A. By using automated tools an investigator can make up for a lack of experience in certain areas.

B. Forensic text search utilities can identify strings of text in an encrypted file.

C. They can help with an investigation, but are no substitute for experience.

D. A standard set of tools can be used across all network types and operating environments.

A. Steps to take before and after an event

B. B & C

C. A, B & C

D. Malicious attack response

E. Crisis mitigation

F. A & C

A. Keymapping Keylogger

B. Low Level Keyloggers

C. Device Driver Keylogger

D. API Keyloggers

A. Port/service mappings

B. Details of protocol usage

C. Forensic Evidence for malicious attacks

D. Details of system usage

A. Intrusion Detection and Traceback Protocol (IDTP)

B. Facilitating Traceback Protocol (FTP)

C. Intruder Detection and Internet Protocol (IDIP)

D. Intruder Detection and Isolation Protocol (IDIP)

A. Always collect the best evidence

B. Requires that the content of a writing be proven by introducing the original or by testimony of a qualified individual assuring its validity.

C. Great to look at

D. Evidence that can't be seen

A. The MS XP graphical version of NETSTAT showing all active connections

B. A firewall log file

C. A telnet session into a Linux system and a view of the /log/messages file.

D. An Intrusion Detection log file.

A. CCTV

B. Tripwire

C. Network Intrusion Detection

D. Electronic Frontier Firewall

A. False

B. True