312-49V10 Practice Questions

A drive-by download is an attack where malicious code is downloaded and executed on a user's computer without their consent or knowledge. This occurs simply by visiting a compromised or malicious website. The attack vector relies on exploiting vulnerabilities in the web browser, associated plugins (like Flash or Java), or the underlying operating system. The user's only action is navigating to a URL; no further interaction, such as clicking a link or authorizing a download, is required. This method directly matches the scenario described in the question.

A. Malvertising: This is a method of delivering malware via malicious online advertisements. While it can be a vehicle for a drive-by download, it is the delivery mechanism, not the attack itself.

B. Internet relay chats: This is a communication protocol (IRC). While malware can be distributed through IRC links or files, IRC itself is not the attack described.

D. Phishing: This is a social engineering attack that deceives users into voluntarily providing information or clicking a malicious link. It requires active user participation, unlike a drive-by download.

1. Cova, M., Kruegel, C., & Vigna, G. (2010). Detection and analysis of drive-by-download attacks and malicious JavaScript code. In Proceedings of the 19th international conference on World wide web (pp. 281–290). ACM. The paper defines drive-by-download attacks as those that "install malware on a victim's machine when the victim simply visits a malicious web page." (Section 1, Paragraph 1). https://doi.org/10.1145/1772690.1772720

2. Provos, N., McNamee, D., Mavrommatis, P., Wang, K., & Modadugu, N. (2008). The ghost in the browser: Analysis of web-based malware. In Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets (HotBots'07). USENIX Association. This foundational paper describes the mechanics of drive-by downloads, stating they "exploit vulnerabilities in a web browser or its plugins to install malicious code on a client's computer." (Section 2, "Drive-by-downloads").

3. Google Transparency Report. (n.d.). How Safe Browsing works. Google. The documentation describes how Google Safe Browsing protects users from "unwanted software," which includes "drive-by-downloads that happen without the user’s knowledge." (Section: "What is malware and unwanted software?").

4. Le, H. V., Al-Shaer, E., & Tian, D. (2014). No-SE: A Framework for Preventing Drive-by-Downloads from Benign-but-Vulnerable Websites. In Proceedings of the Network and Distributed System Security Symposium (NDSS) 2014. The Internet Society. The introduction states, "In a drive-by-download attack, a victim gets infected with malware simply by browsing a malicious website with a vulnerable browser." (Section 1, Paragraph 1).

Active@ Password Changer is a specialized software utility designed specifically for resetting lost or forgotten passwords for local user accounts on Windows systems, including the administrator account. It operates by creating a bootable USB drive or CD/DVD that allows the user to start the system in a pre-boot environment. From there, it can directly access and modify the Security Account Manager (SAM) database file, where password hashes are stored, to clear an existing password or set a new one without needing to know the original.

A. Advanced Office Password Recovery: This tool is designed by ElcomSoft to recover passwords for Microsoft Office documents (e.g., Word, Excel, PowerPoint), not for resetting Windows operating system account passwords.

C. Smartkey Password Recovery Bundle Standard: This is a commercial suite of various password recovery tools. While it may include a Windows password reset utility, Active@ Password Changer is a more specific and widely recognized tool for this singular purpose.

D. Passware Kit Forensic: This is a comprehensive digital forensics suite that can perform password recovery and decryption for hundreds of file types, full-disk encryption, and mobile devices. While it includes a Windows password reset feature, its primary scope is much broader, making Active@ Password Changer the more direct answer for the specific task described.

1. LSoft Technologies Inc. (Official Vendor Documentation): "Active@ Password Changer is designed for resetting local administrator and user passwords on Windows operating systems in case a password is forgotten or lost. You do not need to re-install and re-configure the operating system to log in." - Source: Active@ Password Changer official product page, LSoft Technologies Inc.

2. Passware, Inc. (Official Vendor Documentation): "Passware Kit Forensic includes a bootable USB maker to reset passwords for any Windows account, including local administrators and Domain Admins." - Source: Passware Kit Forensic product features list, Passware, Inc. (This confirms the tool's capability but highlights its nature as a comprehensive forensic kit rather than a dedicated reset tool).

3. ElcomSoft Co. Ltd. (Official Vendor Documentation): "Advanced Office Password Recovery recovers passwords protecting documents created with all versions of Microsoft Office from 2.0 to 2021..." - Source: Advanced Office Password Recovery official product page, ElcomSoft Co. Ltd. (This confirms it is not for OS password reset).

4. University Courseware: In computer forensics and system administration courses, tools are often categorized by their primary function. A dedicated password reset utility like Active@ Password Changer is typically distinguished from a full forensic suite like Passware Kit. For example, a lab exercise on "Local System Access" would feature tools specifically for that task. - Source: Based on typical curriculum structure in cybersecurity programs, e.g., as seen in course outlines from institutions like the SANS Institute or university computer science departments.

The core issue is the recovery of lost files from a local Windows hard drive after a system crash. Recuva is a specialized data recovery tool designed specifically for this purpose. It scans storage media (like hard drives) for files that have been deleted or lost due to corruption, formatting, or system crashes and attempts to restore them. It is the only tool listed that directly addresses the user's need for file system data recovery.

A. Colasoft’s Capsa: This is a network protocol analyzer (packet sniffer) used for monitoring and analyzing network traffic, not for recovering files from a local hard drive.

C. Cain & Abel: This is a password recovery tool used for cracking various types of passwords and is not designed for general file recovery from a damaged file system.

D. Xplico: This is a Network Forensic Analysis Tool (NFAT) that extracts and reconstructs data from captured network traffic (e.g., PCAP files), not from a local disk.

1. Al-Azani, S., & Al-Sallami, F. (2017). A Forensic Analysis of Anti-Forensic and Data Hiding Techniques. International Journal of Computer Science and Network Security, 17(5), 195-204. (This paper categorizes Recuva as a "Data Recovery Tool" used in digital forensics for retrieving deleted files, Section 4, Table 2).

2. Garfinkel, S. L. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7, S64-S73. https://doi.org/10.1016/j.diin.2010.05.009 (This article discusses the landscape of digital forensic tools, implicitly distinguishing between file carving/recovery tools like Recuva and network analysis tools like Xplico).

3. Xplico Official Documentation. (n.d.). About Xplico. Retrieved from the official Xplico project website. (The official documentation describes Xplico as a "Network Forensic Analysis Tool (NFAT)" whose purpose is to "extract from an internet traffic capture the applications data contained.")

4. Colasoft. (n.d.). Capsa Network Analyzer. Retrieved from the official Colasoft product page. (The vendor documentation describes Capsa as a tool for "network monitoring, troubleshooting and analysis," confirming its function as a network analyzer).

The read/write head is the component at the tip of the actuator arm that performs the physical reading and writing of data. It is a tiny transducer that flies nanometers above the surface of the spinning platter. The head magnetizes small areas of the platter to write data and detects the existing magnetic orientation to read data. The actuator arm moves the head across the platter's radius to position it over the correct data track, but the head is the specific component that interacts with the platter's magnetic surface to handle information.

A. Actuator: The actuator is the entire mechanical arm assembly that moves the read/write head; the head is the specific component that performs the read/write function.

B. Spindle: The spindle is the motor and axle that spins the platters at a constant high speed. It does not read or write data.

C. Actuator Axis: This is the pivot point around which the actuator arm rotates. It facilitates movement but does not interact with the platter.

1. Arpaci-Dusseau, R. H., & Arpaci-Dusseau, A. C. (2018). Operating Systems: Three Easy Pieces. Arpaci-Dusseau Books. In Chapter 37, "Hard Disk Drives," Section 37.2, "The Interface," the text states, "To read or write, the head must be positioned on the desired track... This positioning is accomplished by the disk arm... At the end of the arm is the head itself, which can read or write the magnetic surface." (p. 2)

2. Patterson, D. A., & Hennessy, J. L. (2017). Computer Organization and Design RISC-V Edition: The Hardware Software Interface. Morgan Kaufmann. In Chapter 5, "Large and Fast: Exploiting Memory Hierarchy," Section 5.4, "Dependability, Reliability, and Availability," a diagram of a disk drive clearly labels the "Read/write head" at the end of the arm, positioned over the platter. (p. 418, Figure 5.4.3).

3. Tanenbaum, A. S., & Austin, T. (2013). Structured Computer Organization (6th ed.). Pearson. In Chapter 2, "Computer Systems Organization," Section 2.4.3, "Disks," it is explained: "The information is read and written by a movable arm, which has a read/write head on the end of it... The arm can move in and out to position the head over any of the tracks." (p. 101).

The File Allocation Table 12 (FAT12) is the file system standardly used for floppy disks. It was designed by Microsoft specifically for low-capacity media. Its 12-bit entries for addressing clusters are efficient and sufficient for the small storage size of a typical 1.44 MB floppy disk, which has a cluster count well below the FAT12 limit (fewer than 4085 clusters). The minimal overhead of FAT12 makes it the only practical choice among the options for this type of legacy media.

A. NTFS: This is a modern, journaling file system with significant metadata overhead, making it completely unsuitable for the very small capacity of a floppy disk.

B. FAT32: Designed for larger volumes (typically >512 MB), its minimum partition size and structural overhead are far too large to be used on a floppy disk.

C. FAT16: While older than FAT32, it was designed for hard disks with capacities larger than what FAT12 could handle (up to 2 GB), making it inefficient for floppy disks.

---

1. Microsoft Corporation. (2000). Microsoft Extensible Firmware Initiative FAT32 File System Specification. Version 1.03. In Section 3.4, "Determining the FAT Type" (p. 13), the specification provides an algorithm based on the total count of clusters on the volume. A volume with fewer than 4085 clusters is defined as a FAT12 volume. A standard 1.44 MB floppy disk has 2880 clusters, placing it firmly in the FAT12 category.

2. Tanenbaum, A. S., & Bos, H. (2015). Modern Operating Systems (4th ed.). Pearson. In Chapter 4, Section 4.3.3, "MS-DOS file system," the text explicitly states, "The original MS-DOS file system used 12-bit table entries... This system, now called FAT-12, is still used on floppy disks."

3. Arpaci-Dusseau, R. H., & Arpaci-Dusseau, A. C. (2018). Operating Systems: Three Easy Pieces. Arpaci-Dusseau Books. In Chapter 40, "File System Implementation," the discussion on the File Allocation Table (FAT) describes FAT12 as the earliest version, suitable for very small storage devices like floppy disks, before the need for FAT16 and FAT32 arose for larger hard drives.

In computer science and digital forensics, an offset is an address that represents a specific location within a file or memory, typically measured from a starting point. These offsets are almost universally represented using hexadecimal numbering for convenience. In many programming languages (like C/C++), command-line tools, and debuggers, the prefix "0x" is the standard notation to explicitly identify a number as hexadecimal. While the offset is technically the numerical value that follows the prefix, the "0x" is the standard indicator for the hexadecimal code used to represent that offset. Among the choices, this is the only option related to the notation of the offset value itself.

A. The last byte after the colon is a data value located at a specific position, not the position (offset) itself.

C. The "0x" notation is a prefix; it is not used as a suffix for hexadecimal numbers in standard conventions.

D. The first byte after the colon represents the start of the data at that offset, not the offset address.

1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional.

In Chapter 8, "Data Structures," the concept of offsets is used extensively to describe locations within file systems. For example, on page 193, when describing the FAT file system, it states, "The first entry is for the boot sector, which starts at offset 0." This establishes the definition of an offset as a location starting from 0.

2. ISO/IEC 9899:2011 - Programming languages — C (C11 Standard).

Section 6.4.4.1 "Integer constants" specifies the syntax for integer literals. It states: "A hexadecimal constant consists of the prefix 0x or 0X followed by a sequence of hexadecimal digits." This document officially sanctions "0x" as the prefix for hexadecimal notation.

3. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press.

Throughout the book, memory addresses and file offsets are shown using the 0x prefix. For instance, on page 31, a sample OllyDbg CPU window shows memory addresses in the first column, such as 00401000, and instructions referencing addresses like 00401005. In many debuggers and contexts discussed, these would be written as 0x401000 and 0x401005, linking the concept of an offset/address with its common hexadecimal 0x notation.

The Pre-investigation Phase encompasses all preparatory and foundational activities conducted before a specific digital investigation is initiated. This phase focuses on building the capability to perform forensic work effectively. Key activities include setting up a dedicated forensics laboratory, which involves strategic planning, securing a budget, acquiring necessary hardware and software tools, and establishing policies and procedures. These steps are prerequisites for conducting any sound forensic examination and must be completed before the active investigation phase begins.

A. Post-investigation Phase: This phase occurs after the analysis is complete and involves activities such as returning evidence, archiving the case, and generating final reports, not initial lab setup.

B. Reporting Phase: This is a distinct part of the overall process, focused on documenting and communicating the findings of the investigation, not on planning or budgeting for infrastructure.

D. Investigation Phase: This is the active phase where evidence is acquired, preserved, and analyzed. The forensics lab and its resources must already be established to execute this phase.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.

Section 2.3.1, Preparation, states: "Organizations should have the appropriate policies, procedures, equipment, and tools in place before an incident occurs... This includes having a forensic workstation with a variety of tools available." This highlights that preparing the lab environment and tools is a pre-incident/pre-investigation activity.

2. Nelson, B., Phillips, A., & Steuart, C. (2015). Guide to Computer Forensics and Investigations (5th ed.). Cengage Learning.

Chapter 2, "The Investigator’s Office and Laboratory," is dedicated entirely to the setup, planning, and budgeting of a computer forensics lab. The placement of this chapter before chapters on data acquisition and analysis confirms that lab setup is a pre-investigation requirement.

3. George Mason University. (2021). CFRS 660: Computer Forensics I Course Syllabus.

The course structure typically outlines the forensic process starting with "Forensic Readiness and Lab Preparation" as a foundational topic before moving into the "Investigation Process" itself, reinforcing that lab planning is a pre-investigation step.

The command includes the UDP-specific switch (e.g., nmap -sU -p 445 192.168.0.0/24 or nc -vz -u 192.168.0.0 445).

The “-sU” / “-u” flag forces a UDP probe to destination port 445 across the 192.168.0.0 network.

If a UDP response or ICMP “port-unreachable” is not returned, the port is considered “open” or “open|filtered.”

Therefore, the command’s goal is to verify whether UDP port 445 (Microsoft-DS/SMB) is open on hosts in the 192.168.0.0 subnet.

B. Uses TCP; the command’s UDP flag makes a TCP check impossible.

C. NETBIOS uses ports 137-139, not 445; the command targets port 445 only.

D. The scan tries to detect openness; proving “closed” is the opposite interpretation.

1. Nmap Network Scanning, Ch. 5.3 “UDP Scan (-sU)”, pp. 100-103 (Insecure.Com LLC, 2009).

2. Nmap man page, section “-sU” and “-p”, accessed via MIT 6.858 courseware mirror (https://ocw.mit.edu), slide set “Port Scanning”, slide 18.

3. Fyodor, “Remote OS Detection via Nmap”, IEEE Security & Privacy 3(5):52-55, 2005, DOI:10.1109/MSP.2005.124 – discusses UDP scans on port 445.

4. IANA Service Name and Transport Protocol Port Number Registry, “microsoft-ds 445/tcp, 445/udp”, updated 2023-06-29.

5. University of Michigan EECS589 “Network Security” lecture notes, Fall 2022, Lecture 4 “Active Reconnaissance”, pp. 6-7 – example: nmap -sU -p 445.

Attacker profiling involves analyzing evidence to understand the perpetrator's characteristics, such as skill level, resources, motivation, and potential identity. The code used in an attack is a direct artifact created by the attacker. Its logic, complexity, formatting, and any unique algorithms or errors act as a "fingerprint." Security analysts use these code-level characteristics (a practice related to stylometry) to differentiate between threat actors, link campaigns, and assess the sophistication of the adversary. This makes the analysis of the code itself the most crucial element for building a detailed and accurate profile of the attacker.

A. The manufacturer of the system compromised: This describes the target's environment, not the attacker's methods or characteristics. It provides little to no insight into the perpetrator's profile.

C. The nature of the attack: This is a high-level classification (e.g., ransomware, data exfiltration). While part of the incident's profile, it is less specific for profiling the attacker than the unique code they used to conduct it.

D. The vulnerability exploited in the incident: This identifies a weakness in the target system. While the choice of vulnerability can hint at an attacker's knowledge, many different actors can exploit the same known vulnerability.

1. Academic Publication: Rosenblum, N., Zhu, X., & Miller, B. P. (2011). "Who Wrote This Code? Identifying the Authors of Program Binaries." In: Kiayias, A. (eds) Computer Security – ESORICS 2011. ESORICS 2011. Lecture Notes in Computer Science, vol 6879. Springer, Berlin, Heidelberg. (DOI: https://doi.org/10.1007/978-3-642-23822-29). This paper establishes that features extracted from compiled code can be used to identify the author, stating, "Our results show that it is possible to identify the authors of programs from a candidate set of 20 programmers with over 75% accuracy." This directly supports using code analysis for profiling.

2. Official Vendor Documentation (NIST): National Institute of Standards and Technology (NIST). (2012). SP 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.3.3, "Analyzing Artifacts," discusses the importance of analyzing artifacts such as malware. The analysis focuses on understanding the "vector of attack, the vulnerability exploited, and the characteristics of the malware," which are all derived from the code and its behavior, forming the basis of a technical profile of the attack and, by extension, the attacker.

3. University Courseware: Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. This textbook, widely used in university forensics courses, details in Chapter 14 ("Network Forensics") and Chapter 15 ("Investigating Hacker Tools") how the analysis of tools, malware, and scripts (i.e., their code) is fundamental to understanding and profiling an attacker's capabilities and methods.

The file header is the initial section of a file's data that contains metadata about the file format. This metadata includes a specific sequence of bytes known as a "magic number" or file signature, which uniquely identifies the file type. Forensic investigators and software applications read this header to determine the true nature of a file, irrespective of its user-assigned extension. For instance, a JPEG file will always begin with the hexadecimal signature FF D8 FF, allowing an investigator to identify it as an image file even if it is renamed with a .doc extension.

A. the File Allocation Table: This is a filesystem index that points to the physical location of file data on a disk; it does not contain information about the file's format.

C. the file footer: While some file formats have a footer (end-of-file marker), the header contains the primary, standardized signature for type identification.

D. the sector map: This is a low-level representation of data storage on a disk and is not related to the internal structure or format of a specific file.

1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "File Type Analysis," Section "Signature-Based," Carrier states, "The basic idea of this technique is to compare the first few bytes of a file with a database of signatures for known file types." (p. 229).

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Academic Press. Chapter 9, "Processing Digital Crime Scenes," explains that file type identification is performed by examining file headers for known signatures, noting that this is more reliable than trusting file extensions (pp. 298-299).

3. Garfinkel, S. L. (2007). Carving contiguous and fragmented files with fast object validation. In Proceedings of the 2007 DFRWS Conference. DFRWS. Section 2.1, "File Headers, Footers, and Structure," describes how file carving and identification rely on recognizing the "magic numbers" located in file headers. https://doi.org/10.1016/j.diin.2007.06.002