System Forensics, Investigation, and Response, 3rd Edition

CHAPTER 2 ASSESSMENT

1. 1. When investigating a virus, what is the first step?

   1. Check firewall logs.

   2. Check IDS logs.

   3. Document the virus.

   4. Trace the origin of the virus.

2. 2. Which of the following crimes is most likely to leave email evidence?

   1. Cyberstalking

   2. DoS

   3. Logic bomb

   4. Fraud

3. 3. Where would you seek evidence that ophcrack had been used on a Windows Server 2008 machine?

   1. In the logs of the server; look for the reboot of the system

   2. In the logs of the server; look for the loading of a CD

   3. In the firewall logs

   4. In the IDS logs

4. 4. Logic bombs are often perpetrated by ________.

   1. identity thieves

   2. disgruntled employees

   3. terrorists

   4. hackers

5. 5. Spyware is legal.

   1. True

   2. False

6. 6. It is legal for employers to monitor work computers.

   1. True

   2. False