time the system is available compared to the total time in a year. Therefore, the statement that system availability is often expressed as a percentage of uptime in a year is true.
3.
Duplicate image backups are considered a primary key to uncovering evidence because they create exact replicas of the crime scene.
Correct Answer
B. False
Explanation
Duplicate image backups are not considered a primary key to uncovering evidence because they create exact replicas of the crime scene. Instead, duplicate image backups are considered as secondary or tertiary sources of evidence that can be used for verification or comparison purposes. Primary keys to uncovering evidence typically include original physical evidence, eyewitness testimony, and digital forensic analysis.
4.
RAM slack can contain any information that has been created, viewed, modified, downloaded, or copied since the computer was last booted.
Correct Answer
A. True
Explanation
RAM slack refers to the unused space within a computer's random access memory (RAM). This space can contain fragments of data that have been created, viewed, modified, downloaded, or copied since the computer was last booted. Therefore, the given statement is true as RAM slack can indeed contain any information that has been processed by the computer.
5.
Most metadata about a file is generated and recorded automatically without the user’s knowledge.
Correct Answer
A. True
Explanation
Metadata is information about a file that provides details such as the file's size, type, creation date, and author. In most cases, this metadata is generated and recorded automatically by the system without the user's active involvement or knowledge. This allows for easier organization and retrieval of files and helps in maintaining the integrity of the file system. Therefore, the statement that most metadata about a file is generated and recorded automatically without the user's knowledge is true.
6.
Is designed to ensure that an organization can continue to function in the event of a natural or man-made disaster.
Correct Answer
A. Business continuity planning and testing
Explanation
Business continuity planning and testing is the correct answer because it refers to the process of creating a strategy and procedures to ensure that an organization can continue operating in the face of potential disruptions caused by natural or man-made disasters. This involves identifying potential risks, developing plans to mitigate them, and regularly testing those plans to ensure they are effective. This ensures that the organization is prepared and can quickly recover and resume normal operations in the event of a disaster.
7.
A ____ typically begins by identifying threats through a risk assessment.
Correct Answer
D. BIA
Explanation
A BIA (Business Impact Analysis) typically begins by identifying threats through a risk assessment. A BIA is a process that assesses the potential impact of disruptions to the normal operations of a business. It helps identify and prioritize critical business functions, assess the potential risks and vulnerabilities, and develop strategies to mitigate those risks. By conducting a risk assessment, the BIA can identify potential threats that could impact the business and inform the development of a comprehensive business continuity plan.
8.
Plans typically include procedures to address redundancy and fault tolerance as well as data backups.
Correct Answer
B. Disaster recovery
Explanation
The given statement suggests that plans typically include procedures for redundancy, fault tolerance, and data backups. This aligns with the concept of disaster recovery, which involves preparing for and responding to potential disasters or disruptions that could impact the organization's IT infrastructure and data. Disaster recovery plans aim to minimize downtime, restore critical systems, and ensure business continuity in the event of a disaster or emergency situation. Therefore, the correct answer is disaster recovery.
9.
A ____ is a component or entity in a system which, if it no longer functions, will disable the entire system.
Correct Answer
C. Single point of failure
Explanation
A single point of failure refers to a component or entity in a system that, if it stops functioning, will cause the entire system to fail. This means that the system is highly dependent on this particular element, and if it fails, there are no redundant or backup mechanisms to keep the system operational. Therefore, the failure of this single point can have severe consequences and may result in a complete system shutdown until the issue is resolved.
10.
A ____ is a service contract between a vendor and a client that specifies what services will be provided, the responsibilities of each party, and any guarantees of service.
Correct Answer
A. Service level agreement
Explanation
A service level agreement (SLA) is a service contract between a vendor and a client that outlines the specific services that will be provided, the responsibilities of both parties, and any guarantees of service. It is a formal agreement that helps to define the expectations and standards for the delivery of services. SLAs are commonly used in various industries, including IT, telecommunications, and outsourcing, to ensure that both parties are aware of their obligations and to establish a framework for measuring and monitoring service performance.
11.
In a(n) ____ cluster, a standby server exists only to take over for another server in the event of its failure.
Correct Answer
D. Asymmetric server
Explanation
In an asymmetric server cluster, a standby server is present solely to replace another server in case it fails. This means that the standby server does not actively participate in processing or sharing the workload with the primary server, but rather remains idle until it is needed. This setup ensures high availability and fault tolerance, as the standby server can quickly take over the workload without any interruption in service.
12.
In a(n) ____ cluster, every server in the cluster performs useful work.
Correct Answer
C. Symmetric server
Explanation
A symmetric server cluster refers to a cluster where every server in the cluster performs useful work. This means that each server in the cluster is capable of handling requests and executing tasks, ensuring that the workload is evenly distributed among all servers. In contrast, an asymmetric server cluster may have some servers that perform specific tasks while others handle different tasks or remain idle. Therefore, the correct answer is symmetric server.
13.
A(n) ____ is a device that maintains power to equipment in the event of an interruption in the primary electrical power source.
Correct Answer
A. Uninterruptible power supply
Explanation
An uninterruptible power supply is a device that provides continuous power to equipment even during a power outage. It acts as a backup power source, ensuring that the equipment remains operational and protected from any interruptions in the primary electrical power source. This device is commonly used in critical systems such as data centers, hospitals, and telecommunications networks to prevent data loss and maintain uninterrupted operation.
14.
A ____ has all of the equipment installed, but does not have active Internet or telecommunications facilities, and does not have current backups of data.
Correct Answer
D. Warm site
Explanation
A warm site is a type of disaster recovery site that has all the necessary equipment installed but does not have active internet or telecommunications facilities. It also does not have current backups of data. This means that in the event of a disaster or outage, the warm site can be quickly activated and brought online, but it may take some time to restore the data and establish connectivity.
15.
Is a form of eavesdropping in which special equipment is used to pick up telecommunication signals or data within a computer device by monitoring the electromagnetic fields.
Correct Answer
B. Van Eck pHreaking
Explanation
Van Eck phreaking is a form of eavesdropping that involves the use of special equipment to intercept telecommunication signals or data by monitoring the electromagnetic fields emitted by a computer device. This technique allows the attacker to gather sensitive information without physically accessing the device or network.
16.
A ____ is a metallic enclosure that prevents the entry or escape of an electromagnetic field.
Correct Answer
C. Faraday cage
Explanation
A Faraday cage is a metallic enclosure that prevents the entry or escape of an electromagnetic field. It is designed to block electromagnetic radiation and protect sensitive electronic equipment from external electromagnetic interference. It works by using conductive materials to create a shield that redirects the electromagnetic waves around the enclosed space, effectively isolating it from the outside world. This makes it an effective solution for applications where electromagnetic interference needs to be controlled or prevented, such as in laboratories, data centers, or military installations.
17.
Uses technology to search for computer evidence of a crime, can attempt to retrieve information—even if it has been altered or erased—that can be used in the pursuit of the attacker or criminal.
Correct Answer
A. Computer forensics
Explanation
Computer forensics is the correct answer because it involves using technology to search for computer evidence of a crime. It also includes the ability to retrieve information, even if it has been altered or erased, which can be used in the pursuit of the attacker or criminal. Penetration testing, vulnerability testing, and risk management are not directly related to searching for computer evidence or retrieving information.
18.
According to the Federal Bureau of Investigation (FBI), almost ____ percent of crimes committed today leave behind digital evidence that can be retrieved through computer forensics.
Correct Answer
C. 85
Explanation
According to the Federal Bureau of Investigation (FBI), a significant percentage of crimes committed today leave behind digital evidence that can be retrieved through computer forensics. This means that in 85% of cases, there is some form of digital evidence that can be used to investigate and solve crimes.
19.
The ____ response team serves as first responders whenever digital evidence needs to be preserved.
Correct Answer
B. Computer forensics
Explanation
Computer forensics is the correct answer because they are the experts who specialize in investigating and preserving digital evidence. They are trained to handle incidents involving cybercrime, data breaches, and other digital threats. As first responders, they play a crucial role in collecting and analyzing digital evidence, ensuring its integrity for further investigation or legal proceedings. Their expertise is essential in identifying and mitigating risks, as well as responding to emergencies related to digital evidence preservation.
20.
data is the most difficult type of data to capture.
Correct Answer
A. Volatile
Explanation
Volatile data refers to data that is temporary and can change frequently. It is difficult to capture because it can be easily lost or overwritten. Unlike static data, which remains constant, volatile data requires immediate capture or it may be lost. Non-volatile data, on the other hand, is persistent and retains its value even after power loss or system restart. Therefore, the correct answer is volatile.
21.
A ____ is a snapshot of the current state of the computer that contains all current settings and data.
Correct Answer
C. System image
Explanation
A system image is a snapshot of the current state of the computer that contains all current settings and data. This image is a complete copy of the entire system, including the operating system, installed software, and user data. It can be used to restore the computer to its previous state in case of system failure or to transfer the system to a new computer.
22.
A(n) ____ backup is an evidence-grade backup because its accuracy meets evidence standards.
Correct Answer
B. Mirror image
Explanation
A mirror image backup is considered an evidence-grade backup because it accurately replicates the entire content and structure of the original data source. This type of backup is often used in forensic investigations or legal proceedings, where the integrity and accuracy of the data are crucial. It ensures that the backup is an exact replica of the original, meeting the evidence standards required for legal purposes.
23.
The ____ documents that the evidence was under strict control at all times and no unauthorized person was given the opportunity to corrupt the evidence.
Correct Answer
D. Chain of custody
Explanation
The term "chain of custody" refers to the chronological documentation of the handling, control, and transfer of evidence in a legal case. It ensures that the evidence is properly preserved and prevents any tampering or corruption. This process involves maintaining a detailed record of each person who had custody of the evidence, including when and how it was transferred. The chain of custody is crucial in establishing the integrity and admissibility of evidence in court.
24.
Multiple sectors are used to make up a ____.
Correct Answer
A. Cluster
Explanation
In the context of the question, multiple sectors are used to make up a cluster. A cluster refers to a group of sectors on a storage device, such as a hard drive. These sectors are grouped together to store and retrieve data efficiently. Therefore, the correct answer is "cluster".
25.
Pertains only to the last sector of a file.
Correct Answer
B. RAM slack
Explanation
RAM slack refers to the unused space in the last sector of a file that is stored in the computer's RAM. This slack space occurs because the file size may not be an exact multiple of the sector size, resulting in unused space in the last sector. Disk slack, ROM slack, and edge slack are not relevant in this context.
26.
____ could contain remnants of previously deleted files or data from the format pattern associated with disk storage space that has yet to be used by the computer.
Correct Answer
C. Drive file slack
Explanation
Drive file slack refers to the unused space between the end of a file and the end of the last cluster allocated to that file on a disk. This space can contain remnants of previously deleted files or data from the format pattern associated with disk storage space that has yet to be used by the computer. Therefore, drive file slack is the most suitable option to explain the given statement.