Instant Access ISC.SSCP.v2022-06-29.q999 Actual Practice Test Engine for Free (Page 36)

Question 172

Total risk is defined as:

A.Threats * Vulnerability * Asset Control Gap = Total Risk
B.Threats * Vulnerability * Asset Replacement Cost = Total Risk
C.Threats * Estimated Downtime * Asset Value = Total Risk
D.Total Risk = Asset Value * Exposure
E.Threats * Vulnerability * Asset Value = Total Risk

Question 173

You work in a police department forensics lab where you examine computers for evidence of crimes. Your work is vital to the success of the prosecution of criminals.
One day you receive a laptop and are part of a two man team responsible for examining it together.
However, it is lunch time and after receiving the laptop you leave it on your desk and you both head out to lunch.
What critical step in forensic evidence have you forgotten?

A.Chain of custody
B.Locking the laptop in your desk
C.Making a disk image for examination
D.Cracking the admin password with chntpw

Correct Answer: A

Explanation/Reference:
When evidence from a crime is to be used in the prosecution of a criminal it is critical that you follow the law when handling that evidence. Part of that process is called chain of custody and is when you maintain proactive and documented control over ALL evidence involved in a crime.
Failure to do this can lead to the dismissal of charges against a criminal because if the evidence is compromised because you failed to maintain of chain of custody.
A chain of custody is chronological documentation for evidence in a particular case, and is especially important with electronic evidence due to the possibility of fraudulent data alteration, deletion, or creation.
A fully detailed chain of custody report is necessary to prove the physical custody of a piece of evidence and show all parties that had access to said evidence at any given time.
Evidence must be protected from the time it is collected until the time it is presented in court.
The following answers are incorrect:
- Locking the laptop in your desk: Even this wouldn't assure that the defense team would try to challenge chain of custody handling. It's usually easy to break into a desk drawer and evidence should be stored in approved safes or other storage facility.
- Making a disk image for examination: This is a key part of system forensics where we make a disk image of the evidence system and study that as opposed to studying the real disk drive. That could lead to loss of evidence. However if the original evidence is not secured than the chain of custoday has not been maintained properly.
- Cracking the admin password with chntpw: This isn't correct. Your first mistake was to compromise the chain of custody of the laptop. The chntpw program is a Linux utility to (re)set the password of any user that has a valid (local) account on a Windows system, by modifying the crypted password in the registry's SAM file. You do not need to know the old password to set a new one. It works offline which means you must have physical access (i.e., you have to shutdown your computer and boot off a linux floppy disk). The bootdisk includes stuff to access NTFS partitions and scripts to glue the whole thing together. This utility works with SYSKEY and includes the option to turn it off. A bootdisk image is provided on their website at
http://freecode.com/projects/chntpw .
The following reference(s) was used to create this question:
For more details and to cover 100% of the exam Qs, subscribe to our holistic Security+ 2014 CBT Tutorial at: http://www.cccure.tv/
and
http://en.wikipedia.org/wiki/Chain_of_custody
and
http://www.datarecovery.com/forensic_chain_of_custody.asp

Question 174

Which type of firewall can be used to track connectionless protocols such as UDP and RPC?

A.Stateful inspection firewalls
B.Packet filtering firewalls
C.Application level firewalls
D.Circuit level firewalls

Question 175

CORRECT TEXT
An attempt to break an encryption algorithm is called _____________.

Question 176

Which of the following is NOT a common integrity goal?

A.Prevent unauthorized users from making modifications.
B.Maintain internal and external consistency.
C.Prevent authorized users from making improper modifications.
D.Prevent paths that could lead to inappropriate disclosure.

Question 172

Question 173

Question 174

Question 175

Question 176

Download PDF File