CHFI Fast Track Module 14 Quiz Level 1 - Keyword Recall

Question 1 of 562

How does the courseware define mobile device forensics?

The process of examining a mobile device along with the associated digital evidence, reported in a forensically sound manner

Correct Incorrect Correct answer

The monitoring of mobile network traffic for signs of criminal activity while the device is still in the hands of its owner

Correct Incorrect Correct answer

The recovery of records held by the cellular service provider

Correct Incorrect Correct answer

The testing of mobile applications for security defects before release

Correct Incorrect Correct answer

Question 2 of 562

From which three places does mobile device forensics extract, recover, and analyse data?

The device, the network, and the data center

Correct Incorrect Correct answer

The cache, the registry, and the system files that the operating system writes as it runs

Correct Incorrect Correct answer

The provider, the manufacturer, and the carrier

Correct Incorrect Correct answer

The internal memory, the SD cards, and the SIM cards of the device

Correct Incorrect Correct answer

Question 3 of 562

Which set of items does the courseware say forensic experts examine on a phone?

Only the applications installed by the user

Correct Incorrect Correct answer

Only the call logs and the contact list

Correct Incorrect Correct answer

Incoming and outgoing text messages, pictures in phone memory, call logs, email messages, card data, and deleted data

Correct Incorrect Correct answer

Only the data held by the service provider for the account registered to the handset under investigation

Correct Incorrect Correct answer

Question 4 of 562

What does the courseware give as the aim of mobile forensics?

To recover the cost of the investigation from the offender

Correct Incorrect Correct answer

To trace the perpetrators of crimes that involve the use of mobile phones

Correct Incorrect Correct answer

To repair the device so that it can be returned to its owner

Correct Incorrect Correct answer

To identify vulnerabilities in the operating system of the device

Correct Incorrect Correct answer

Question 5 of 562

Why does the courseware say the field of mobile device forensics is continually evolving?

Because the number of devices in use falls each year as the market matures worldwide

Correct Incorrect Correct answer

Because new device features, encryption methods, app ecosystems, and cloud storage practices keep arriving

Correct Incorrect Correct answer

Because the legal standards for evidence change every year

Correct Incorrect Correct answer

Because manufacturers publish their hardware designs

Correct Incorrect Correct answer

Question 6 of 562

In which kinds of matter does the courseware say mobile device forensics is critical?

Criminal cases, corporate litigation, and private investigations

Correct Incorrect Correct answer

Regulatory filings and audits only

Correct Incorrect Correct answer

Product recalls and warranty claims as the courseware presents them

Correct Incorrect Correct answer

Insurance assessments and valuations

Correct Incorrect Correct answer

Question 7 of 562

Which mobile risk covers the misuse of a platform feature or the failure to use platform security controls?

Insecure data storage

Correct Incorrect Correct answer

Client code quality

Correct Incorrect Correct answer

Extraneous functionality

Correct Incorrect Correct answer

Improper platform usage

Correct Incorrect Correct answer

Question 8 of 562

Which mobile risk arises when development teams assume that users and malware will not reach the file system of the device?

Code tampering

Correct Incorrect Correct answer

Insecure communication

Correct Incorrect Correct answer

Insecure data storage

Correct Incorrect Correct answer

Insufficient cryptography

Correct Incorrect Correct answer

Question 9 of 562

What does the courseware call sensitive data placed unintentionally where other apps can read it?

Extraneous functionality

Correct Incorrect Correct answer

Improper platform usage

Correct Incorrect Correct answer

Unintended data leakage

Correct Incorrect Correct answer

Code tampering

Correct Incorrect Correct answer

Question 10 of 562

Which mobile risk covers poor handshaking, incorrect secure socket layer versions, and clear-text communication of sensitive assets?

Insecure authorization

Correct Incorrect Correct answer

Insecure communication

Correct Incorrect Correct answer

Insufficient cryptography

Correct Incorrect Correct answer

Insecure authentication

Correct Incorrect Correct answer

Question 11 of 562

Which mobile risk captures failing to identify the user when required and weaknesses in session management?

Insecure authentication

Correct Incorrect Correct answer

Insecure authorization

Correct Incorrect Correct answer

Client code quality

Correct Incorrect Correct answer

Insecure data storage

Correct Incorrect Correct answer

Question 12 of 562

Which mobile risk describes cryptography that is attempted but performed incorrectly?

Code tampering

Correct Incorrect Correct answer

Mobile reverse engineering

Correct Incorrect Correct answer

Insecure communication

Correct Incorrect Correct answer

Insufficient cryptography

Correct Incorrect Correct answer

Question 13 of 562

Which mobile risk covers authorization decisions taken on the client side and forced browsing?

Improper platform usage

Correct Incorrect Correct answer

Extraneous functionality

Correct Incorrect Correct answer

Insecure authentication

Correct Incorrect Correct answer

Insecure authorization

Correct Incorrect Correct answer

Question 14 of 562

Which mobile risk is the catch-all for buffer overflows and format string vulnerabilities in the mobile client?

Insufficient cryptography

Correct Incorrect Correct answer

Insecure data storage

Correct Incorrect Correct answer

Client code quality

Correct Incorrect Correct answer

Code tampering

Correct Incorrect Correct answer

Question 15 of 562

Which mobile risk covers binary patching, method hooking, method swizzling, and dynamic memory modification?

Mobile reverse engineering

Correct Incorrect Correct answer

Code tampering

Correct Incorrect Correct answer

Client code quality

Correct Incorrect Correct answer

Insecure authorization

Correct Incorrect Correct answer

Question 16 of 562

Which mobile risk is the analysis of the final core binary to determine its source code, libraries, and algorithms?

Mobile reverse engineering

Correct Incorrect Correct answer

Improper platform usage

Correct Incorrect Correct answer

Code tampering

Correct Incorrect Correct answer

Extraneous functionality

Correct Incorrect Correct answer

Question 17 of 562

Which mobile risk covers hidden backdoor functionality left in an application by its developers?

Extraneous functionality

Correct Incorrect Correct answer

Client code quality

Correct Incorrect Correct answer

Insecure authorization

Correct Incorrect Correct answer

Code tampering

Correct Incorrect Correct answer

Question 18 of 562

Which three points does the courseware say a mobile attack can involve?

The browser, the application, and the operating system in the release it was built for

Correct Incorrect Correct answer

The carrier, the manufacturer, and the vendor

Correct Incorrect Correct answer

The processor, the memory, and the radio

Correct Incorrect Correct answer

The device, the network, and the data center or cloud

Correct Incorrect Correct answer

Question 19 of 562

Why have mobile devices emerged as a prime target for attacks?

Because the devices cannot be encrypted

Correct Incorrect Correct answer

Because the devices carry no security software at all and no way of installing any

Correct Incorrect Correct answer

Because of the extensive usage and implementation of bring your own device policies in organizations

Correct Incorrect Correct answer

Because manufacturers publish the source of their firmware

Correct Incorrect Correct answer

Question 20 of 562

Into which four groups does the courseware divide device-based attacks?

Static, dynamic, hybrid, and manual

Correct Incorrect Correct answer

Browser-based, phone and message based, application-based, and system based

Correct Incorrect Correct answer

Wireless, wired, cellular, and satellite

Correct Incorrect Correct answer

Server-based, database-based, cloud-based, and network-based which belong to the data center point

Correct Incorrect Correct answer

Question 21 of 562

How does the courseware describe mobile phishing?

Code implanted to bypass one-time password verification

Correct Incorrect Correct answer

Emails or pop-ups that redirect users to fake web pages mimicking trustworthy sites and ask for personal information

Correct Incorrect Correct answer

Text messages containing deceptive links to malicious websites

Correct Incorrect Correct answer

A web page integrated into another using inline frames so that the embedded page is displayed inside the outer one

Correct Incorrect Correct answer

Question 22 of 562

Why are mobile users more likely to fall victim to phishing sites?

Because the devices are small and display only short addresses, limited warning messages, and scaled-down lock icons

Correct Incorrect Correct answer

Because mobile devices cannot display images

Correct Incorrect Correct answer

Because phishing sites are hosted on mobile networks

Correct Incorrect Correct answer

Because mobile browsers do not support secure connections and therefore cannot warn the user at all

Correct Incorrect Correct answer

Question 23 of 562

Which browser-based attack integrates one web page into another using inline frame elements?

Data caching

Correct Incorrect Correct answer

Man-in-the-mobile

Correct Incorrect Correct answer

Clickjacking

Correct Incorrect Correct answer

Framing

Correct Incorrect Correct answer

Question 24 of 562

Which attack is also known as a user interface redress attack?

Session hijacking

Correct Incorrect Correct answer

Framing

Correct Incorrect Correct answer

Clickjacking

Correct Incorrect Correct answer

Baseband attack

Correct Incorrect Correct answer

Question 25 of 562

Which attack implants malicious code to bypass systems that send one-time passwords by message or voice call?

Message phishing

Correct Incorrect Correct answer

Data caching

Correct Incorrect Correct answer

Man-in-the-mobile

Correct Incorrect Correct answer

Man-in-the-middle

Correct Incorrect Correct answer

Question 26 of 562

How does the courseware describe a buffer overflow on a mobile device?

A program overwrites the boot partition of the device

Correct Incorrect Correct answer

A program writing data to a buffer surfeits the intended limit and overwrites the adjacent memory

Correct Incorrect Correct answer

A program consumes all the available storage on the device until nothing further can be written to it

Correct Incorrect Correct answer

A program floods the network interface with packets

Correct Incorrect Correct answer

Question 27 of 562

What does the data caching attack exploit?

The caches that store information needed to interact with web applications

Correct Incorrect Correct answer

The cached credentials held by the network operator for the accounts the user holds

Correct Incorrect Correct answer

The cache partition of the file system

Correct Incorrect Correct answer

The browser bookmarks of the user

Correct Incorrect Correct answer

Question 28 of 562

Which attack exploits vulnerabilities in the processor that sends and receives radio signals to cell towers?

Packet sniffing

Correct Incorrect Correct answer

Rogue access points

Correct Incorrect Correct answer

Name service poisoning

Correct Incorrect Correct answer

Baseband attacks

Correct Incorrect Correct answer

Question 29 of 562

Which attack sends text messages containing deceptive links to malicious websites or telephone numbers?

Framing

Correct Incorrect Correct answer

Clickjacking

Correct Incorrect Correct answer

Mobile phishing

Correct Incorrect Correct answer

Message phishing

Correct Incorrect Correct answer

Question 30 of 562

Which application-based attack targets apps whose database architecture uses weak security?

Dynamic runtime injection as the app was written to expect

Correct Incorrect Correct answer

Unintended permissions

Correct Incorrect Correct answer

The sensitive data storage attack

Correct Incorrect Correct answer

Configuration manipulation

Correct Incorrect Correct answer

Question 31 of 562

What does the courseware say about apps that transmit unencrypted or weakly encrypted data?

They are unable to reach the network at all

Correct Incorrect Correct answer

They are susceptible to attacks such as session hijacking

Correct Incorrect Correct answer

They are rejected by the application store

Correct Incorrect Correct answer

They cannot be installed on a rooted device

Correct Incorrect Correct answer

Question 32 of 562

Which attack takes advantage of security loopholes in the certificate validation process of an application?

Improper secure socket layer validation

Correct Incorrect Correct answer

Configuration manipulation

Correct Incorrect Correct answer

Escalated privileges

Correct Incorrect Correct answer

Unintended permissions granted in error by a misconfigured app

Correct Incorrect Correct answer

Question 33 of 562

Which attack exploits the external configuration files and libraries an app uses?

Configuration manipulation

Correct Incorrect Correct answer

The sensitive data storage attack

Correct Incorrect Correct answer

User-initiated code

Correct Incorrect Correct answer

Dynamic runtime injection

Correct Incorrect Correct answer

Question 34 of 562

Which attack manipulates the run time of an application to circumvent security locks and logic checks?

Code tampering

Correct Incorrect Correct answer

Escalated privileges

Correct Incorrect Correct answer

Configuration manipulation

Correct Incorrect Correct answer

Dynamic runtime injection

Correct Incorrect Correct answer

Question 35 of 562

Which attack arises where a misconfigured app grants permissions the developer never intended?

Dynamic runtime injection

Correct Incorrect Correct answer

Escalated privileges

Correct Incorrect Correct answer

Unintended permissions

Correct Incorrect Correct answer

Improper platform usage

Correct Incorrect Correct answer

Question 36 of 562

Which attack takes advantage of design flaws, programming errors, bugs, or configuration oversights to reach protected resources?

Server misconfiguration

Correct Incorrect Correct answer

Escalated privileges

Correct Incorrect Correct answer

Unintended permissions

Correct Incorrect Correct answer

Data dumping

Correct Incorrect Correct answer

Question 37 of 562

Which system-based weakness does the courseware describe as many users choosing not to set a code at all?

Carrier-loaded software

Correct Incorrect Correct answer

No passcode or weak passcode

Correct Incorrect Correct answer

Operating system data caching

Correct Incorrect Correct answer

Passwords and data accessible

Correct Incorrect Correct answer

Question 38 of 562

What does the courseware say jailbreaking does when treated as an attack?

It removes the security mechanisms set by the vendor, giving root access and removing sandbox restrictions

Correct Incorrect Correct answer

It replaces the operating system with a custom build supplied by a third party rather than the vendor

Correct Incorrect Correct answer

It disables the cellular radio of the device

Correct Incorrect Correct answer

It encrypts the file system of the device

Correct Incorrect Correct answer

Question 39 of 562

What does the courseware say rooting does when treated as an attack?

It replaces the boot loader with an unsigned one so that unsigned firmware can be installed

Correct Incorrect Correct answer

It removes the applications installed by the carrier

Correct Incorrect Correct answer

It disables the lock screen of the device

Correct Incorrect Correct answer

It attains privileged control within the subsystem, which can expose sensitive data stored on the device

Correct Incorrect Correct answer

Question 40 of 562

How does an attacker exploit the operating system cache of a device?

By clearing the cache to force a re-download of sensitive data held by the platform itself

Correct Incorrect Correct answer

By reading the cache directly from the running system

Correct Incorrect Correct answer

By dumping the memory after rebooting the device with a malicious operating system

Correct Incorrect Correct answer

By requesting the cache contents from the carrier

Correct Incorrect Correct answer

Question 41 of 562

Which weakness lets attackers decrypt the keychain of a device and expose user passwords and encryption keys?

Carrier-loaded software

Correct Incorrect Correct answer

User-initiated code

Correct Incorrect Correct answer

Passwords and data accessible

Correct Incorrect Correct answer

No passcode or weak passcode

Correct Incorrect Correct answer

Question 42 of 562

Which weakness concerns software already present on the device when the user receives it?

User-initiated code

Correct Incorrect Correct answer

Carrier-loaded software

Correct Incorrect Correct answer

Extraneous functionality

Correct Incorrect Correct answer

Configuration manipulation

Correct Incorrect Correct answer

Question 43 of 562

Which weakness describes tricking the victim into installing malicious applications or clicking links?

User-initiated code

Correct Incorrect Correct answer

Carrier-loaded software

Correct Incorrect Correct answer

Framing

Correct Incorrect Correct answer

Rogue access points

Correct Incorrect Correct answer

Question 44 of 562

Which network-based attack lets an attacker intercept data by eavesdropping on a wireless connection?

Rogue access points

Correct Incorrect Correct answer

Name service poisoning over the air interface

Correct Incorrect Correct answer

Fake certificates

Correct Incorrect Correct answer

Wireless weak or no encryption

Correct Incorrect Correct answer

Question 45 of 562

Which attack installs an illicit wireless access point by physical means?

The transport stripping attack

Correct Incorrect Correct answer

Session hijacking

Correct Incorrect Correct answer

Packet sniffing

Correct Incorrect Correct answer

Rogue access points

Correct Incorrect Correct answer

Question 46 of 562

What does packet sniffing capture on a mobile network?

Only the encrypted portion of each session

Correct Incorrect Correct answer

Only the routing headers of each packet

Correct Incorrect Correct answer

All the data packets in network traffic, which generally include credentials sent in clear text

Correct Incorrect Correct answer

Only the packets addressed to the attacker rather than the whole of the traffic on the segment

Correct Incorrect Correct answer

Question 47 of 562

Which attack eavesdrops on existing connections between two systems, then reads, modifies, or inserts data?

Name service poisoning

Correct Incorrect Correct answer

The man-in-the-middle attack

Correct Incorrect Correct answer

Man-in-the-mobile

Correct Incorrect Correct answer

Rogue access points

Correct Incorrect Correct answer

Question 48 of 562

Which attack steals valid session identifiers to gain unauthorized access to user and network information?

Mobile session hijacking

Correct Incorrect Correct answer

Cross-site request forgery

Correct Incorrect Correct answer

The transport stripping attack

Correct Incorrect Correct answer

Escalated privileges

Correct Incorrect Correct answer

Question 49 of 562

Which attack results in the substitution of false addresses at the name service level?

Name service poisoning

Correct Incorrect Correct answer

The transport stripping attack

Correct Incorrect Correct answer

Packet sniffing

Correct Incorrect Correct answer

Fake certificates

Correct Incorrect Correct answer

Question 50 of 562

Which middle attack invisibly downgrades connections to the unencrypted protocol?

Rogue access points

Correct Incorrect Correct answer

Fake certificates

Correct Incorrect Correct answer

Name service poisoning

Correct Incorrect Correct answer

The transport stripping attack

Correct Incorrect Correct answer

Question 51 of 562

Which middle attack issues a false certificate to intercept traffic on a supposedly secure connection?

Cross-site scripting

Correct Incorrect Correct answer

Packet sniffing

Correct Incorrect Correct answer

Fake certificates

Correct Incorrect Correct answer

The transport stripping attack

Correct Incorrect Correct answer

Question 52 of 562

Which two primary points of entry does a data center have?

A gateway and a proxy

Correct Incorrect Correct answer

A web server and a database

Correct Incorrect Correct answer

A firewall and a router

Correct Incorrect Correct answer

A load balancer and a cache

Correct Incorrect Correct answer

Question 53 of 562

Which server-side attack exploits weaknesses in the operating system, the server software, or the application modules?

Cross-site scripting

Correct Incorrect Correct answer

Platform vulnerabilities

Correct Incorrect Correct answer

Server misconfiguration

Correct Incorrect Correct answer

Weak input validation

Correct Incorrect Correct answer

Question 54 of 562

Which server-side attack turns on settings rather than software defects?

Server misconfiguration

Correct Incorrect Correct answer

Brute-force attacks

Correct Incorrect Correct answer

Cross-site request forgery

Correct Incorrect Correct answer

Platform vulnerabilities

Correct Incorrect Correct answer

Question 55 of 562

Which attack injects client-side scripts into dynamically generated web pages viewed by other users?

Structured query injection

Correct Incorrect Correct answer

Weak input validation

Correct Incorrect Correct answer

Cross-site request forgery

Correct Incorrect Correct answer

Cross-site scripting

Correct Incorrect Correct answer

Question 56 of 562

Which attack forces the browser of a user holding an active session with a trusted site to send unintended requests?

Brute-force attacks

Correct Incorrect Correct answer

Cross-site scripting

Correct Incorrect Correct answer

Cross-site request forgery

Correct Incorrect Correct answer

Session hijacking

Correct Incorrect Correct answer

Question 57 of 562

Which server-side weakness follows from web services trusting the input sent by mobile applications?

Platform vulnerabilities

Correct Incorrect Correct answer

Data dumping

Correct Incorrect Correct answer

Weak input validation

Correct Incorrect Correct answer

Server misconfiguration

Correct Incorrect Correct answer

Question 58 of 562

Which attack adopts a trial-and-error approach to guess the valid input to a field?

Privilege escalation

Correct Incorrect Correct answer

Mobile brute-force attacks

Correct Incorrect Correct answer

Weak input validation

Correct Incorrect Correct answer

Structured query injection

Correct Incorrect Correct answer

Question 59 of 562

Which database attack passes commands through a web application for execution by a backend database?

Structured query injection

Correct Incorrect Correct answer

Operating system command execution

Correct Incorrect Correct answer

Database privilege escalation

Correct Incorrect Correct answer

Data dumping

Correct Incorrect Correct answer

Question 60 of 562

Which database attack leverages an exploit to gain high-level access and steal sensitive data?

Data dumping

Correct Incorrect Correct answer

Structured query injection

Correct Incorrect Correct answer

Weak input validation

Correct Incorrect Correct answer

Database privilege escalation

Correct Incorrect Correct answer

Question 61 of 562

Which database attack causes the database to reveal some or all of its records?

Operating system command execution

Correct Incorrect Correct answer

Structured query injection

Correct Incorrect Correct answer

Privilege escalation

Correct Incorrect Correct answer

Data dumping

Correct Incorrect Correct answer

Question 62 of 562

Which database attack injects system-level commands into a query so they execute on the server?

Structured query injection

Correct Incorrect Correct answer

Data dumping

Correct Incorrect Correct answer

Operating system command execution

Correct Incorrect Correct answer

Server misconfiguration

Correct Incorrect Correct answer

Question 63 of 562

Why does the courseware say mobile forensics investigators need sound knowledge of mobile hardware?

Because every manufacturer uses the same board layout

Correct Incorrect Correct answer

Because forensics is highly dependent on the underlying hardware and there is no standard hardware architecture for mobile phones

Correct Incorrect Correct answer

Because the hardware determines which laws apply to the investigation

Correct Incorrect Correct answer

Because the hardware carries the encryption keys of the device in a component that no software method can reach

Correct Incorrect Correct answer

Question 64 of 562

Which set does the courseware give as the common mobile hardware components?

The application processor, the baseband processor, the digital signal processor, the converters, memory, read-only memory, and the radio part

Correct Incorrect Correct answer

The display, the keypad, the battery, and the case

Correct Incorrect Correct answer

The kernel, the drivers, the libraries, and the runtime that make up the software stack above the hardware

Correct Incorrect Correct answer

The client, the daemon, and the server

Correct Incorrect Correct answer

Question 65 of 562

What difficulty does proprietary mobile hardware create for the investigator?

It makes the forensic acquisition process difficult, and the investigator must know where components such as the memory chip sit

Correct Incorrect Correct answer

It prevents the device from being connected to a workstation at all until the manufacturer supplies a proprietary adapter

Correct Incorrect Correct answer

It requires the manufacturer to be present during the examination

Correct Incorrect Correct answer

It makes the device impossible to power on

Correct Incorrect Correct answer

Question 66 of 562

In which situation does the courseware say knowledge of mobile hardware becomes essential?

When the device is locked with a pattern

Correct Incorrect Correct answer

When the device has been rooted by its owner

Correct Incorrect Correct answer

When the device is connected to a cloud account and the credentials for that account are unknown

Correct Incorrect Correct answer

When the device is broken or damaged and cannot be accessed using data ports

Correct Incorrect Correct answer

Question 67 of 562

How does the courseware define mobile operating system forensics?

The installation of a forensic operating system onto the device so that it can be examined in place afterwards

Correct Incorrect Correct answer

The testing of the operating system for vulnerabilities

Correct Incorrect Correct answer

The recovery, analysis, and presentation of data from mobile operating systems in a way that is legally admissible in court

Correct Incorrect Correct answer

The comparison of one mobile operating system against another

Correct Incorrect Correct answer

Question 68 of 562

Why is mobile operating system forensics described as challenging?

Because of the wide variety of mobile operating systems and the rapid pace at which they evolve

Correct Incorrect Correct answer

Because the systems are all closed source

Correct Incorrect Correct answer

Because the systems store no data locally

Correct Incorrect Correct answer

Because the systems cannot be examined without the vendor

Correct Incorrect Correct answer

Question 69 of 562

Which operating systems does the courseware say are most commonly encountered in mobile forensics?

Only the closed platform

Correct Incorrect Correct answer

The two major mobile platforms, and to a lesser extent others such as the discontinued phone and messaging systems

Correct Incorrect Correct answer

Desktop operating systems ported to phones and adapted by their vendors for the smaller screen and sold under their own brands

Correct Incorrect Correct answer

Only the open-source platform

Correct Incorrect Correct answer

Question 70 of 562

What knowledge does the courseware say investigators require of the devices under investigation?

The underlying operating system, its architecture, and its file systems, because boot process knowledge helps gain lower-level access

Correct Incorrect Correct answer

The purchase history and warranty status of the device together with the retailer that sold it to the suspect

Correct Incorrect Correct answer

The carrier billing arrangements for the account

Correct Incorrect Correct answer

The manufacturing plant that produced the device

Correct Incorrect Correct answer

Question 71 of 562

Which challenge requires investigators to learn several acquisition procedures and forensic tools?

The volatile data challenge

Correct Incorrect Correct answer

The privacy law challenge

Correct Incorrect Correct answer

The cloud data challenge

Correct Incorrect Correct answer

The varied nature challenge

Correct Incorrect Correct answer

Question 72 of 562

Which challenge concerns bypassing a number lock, passcode, pattern, or fingerprint?

The tool incompatibility challenge

Correct Incorrect Correct answer

The update and overwrite challenge

Correct Incorrect Correct answer

The security mechanism challenge

Correct Incorrect Correct answer

The anti-forensics challenge

Correct Incorrect Correct answer

Question 73 of 562

Which challenge arises because the data in question is saved on cloud storage instead of the device?

The evolving technology challenge

Correct Incorrect Correct answer

The low-level access challenge

Correct Incorrect Correct answer

The cloud data challenge

Correct Incorrect Correct answer

The network isolation challenge

Correct Incorrect Correct answer

Question 74 of 562

Which challenge follows from failing to isolate a seized device from other networks?

The varied nature challenge

Correct Incorrect Correct answer

The network isolation challenge

Correct Incorrect Correct answer

The cloud data challenge

Correct Incorrect Correct answer

The volatile data challenge

Correct Incorrect Correct answer

Question 75 of 562

Which challenge warns that a step taken during physical acquisition might itself destroy data?

The rooting and jailbreaking challenge

Correct Incorrect Correct answer

The anti-forensics challenge

Correct Incorrect Correct answer

The privacy law challenge

Correct Incorrect Correct answer

The security mechanism challenge

Correct Incorrect Correct answer

Question 76 of 562

Which challenge concerns finding the correct tools to reach the device at a low level during acquisition?

The tool incompatibility challenge

Correct Incorrect Correct answer

The varied nature challenge

Correct Incorrect Correct answer

The evolving technology challenge

Correct Incorrect Correct answer

The low-level access challenge

Correct Incorrect Correct answer

Question 77 of 562

Which challenge covers data wiping, data forgery, data hiding, and deletion after many incorrect password attempts?

The update and overwrite challenge

Correct Incorrect Correct answer

The security mechanism challenge

Correct Incorrect Correct answer

The volatile data challenge

Correct Incorrect Correct answer

The anti-forensics challenge

Correct Incorrect Correct answer

Question 78 of 562

Which challenge arises because mobile devices are subjected to frequent updates and modifications?

The evolving technology challenge

Correct Incorrect Correct answer

The tool incompatibility challenge

Correct Incorrect Correct answer

The update and overwrite challenge

Correct Incorrect Correct answer

The anti-forensics challenge

Correct Incorrect Correct answer

Question 79 of 562

Which challenge concerns data lost when a device turns off during live capture?

The low-level access challenge

Correct Incorrect Correct answer

The volatile data challenge

Correct Incorrect Correct answer

The network isolation challenge

Correct Incorrect Correct answer

The update and overwrite challenge

Correct Incorrect Correct answer

Question 80 of 562

Which challenge concerns restricted access to devices or data and difficulty in obtaining consent?

The privacy law challenge

Correct Incorrect Correct answer

The cloud data challenge

Correct Incorrect Correct answer

The security mechanism challenge

Correct Incorrect Correct answer

The evolving technology challenge

Correct Incorrect Correct answer

Question 81 of 562

Which challenge makes investigations time-consuming and demands expensive, specialized tools and training?

The evolving technology challenge

Correct Incorrect Correct answer

The varied nature challenge

Correct Incorrect Correct answer

The privacy law challenge

Correct Incorrect Correct answer

The tool incompatibility challenge

Correct Incorrect Correct answer

Question 82 of 562

Which challenge can cause obstructions in the data-recovery process itself?

The presence of a cloud account on the device

Correct Incorrect Correct answer

The absence of a memory card in the device when the handset reaches the laboratory

Correct Incorrect Correct answer

The age of the device operating system

Correct Incorrect Correct answer

The incompatibility of various forensic tools with certain devices and data types

Correct Incorrect Correct answer

Question 83 of 562

What does the courseware say the mobile architectural layer is?

A platform enabling mobile operating systems, applications, and device hardware to work in coordination

Correct Incorrect Correct answer

The physical case and screen assembly of the device

Correct Incorrect Correct answer

The set of drivers loaded by the kernel at boot when the handset is first powered on

Correct Incorrect Correct answer

The interface between the device and the cellular network

Correct Incorrect Correct answer

Question 84 of 562

Which set does the courseware give as the parts a mobile device usually consists of?

Kernel, libraries, runtime, framework, and applications

Correct Incorrect Correct answer

Client, daemon, server, and shell

Correct Incorrect Correct answer

Boot, system, recovery, data, cache, and miscellaneous which are the partitions of the file system rather than the parts of the handset

Correct Incorrect Correct answer

Display, keypad, subscriber module, battery, camera, speaker, antenna, microphone, codec, radio part, converters, connectivity, memory, and touch screen

Correct Incorrect Correct answer

Question 85 of 562

What does the antenna of a mobile device do?

It converts analog speech into digital samples

Correct Incorrect Correct answer

It mixes the transmit and receive frequencies

Correct Incorrect Correct answer

It converts electromagnetic radiation to electric signals and electric signals back to radiation

Correct Incorrect Correct answer

It amplifies the audio signal before it reaches the speaker as it travels towards the speaker

Correct Incorrect Correct answer

Question 86 of 562

Which component does the courseware name as the basic component used for frequency conversion?

The attenuator

Correct Incorrect Correct answer

The mixer in the radio frequency part

Correct Incorrect Correct answer

The digital signal processor inside the baseband part of the handset

Correct Incorrect Correct answer

The analog filter

Correct Incorrect Correct answer

Question 87 of 562

What do the analog-to-digital and digital-to-analog converters do in a mobile device?

They convert the battery voltage for the processor

Correct Incorrect Correct answer

They convert analog speech signals to digital signals and digital signals back to analog

Correct Incorrect Correct answer

They convert between the two cellular interface standards so that a handset can register on either of them

Correct Incorrect Correct answer

They convert stored media between formats

Correct Incorrect Correct answer

Question 88 of 562

Which part of a mobile device processes the forward and reverse voice and data signals, and differs by interface standard?

The baseband part

Correct Incorrect Correct answer

The radio frequency part

Correct Incorrect Correct answer

The application and processor layer

Correct Incorrect Correct answer

The codec

Correct Incorrect Correct answer

Question 89 of 562

What runs on the central processor of a mobile device, and what services does it provide?

The baseband layer, providing radio signal processing

Correct Incorrect Correct answer

The kernel layer, providing memory and power management

Correct Incorrect Correct answer

The abstraction layer, providing access to hardware modules through the modules it holds for audio, camera, and sensors

Correct Incorrect Correct answer

The application layer, including audio, video, and graphics applications, providing services such as mail and file transfer

Correct Incorrect Correct answer

Question 90 of 562

What does the courseware say about the memory unit of a mobile device?

It is a single unified pool shared with the graphics processor from which both draw as their work demands

Correct Incorrect Correct answer

It is held entirely in the baseband processor

Correct Incorrect Correct answer

It includes the working memory and the read-only memory, of which the read-only memory is the internal storage

Correct Incorrect Correct answer

It consists only of the removable memory card

Correct Incorrect Correct answer

Question 91 of 562

Which list does the courseware give for the display technologies available on mobile devices?

Electronic ink and reflective displays only

Correct Incorrect Correct answer

Touch, multi-touch, and pressure-sensitive displays

Correct Incorrect Correct answer

The twisted nematic and thin film types, the light emitting diode families, and the organic displays

Correct Incorrect Correct answer

Cathode ray, plasma, and projection displays which belong to televisions and projectors rather than to handsets

Correct Incorrect Correct answer

Question 92 of 562

What does the courseware say about the cameras on a smartphone?

The camera resolution is fixed by the operating system

Correct Incorrect Correct answer

Almost all smartphones feature a camera, and the front and rear resolutions differ depending on the price of the device

Correct Incorrect Correct answer

Only high-end devices carry a camera at all

Correct Incorrect Correct answer

The front and rear cameras always share the same resolution whatever the price of the device happens to be

Correct Incorrect Correct answer

Question 93 of 562

What does the microphone of a mobile device do?

It converts acoustical or sound energy into electrical energy to couple onto the circuit board for further processing

Correct Incorrect Correct answer

It converts electrical audio signals into sound energy through an amplifier and a volume-adjustable circuit mounted beside it on the board

Correct Incorrect Correct answer

It converts analog signals into digital samples

Correct Incorrect Correct answer

It amplifies the received radio signal

Correct Incorrect Correct answer

Question 94 of 562

Which component converts electrical audio signals into sound energy and carries a volume-adjustable circuit?

The microphone

Correct Incorrect Correct answer

The codec

Correct Incorrect Correct answer

The antenna

Correct Incorrect Correct answer

The speaker

Correct Incorrect Correct answer

Question 95 of 562

Which four connectivity components does the courseware name, and what does the fourth of them provide?

Wireless networking, infrared, cellular, and satellite, where satellite provides the location data

Correct Incorrect Correct answer

Bluetooth, serial bus, infrared, and cellular, where cellular provides the location data

Correct Incorrect Correct answer

Wireless networking, Bluetooth, cellular, and infrared, where infrared provides the location data to the applications that ask the system for it

Correct Incorrect Correct answer

Wireless networking, Bluetooth, positioning, and the serial bus, where positioning provides the location data of the user

Correct Incorrect Correct answer

Question 96 of 562

How does the courseware describe the open mobile platform?

A firmware layer that runs beneath the boot loader

Correct Incorrect Correct answer

A set of applications distributed with the hardware

Correct Incorrect Correct answer

A Linux-based operating system designed for portable devices such as smartphones and tablets, built as a stack of software components

Correct Incorrect Correct answer

A closed operating system supporting only the devices of one manufacturer and licensed to no other hardware maker at all

Correct Incorrect Correct answer

Question 97 of 562

Into how many sections and layers is the open platform stack divided, and what are the sections?

Three sections in three layers: user space, kernel space, and firmware

Correct Incorrect Correct answer

Six sections in five layers: system apps, the framework, native libraries, the runtime, the abstraction layer, and the kernel

Correct Incorrect Correct answer

Five sections in six layers: applications, services, drivers, kernel, and firmware arranged with the firmware at the bottom of the stack

Correct Incorrect Correct answer

Four sections in four layers: applications, framework, runtime, and kernel

Correct Incorrect Correct answer

Question 98 of 562

What does the top layer of the open platform stack hold?

All system applications, including the dialer, email, calendar, camera, messaging, and browsers

Correct Incorrect Correct answer

The native libraries specific to the hardware

Correct Incorrect Correct answer

The runtime virtual machine and the core libraries which sit one layer further down

Correct Incorrect Correct answer

The low-level device drivers

Correct Incorrect Correct answer

Question 99 of 562

What does the framework layer of the open platform do?

It makes the platform functions available to developers through programming interfaces and offers high-level services

Correct Incorrect Correct answer

It exposes the hardware capabilities of the device to the kernel through the modules of that layer

Correct Incorrect Correct answer

It compiles applications ahead of time

Correct Incorrect Correct answer

It manages the boot sequence of the device

Correct Incorrect Correct answer

Question 100 of 562

Which framework block manages data sharing between applications?

The package manager

Correct Incorrect Correct answer

The activity manager

Correct Incorrect Correct answer

The resource manager

Correct Incorrect Correct answer

The content provider

Correct Incorrect Correct answer

Question 101 of 562

Which framework block is used for developing lists, grids, text boxes, and buttons?

The surface manager

Correct Incorrect Correct answer

The notification manager

Correct Incorrect Correct answer

The view system

Correct Incorrect Correct answer

The window manager

Correct Incorrect Correct answer

Question 102 of 562

Which framework block controls the activity life cycle of applications?

The telephony manager

Correct Incorrect Correct answer

The activity manager

Correct Incorrect Correct answer

The package manager

Correct Incorrect Correct answer

The window manager

Correct Incorrect Correct answer

Question 103 of 562

Which framework block manages location using the positioning system or cell towers?

The resource manager

Correct Incorrect Correct answer

The location manager

Correct Incorrect Correct answer

The telephony manager

Correct Incorrect Correct answer

The content provider

Correct Incorrect Correct answer

Question 104 of 562

Which framework block keeps track of the applications installed on the device?

The package manager

Correct Incorrect Correct answer

The activity manager

Correct Incorrect Correct answer

The resource manager

Correct Incorrect Correct answer

The content provider

Correct Incorrect Correct answer

Question 105 of 562

Which framework block helps applications display custom messages in a status bar?

The window manager

Correct Incorrect Correct answer

The view system

Correct Incorrect Correct answer

The surface manager

Correct Incorrect Correct answer

The notification manager

Correct Incorrect Correct answer

Question 106 of 562

Which framework block manages the various types of resource used by an application?

The content provider

Correct Incorrect Correct answer

The activity manager

Correct Incorrect Correct answer

The resource manager

Correct Incorrect Correct answer

The package manager

Correct Incorrect Correct answer

Question 107 of 562

Which framework block manages all voice calls?

The activity manager

Correct Incorrect Correct answer

The notification manager

Correct Incorrect Correct answer

The telephony manager

Correct Incorrect Correct answer

The location manager

Correct Incorrect Correct answer

Question 108 of 562

Which framework block manages application windows?

The activity manager

Correct Incorrect Correct answer

The window manager

Correct Incorrect Correct answer

The view system

Correct Incorrect Correct answer

The surface manager

Correct Incorrect Correct answer

Question 109 of 562

What does the courseware say about the native libraries layer?

The libraries are written in C or C++, are specific to particular hardware, and allow the device to control different types of data

Correct Incorrect Correct answer

The libraries are written in the framework language and are hardware independent so that the same binary runs on every device model

Correct Incorrect Correct answer

The libraries are supplied by the carrier rather than the platform

Correct Incorrect Correct answer

The libraries run inside the runtime virtual machine

Correct Incorrect Correct answer

Question 110 of 562

Which native libraries are named as the web browser engines that display markup content?

The media framework

Correct Incorrect Correct answer

The multimedia companion library

Correct Incorrect Correct answer

The graphics library

Correct Incorrect Correct answer

The browser engine libraries

Correct Incorrect Correct answer

Question 111 of 562

Which native library is described as the companion to the graphics interface but used for video and audio rather than audio alone?

The media framework

Correct Incorrect Correct answer

The surface manager

Correct Incorrect Correct answer

The system C library

Correct Incorrect Correct answer

The multimedia companion library

Correct Incorrect Correct answer

Question 112 of 562

Which native library comprises the system C libraries?

The font library

Correct Incorrect Correct answer

The security library

Correct Incorrect Correct answer

The system C library

Correct Incorrect Correct answer

The media framework

Correct Incorrect Correct answer

Question 113 of 562

Which native library provides the codecs that allow recording and playback of different media formats?

The surface manager

Correct Incorrect Correct answer

The media framework

Correct Incorrect Correct answer

The multimedia companion library

Correct Incorrect Correct answer

The graphics library

Correct Incorrect Correct answer

Question 114 of 562

Which native library provides two-dimensional and three-dimensional graphics?

The graphics library

Correct Incorrect Correct answer

The surface manager

Correct Incorrect Correct answer

The browser engine libraries

Correct Incorrect Correct answer

The media framework

Correct Incorrect Correct answer

Question 115 of 562

Which native library is meant for display management?

The surface manager

Correct Incorrect Correct answer

The window manager

Correct Incorrect Correct answer

The graphics library

Correct Incorrect Correct answer

The view system

Correct Incorrect Correct answer

Question 116 of 562

Which native library is the database engine used for data storage?

The media framework

Correct Incorrect Correct answer

The system C library

Correct Incorrect Correct answer

The font library

Correct Incorrect Correct answer

The embedded database library

Correct Incorrect Correct answer

Question 117 of 562

Which native library is meant for rendering fonts?

The surface manager

Correct Incorrect Correct answer

The security library

Correct Incorrect Correct answer

The font library

Correct Incorrect Correct answer

The graphics library

Correct Incorrect Correct answer

Question 118 of 562

Which native library is meant for Internet security?

The embedded database library

Correct Incorrect Correct answer

The security library

Correct Incorrect Correct answer

The system C library

Correct Incorrect Correct answer

The browser engine libraries

Correct Incorrect Correct answer

Question 119 of 562

What does the runtime of the open platform include, and what changed beyond version five?

It includes the framework blocks, and beyond version five they moved into the kernel

Correct Incorrect Correct answer

It includes the core libraries and the runtime virtual machine, and beyond version five apps have their own runtime processes and instances

Correct Incorrect Correct answer

It includes only the core libraries, and beyond version five the virtual machine was removed in favour of running code compiled ahead of time

Correct Incorrect Correct answer

It includes the native libraries, and beyond version five they became hardware independent

Correct Incorrect Correct answer

Question 120 of 562

Which four features does the courseware attribute to the runtime?

Ahead-of-time compilation, just-in-time compilation, optimized garbage collection, and executable format files that compress machine code

Correct Incorrect Correct answer

Sandboxing, permissions, isolation, and encryption

Correct Incorrect Correct answer

Memory management, power management, security management, and networking which are the functions of the kernel rather than runtime features

Correct Incorrect Correct answer

Preloading, forking, warming, and launching

Correct Incorrect Correct answer

Question 121 of 562

What do the core libraries of the runtime allow?

They allow the kernel to reach the hardware directly

Correct Incorrect Correct answer

They allow the device to boot without a boot loader once the kernel has finished loading

Correct Incorrect Correct answer

They allow applications to run without a virtual machine

Correct Incorrect Correct answer

They allow developers to write applications for the platform in the Java language

Correct Incorrect Correct answer

Question 122 of 562

What is the purpose of the hardware abstraction layer?

To compile applications for the specific hardware

Correct Incorrect Correct answer

To manage the power state of the hardware

Correct Incorrect Correct answer

To expose the hardware capabilities of the device to the framework above it, acting as an abstraction between hardware and the software stack

Correct Incorrect Correct answer

To provide the low-level device drivers to the kernel so that the kernel can talk to the audio, camera, and sensor hardware

Correct Incorrect Correct answer

Question 123 of 562

What does the hardware abstraction layer comprise?

The native libraries specific to that hardware

Correct Incorrect Correct answer

The framework blocks that expose the hardware to apps through the interfaces that developers call in their own code

Correct Incorrect Correct answer

The modules required for the hardware equipment in the device, such as audio, camera, Bluetooth, and sensors

Correct Incorrect Correct answer

The low-level drivers for the same hardware

Correct Incorrect Correct answer

Question 124 of 562

Which layer of the open platform stack holds the low-level device drivers and power management?

The runtime

Correct Incorrect Correct answer

The Linux kernel layer

Correct Incorrect Correct answer

The hardware abstraction layer

Correct Incorrect Correct answer

The native libraries layer

Correct Incorrect Correct answer

Question 125 of 562

Which set does the courseware give as the drivers in the kernel layer?

Audio, binder, display, keypad, Bluetooth, camera, shared memory, serial bus, wireless, and flash memory drivers

Correct Incorrect Correct answer

Audio, camera, Bluetooth, and sensor modules

Correct Incorrect Correct answer

Content, view, activity, and location drivers

Correct Incorrect Correct answer

Boot, system, recovery, and cache drivers which are the partitions of the file system rather than kernel components

Correct Incorrect Correct answer

Question 126 of 562

Which four functions does the courseware attribute to the kernel layer?

Compilation, garbage collection, preloading, and forking

Correct Incorrect Correct answer

Display, audio, camera, and sensor management

Correct Incorrect Correct answer

Activity, window, package, and resource management as the courseware lists them

Correct Incorrect Correct answer

Memory management, power management, security management, and networking

Correct Incorrect Correct answer

Question 127 of 562

What happens in the first step of the boot sequence on the open platform?

The boot loader sets up the network and memory services and hands control to the kernel when they are ready

Correct Incorrect Correct answer

The kernel initializes the interrupt controllers and caches

Correct Incorrect Correct answer

The init process mounts the system directories

Correct Incorrect Correct answer

The boot read-only memory code is activated, loads the boot loader into device memory, and starts execution

Correct Incorrect Correct answer

Question 128 of 562

What does the boot loader do in the second step of the boot sequence?

It launches the first user space process

Correct Incorrect Correct answer

It preloads and initializes the core library classes

Correct Incorrect Correct answer

It sets up the essential services such as network and memory that are required to start the kernel

Correct Incorrect Correct answer

It loads the boot read-only memory code into device memory before the manufacturer locks are applied to the device

Correct Incorrect Correct answer

Question 129 of 562

Where does the boot loader sit within the platform source tree?

Under the recovery partition

Correct Incorrect Correct answer

Under bootable, then bootloader, then legacy, then the loader directory

Correct Incorrect Correct answer

Under system, then core, then init

Correct Incorrect Correct answer

Under the root directory of the device beside the mounted system partitions

Correct Incorrect Correct answer

Question 130 of 562

Why do original equipment manufacturers customize the boot loader?

To put their own locks and restrictions on a device

Correct Incorrect Correct answer

To speed up the boot sequence

Correct Incorrect Correct answer

To reduce the size of the operating system

Correct Incorrect Correct answer

To allow the device to run without a kernel

Correct Incorrect Correct answer

Question 131 of 562

What does the kernel do in the third step of the boot sequence?

It initializes as the Linux kernel does, setting up interrupt controllers, memory protections, caches, and scheduling, then launches the first user process

Correct Incorrect Correct answer

It loads the boot loader into memory and starts executing it from the reset vector of the processor before any user process is started

Correct Incorrect Correct answer

It preloads the core library classes

Correct Incorrect Correct answer

It launches the system server

Correct Incorrect Correct answer

Question 132 of 562

What is the init process, and what appears while it runs?

It is the boot loader, and the manufacturer logo appears

Correct Incorrect Correct answer

It is the kernel, and a blank screen appears

Correct Incorrect Correct answer

It is the system server, and the home screen appears once every service initialized by that server is running

Correct Incorrect Correct answer

It is the first user process and the parent of all processes, and the platform logo appears on the screen

Correct Incorrect Correct answer

Question 133 of 562

What is the init process responsible for?

Loading the boot loader from the read-only memory

Correct Incorrect Correct answer

Forking a virtual machine for each launched application

Correct Incorrect Correct answer

Mounting directories such as the system, device, and process directories, and running the startup script

Correct Incorrect Correct answer

Setting up the interrupt controllers and memory protections before any user space process has been launched

Correct Incorrect Correct answer

Question 134 of 562

What does the startup script describe?

The drivers loaded by the kernel

Correct Incorrect Correct answer

The system services, the file system, and the other parameters that must be set up

Correct Incorrect Correct answer

The partitions of the file system and their mount points only as the kernel established them

Correct Incorrect Correct answer

The applications installed on the device

Correct Incorrect Correct answer

Question 135 of 562

What does the fifth step of the boot sequence initialize?

The boot loader locks set by the manufacturer which the boot loader applies before the system loads

Correct Incorrect Correct answer

The boot-time virtual machine process, which preloads and initializes the core library classes

Correct Incorrect Correct answer

The system server and its services

Correct Incorrect Correct answer

The kernel scheduler and caches

Correct Incorrect Correct answer

Question 136 of 562

Why does the platform use a boot-time virtual machine process rather than starting a fresh machine for each app?

Because launching several applications would otherwise create several virtual machine instances and consume extensive memory and time

Correct Incorrect Correct answer

Because the kernel cannot create more than one process beyond the one that mounts the system directories

Correct Incorrect Correct answer

Because the runtime does not support compilation

Correct Incorrect Correct answer

Because the applications share a single memory space

Correct Incorrect Correct answer

Question 137 of 562

What does the boot-time virtual machine process do when a new application is launched?

It compiles the application ahead of time and caches the result

Correct Incorrect Correct answer

It loads the application into the existing system server process

Correct Incorrect Correct answer

It restarts the runtime so the app can claim the whole memory so that the newly launched app runs without competition

Correct Incorrect Correct answer

It forks a new virtual machine and runs the app in its sandboxed environment, providing a pre-warmed instance that reduces startup time

Correct Incorrect Correct answer

Question 138 of 562

What happens in the sixth step of the boot sequence, and when is the boot complete?

The boot loader hands control to the kernel, and the boot completes when the logo appears on the screen of the device

Correct Incorrect Correct answer

The init process mounts the directories, and the boot completes when the script finishes

Correct Incorrect Correct answer

The runtime requests the boot-time process to launch the system server, and the boot completes when all services are up and running

Correct Incorrect Correct answer

The kernel mounts the file system, and the boot completes when the home screen appears

Correct Incorrect Correct answer

Question 139 of 562

Which services does the system server initialize?

The audio, camera, and sensor modules

Correct Incorrect Correct answer

The interrupt controllers, caches, and scheduler

Correct Incorrect Correct answer

The power manager, the battery service, and the Bluetooth service

Correct Incorrect Correct answer

The content provider, the view system, and the activity manager

Correct Incorrect Correct answer

Question 140 of 562

Which component is the first written in the Java language to launch during the boot sequence?

The boot loader

Correct Incorrect Correct answer

The system server

Correct Incorrect Correct answer

The boot-time virtual machine process

Correct Incorrect Correct answer

The init process

Correct Incorrect Correct answer

Question 141 of 562

Which devices does the closed mobile platform support?

The phone, the media player, the tablet, and the television box of its vendor

Correct Incorrect Correct answer

Any device whose manufacturer licenses the platform under a distribution agreement with that vendor

Correct Incorrect Correct answer

Only the phone and the tablet

Correct Incorrect Correct answer

Only devices sold through a carrier

Correct Incorrect Correct answer

Question 142 of 562

What role does the closed platform play at the highest level?

It acts as a boot loader for the device firmware and hands control to the kernel once the checks have passed

Correct Incorrect Correct answer

It acts as a driver layer beneath the kernel

Correct Incorrect Correct answer

It acts as a store front for applications

Correct Incorrect Correct answer

It acts as an intermediary between apps and the underlying hardware, with apps communicating through well-defined system interfaces

Correct Incorrect Correct answer

Question 143 of 562

On what concept is the user interface of the closed platform based?

Command entry through a shell

Correct Incorrect Correct answer

Menu navigation with hardware keys

Correct Incorrect Correct answer

Voice control alone

Correct Incorrect Correct answer

Direct manipulation, using multi-touch gestures

Correct Incorrect Correct answer

Question 144 of 562

Which five layers make up the architecture of the closed platform?

Presentation, session, transport, network, and link

Correct Incorrect Correct answer

Boot, recovery, system, data, and cache

Correct Incorrect Correct answer

The application layer, the media layer, the core services layer, the core operating system layer, and the kernel and device drivers layer

Correct Incorrect Correct answer

System apps, framework, native libraries, runtime, and kernel which are the sections of the stack on the other mobile platform as the vendor documents them

Correct Incorrect Correct answer

Question 145 of 562

Which layer holds the frameworks that define the appearance of apps and support push notifications and multitasking?

The core operating system layer

Correct Incorrect Correct answer

The application layer

Correct Incorrect Correct answer

The media layer

Correct Incorrect Correct answer

The core services layer

Correct Incorrect Correct answer

Question 146 of 562

Which layer contains the graphics, audio, and video technologies that enable multimedia experiences?

The media layer

Correct Incorrect Correct answer

The application layer

Correct Incorrect Correct answer

The core services layer

Correct Incorrect Correct answer

The kernel and device drivers layer

Correct Incorrect Correct answer

Question 147 of 562

Which layer holds the foundation frameworks that define the basic types all apps use?

The core services layer

Correct Incorrect Correct answer

The application layer

Correct Incorrect Correct answer

The core operating system layer

Correct Incorrect Correct answer

The media layer

Correct Incorrect Correct answer

Question 148 of 562

Which layer holds the low-level features useful when dealing with security or external hardware and networks?

The core services layer

Correct Incorrect Correct answer

The media layer

Correct Incorrect Correct answer

The application layer

Correct Incorrect Correct answer

The core operating system layer

Correct Incorrect Correct answer

Question 149 of 562

What does the lowest layer of the closed platform architecture include?

The graphics, audio, and video technologies

Correct Incorrect Correct answer

The application frameworks and push notification support

Correct Incorrect Correct answer

The kernel, the drivers, the operating system distribution, the file systems, and infrastructure technologies such as networking

Correct Incorrect Correct answer

The foundation frameworks and the basic types that every app on the device uses to declare its data

Correct Incorrect Correct answer

Question 150 of 562

Which two boot modes does the closed platform offer the investigator?

The tethered mode and the untethered mode

Correct Incorrect Correct answer

The device firmware upgrade mode and the recovery mode

Correct Incorrect Correct answer

The safe mode and the diagnostic mode

Correct Incorrect Correct answer

The download mode and the fastboot mode in the release under examination

Correct Incorrect Correct answer

Question 151 of 562

What is the device firmware upgrade mode?

A diagnostic build of the operating system

Correct Incorrect Correct answer

Part of the boot read-only memory written into the hardware, which allows all devices to be restored from any state

Correct Incorrect Correct answer

A recovery partition holding a signed image

Correct Incorrect Correct answer

A service mode enabled from the settings menu once the developer options have been unlocked on the handset as the vendor describes it

Correct Incorrect Correct answer

Question 152 of 562

What information can be retrieved from the firmware upgrade mode?

The device model and the exclusive or unique chip identifier

Correct Incorrect Correct answer

The full contents of the user data partition in the toolkit output

Correct Incorrect Correct answer

The passcode of the device

Correct Incorrect Correct answer

The cloud backups of the account

Correct Incorrect Correct answer

Question 153 of 562

What forensic importance does the courseware attach to the firmware upgrade mode?

It allows the full file system to be imaged without a jailbreak and returns the entire user data partition to the examiner

Correct Incorrect Correct answer

It allows the passcode to be reset without data loss

Correct Incorrect Correct answer

It allows cloud backups to be downloaded

Correct Incorrect Correct answer

It allows extraction of device information without cracking the passcode, and bypasses the restricted bus mode while granting limited information

Correct Incorrect Correct answer

Question 154 of 562

What is the recovery mode of the closed platform?

The mode entered when the device battery is exhausted and cannot be entered while the charger is connected or while it is charging from the workstation

Correct Incorrect Correct answer

The mode used when the device is jailbroken

Correct Incorrect Correct answer

The second-stage loader, which boots a device into the loader used to upgrade it to a new version of the operating system

Correct Incorrect Correct answer

The mode written into the boot read-only memory

Correct Incorrect Correct answer

Question 155 of 562

Which set of information does the recovery mode retrieve?

The passcode and the encryption keys

Correct Incorrect Correct answer

The call history and the message database

Correct Incorrect Correct answer

The device model, the chip identifier, the serial number, and the equipment identity number

Correct Incorrect Correct answer

The device model and the chip identifier only and nothing further about the state of the handset

Correct Incorrect Correct answer

Question 156 of 562

What does the courseware say about the recovery mode on newer processors?

It requires the passcode on newer processors

Correct Incorrect Correct answer

It provides more information than the firmware upgrade mode

Correct Incorrect Correct answer

It provides less information than the firmware upgrade mode

Correct Incorrect Correct answer

It is unavailable on newer processors

Correct Incorrect Correct answer

Question 157 of 562

What order of checks does the courseware give for booting in the firmware upgrade mode?

The boot memory signature checks the second stage loaders, those loaders check the kernel, and the kernel checks the memory disk

Correct Incorrect Correct answer

The kernel checks the boot memory, which checks the loaders, which check the memory disk before any of it is loaded into memory

Correct Incorrect Correct answer

The memory disk checks the kernel, which checks the loaders

Correct Incorrect Correct answer

The loaders check the boot memory, which checks the kernel

Correct Incorrect Correct answer

Question 158 of 562

What is the main reason a device is connected in the firmware upgrade mode?

To charge the device without it booting

Correct Incorrect Correct answer

To pair the device with a forensic workstation so that a backup can be taken over the bus cable before the media application will list it

Correct Incorrect Correct answer

To reset the passcode of the device

Correct Incorrect Correct answer

To change the firmware, which lets users downgrade the system or use custom firmware, and is generally used for jailbreaking or unlocking

Correct Incorrect Correct answer

Question 159 of 562

How does the examiner know a device has entered the firmware upgrade mode?

The device shows the vendor logo on a white background and then displays a progress bar while it connects

Correct Incorrect Correct answer

The device vibrates twice and shows a progress bar

Correct Incorrect Correct answer

The device displays the firmware version on screen

Correct Incorrect Correct answer

The screen remains black, and the desktop media application reports that it has detected a device in recovery mode

Correct Incorrect Correct answer

Question 160 of 562

Which sequence boots a device into the firmware upgrade mode on the later processors?

Hold volume up and volume down together while connecting the cable

Correct Incorrect Correct answer

Hold the side button alone until the vendor logo appears

Correct Incorrect Correct answer

Connect by cable, press and release volume up, press and release volume down, hold the side button until the screen blacks, then hold side and volume down five seconds

Correct Incorrect Correct answer

Connect by cable, press and release volume up, then press and hold the side button until the mode is reached and is released only when the vendor logo appears again

Correct Incorrect Correct answer

Question 161 of 562

Which sequence boots a device into recovery mode on the later processors?

Press and release the side button three times

Correct Incorrect Correct answer

Connect to the computer and open the media application, press and release volume up followed by volume down, then hold the side button until the device enters the mode

Correct Incorrect Correct answer

Press and hold volume down while connecting the cable

Correct Incorrect Correct answer

Hold side and volume down together for five seconds while the media application on the computer is closed and the cable disconnected from the workstation and the screen watched for a change

Correct Incorrect Correct answer

Question 162 of 562

Why does the courseware note that both boot procedures may differ from the ones it gives?

Because the boot process of both modes varies depending on the processor used in the device

Correct Incorrect Correct answer

Because the procedures depend on the carrier of the device

Correct Incorrect Correct answer

Because the procedures depend on the version of the desktop application rather than on the hardware inside the handset

Correct Incorrect Correct answer

Because the procedures depend on whether the device is jailbroken

Correct Incorrect Correct answer

Question 163 of 562

How does the courseware describe the file system of the open platform?

Disk-based, sharing similarities with Linux because it is built on that kernel, with internal and external storage areas

Correct Incorrect Correct answer

Object-based, with no directory hierarchy

Correct Incorrect Correct answer

Network-based, with all data held on the carrier servers and nothing at all held on the device itself

Correct Incorrect Correct answer

Flat, with every file in a single directory

Correct Incorrect Correct answer

Question 164 of 562

What does internal storage hold on a device of the open platform?

Only the applications installed by the user

Correct Incorrect Correct answer

Only the media files created by the camera and nothing belonging to the platform itself

Correct Incorrect Correct answer

Only the temporary files of the system

Correct Incorrect Correct answer

The operating system, application data, caches, and user files, in built-in non-volatile memory

Correct Incorrect Correct answer

Question 165 of 562

How does the courseware describe external storage?

The read-only memory soldered to the board

Correct Incorrect Correct answer

The memory of the subscriber card

Correct Incorrect Correct answer

Physically mountable storage such as a card inserted into its slot, or drives connected to the bus port using on-the-go cables

Correct Incorrect Correct answer

Storage rented from a cloud service provider and reached only while the device holds a network connection that the operator of that service provides

Correct Incorrect Correct answer

Question 166 of 562

Which six partitions does the courseware say every device of the open platform carries?

Internal, external, cloud, and subscriber

Correct Incorrect Correct answer

Boot, system, recovery, data, cache, and miscellaneous

Correct Incorrect Correct answer

Boot, system, recovery, data, card, and extended card

Correct Incorrect Correct answer

Root, applications, user data, system files, and temporary

Correct Incorrect Correct answer

Question 167 of 562

Which two additional partitions do some devices of the open platform carry?

The system and data partitions

Correct Incorrect Correct answer

The card partition and the extended card partition

Correct Incorrect Correct answer

The boot and recovery partitions

Correct Incorrect Correct answer

The cache and miscellaneous partitions which are two of the primary six

Correct Incorrect Correct answer

Question 168 of 562

Which partition holds the boot image and kernel, without which the device cannot start?

The boot partition

Correct Incorrect Correct answer

The system partition

Correct Incorrect Correct answer

The recovery partition

Correct Incorrect Correct answer

The miscellaneous partition

Correct Incorrect Correct answer

Question 169 of 562

Which partition holds the entire operating system, its interface components, and the pre-installed applications?

The boot partition

Correct Incorrect Correct answer

The data partition

Correct Incorrect Correct answer

The cache partition

Correct Incorrect Correct answer

The system partition

Correct Incorrect Correct answer

Question 170 of 562

Which partition is dedicated to back-up, wiping, restoring, software updates, and factory resetting?

The miscellaneous partition

Correct Incorrect Correct answer

The system partition

Correct Incorrect Correct answer

The recovery partition

Correct Incorrect Correct answer

The boot partition

Correct Incorrect Correct answer

Question 171 of 562

Which partition holds all app and user data, and is wiped by a factory reset?

The card partition

Correct Incorrect Correct answer

The system partition

Correct Incorrect Correct answer

The data partition

Correct Incorrect Correct answer

The cache partition

Correct Incorrect Correct answer

Question 172 of 562

Which partition holds the temporary files generated by both the operating system and applications?

The recovery partition

Correct Incorrect Correct answer

The cache partition

Correct Incorrect Correct answer

The data partition

Correct Incorrect Correct answer

The miscellaneous partition

Correct Incorrect Correct answer

Question 173 of 562

Which partition holds carrier details, hardware settings, configurations, the boot loader state, and the device lock state?

The miscellaneous partition

Correct Incorrect Correct answer

The system partition

Correct Incorrect Correct answer

The boot partition

Correct Incorrect Correct answer

The data partition

Correct Incorrect Correct answer

Question 174 of 562

What else does the miscellaneous partition hold?

The recovery image used to restore the device

Correct Incorrect Correct answer

The cached files of the installed applications

Correct Incorrect Correct answer

The encryption keys of the user data partition which are held by the system rather than in that partition

Correct Incorrect Correct answer

The over-the-air update data that keeps the device current with the latest version

Correct Incorrect Correct answer

Question 175 of 562

Which partition does the internal storage often emulate, and what is it the default location for?

The extended card partition, which is the default location for system files

Correct Incorrect Correct answer

The cache partition, which is the default location for temporary files

Correct Incorrect Correct answer

The data partition, which is the default location for the operating system

Correct Incorrect Correct answer

The card partition, which is the default location for application-generated data

Correct Incorrect Correct answer

Question 176 of 562

When is memory allocated for the extended card partition?

When the internal storage is formatted

Correct Incorrect Correct answer

When the device is rooted

Correct Incorrect Correct answer

When an external device such as a memory card is connected to the device

Correct Incorrect Correct answer

When the device is first powered on and formatted along with the internal storage

Correct Incorrect Correct answer

Question 177 of 562

What replaced the previous file system of the closed platform, and when?

The extended file system, introduced in version eleven

Correct Incorrect Correct answer

The Apple file system, introduced in version ten point three

Correct Incorrect Correct answer

The hierarchical file system, introduced in version ten point three

Correct Incorrect Correct answer

The Apple file system, introduced in version nine

Correct Incorrect Correct answer

Question 178 of 562

Which features does the courseware attribute to the file system of the closed platform?

Strong encryption, space sharing, cloning for files and directories, and snapshot capabilities for system state restoration

Correct Incorrect Correct answer

Journalling, compression, deduplication, and quotas

Correct Incorrect Correct answer

Wear levelling, garbage collection, and translation layers which are the flash memory concepts named for the hardware techniques

Correct Incorrect Correct answer

Sandboxing, permissions, and restricted access

Correct Incorrect Correct answer

Question 179 of 562

How is the file system of the closed platform organized?

In a pyramid-like or tree-like form with the root directory at the top, then applications, user data, and system files

Correct Incorrect Correct answer

In six primary partitions and two additional ones

Correct Incorrect Correct answer

As a flat namespace of application containers

Correct Incorrect Correct answer

As a set of volumes managed by the carrier and mounted for the user when the device registers on the network

Correct Incorrect Correct answer

Question 180 of 562

Which key directory contains all built-in and third-party apps?

The library directory

Correct Incorrect Correct answer

The user utilities directory

Correct Incorrect Correct answer

The variable data directory

Correct Incorrect Correct answer

The applications directory

Correct Incorrect Correct answer

Question 181 of 562

Which key directory holds various system files and preferences?

The temporary directory

Correct Incorrect Correct answer

The variable data directory

Correct Incorrect Correct answer

The library directory

Correct Incorrect Correct answer

The applications directory

Correct Incorrect Correct answer

Question 182 of 562

Which key directory includes user-related utilities and applications?

The temporary directory

Correct Incorrect Correct answer

The user utilities directory

Correct Incorrect Correct answer

The applications directory

Correct Incorrect Correct answer

The library directory

Correct Incorrect Correct answer

Question 183 of 562

Which key directory contains variable data such as logs and temporary files?

The user utilities directory

Correct Incorrect Correct answer

The variable data directory

Correct Incorrect Correct answer

The temporary directory

Correct Incorrect Correct answer

The library directory

Correct Incorrect Correct answer

Question 184 of 562

Which key directory holds files that get cleared on reboot?

The temporary directory

Correct Incorrect Correct answer

The variable data directory

Correct Incorrect Correct answer

The library directory

Correct Incorrect Correct answer

The applications directory

Correct Incorrect Correct answer

Question 185 of 562

What does sandboxing provide on the closed platform?

A backup of the app data taken before each update and restored automatically if that update fails

Correct Incorrect Correct answer

A shared area in which apps exchange data freely

Correct Incorrect Correct answer

A restricted network path for app traffic

Correct Incorrect Correct answer

An extra layer of security, ensuring each app operates independently without interfering with other apps or the system

Correct Incorrect Correct answer

Question 186 of 562

What does app isolation mean on the closed platform?

Each app is stored in its own encrypted partition

Correct Incorrect Correct answer

Each app is signed by a different developer certificate issued by the vendor when the app is submitted to the store before it is released to the public

Correct Incorrect Correct answer

Each app operates in a sandbox limiting its access to the file system and other apps, and cannot reach the data of other apps unless explicitly permitted

Correct Incorrect Correct answer

Each app runs on a separate processor core

Correct Incorrect Correct answer

Question 187 of 562

What must apps do before reaching certain data or system capabilities?

Be granted root access by the user

Correct Incorrect Correct answer

Register the request with the cloud service

Correct Incorrect Correct answer

Request permission to access data such as photos, contacts, or location

Correct Incorrect Correct answer

Obtain approval from the carrier of the device before any sensitive data may be read

Correct Incorrect Correct answer

Question 188 of 562

What does the courseware say about access to the file system by regular users and apps?

They may write to the system files after granting permission

Correct Incorrect Correct answer

They do not have root access, access is tightly controlled, and system files are hidden from the user

Correct Incorrect Correct answer

They have full read and write access to every directory including the system files that hold the platform itself

Correct Incorrect Correct answer

They may read but not write the system files

Correct Incorrect Correct answer

Question 189 of 562

What does the courseware say about users who jailbreak their devices to remove the access restrictions?

It can compromise the security and stability of the device

Correct Incorrect Correct answer

It has no effect on the device beyond the restrictions removed

Correct Incorrect Correct answer

It transfers the warranty to the jailbreak provider

Correct Incorrect Correct answer

It encrypts the system partition

Correct Incorrect Correct answer

Question 190 of 562

What does the system partition of the closed platform contain?

The user data and the downloaded apps

Correct Incorrect Correct answer

The temporary files cleared on reboot

Correct Incorrect Correct answer

The cloud backups of the account

Correct Incorrect Correct answer

The platform itself and the built-in apps

Correct Incorrect Correct answer

Question 191 of 562

What does the data partition of the closed platform hold, and why is it separate?

The operating system and built-in apps, kept apart for faster updates which is the other partition of the pair

Correct Incorrect Correct answer

The recovery images, kept apart so they cannot be erased

Correct Incorrect Correct answer

The encryption keys, kept apart so they cannot be read

Correct Incorrect Correct answer

User data, app data, and downloaded apps, kept apart from system files for security and stability

Correct Incorrect Correct answer

Question 192 of 562

What does the cloud backup of the closed platform include?

Only the contacts and the calendar

Correct Incorrect Correct answer

The system partition and the built-in apps

Correct Incorrect Correct answer

App data, device settings, and personal files

Correct Incorrect Correct answer

Only the photographs held on the device

Correct Incorrect Correct answer

Question 193 of 562

How does the courseware say a device of the closed platform is backed up to a computer?

Using a memory card inserted into the device which those devices do not accept at all

Correct Incorrect Correct answer

Using the media application, or the file browser on the newer desktop systems

Correct Incorrect Correct answer

Using the recovery partition of the device

Correct Incorrect Correct answer

Using the cloud service as an intermediary

Correct Incorrect Correct answer

Question 194 of 562

How does the courseware define the mobile forensics process?

A structured approach to recovering, analysing, and presenting data from mobile devices in a legally admissible way

Correct Incorrect Correct answer

The sequence of commands used to image a mobile device once the device has reached the forensic workstation

Correct Incorrect Correct answer

The chain of custody form used for mobile evidence

Correct Incorrect Correct answer

The set of tools approved for mobile examination

Correct Incorrect Correct answer

Question 195 of 562

Why does the courseware insist that mobile evidence be collected carefully?

Because the devices are fragile and break easily

Correct Incorrect Correct answer

Because the evidence must be returned to the owner within a fixed period

Correct Incorrect Correct answer

Because the tools cannot read a device twice

Correct Incorrect Correct answer

Because digital evidence on mobile devices can be easily altered, deleted, or destroyed

Correct Incorrect Correct answer

Question 196 of 562

What is the debugging mode on the open platform?

A service mode enabled by the carrier

Correct Incorrect Correct answer

A restricted mode that blocks new data connections

Correct Incorrect Correct answer

A developer feature activated from the developer options menu, allowing the device to communicate with a workstation running the developer kit

Correct Incorrect Correct answer

A boot mode that loads a diagnostic kernel and hands the examiner a shell before the platform starts in place of the ordinary user interface

Correct Incorrect Correct answer

Question 197 of 562

Which path enables the debugging mode on version nine and higher?

Settings, then applications, then permissions

Correct Incorrect Correct answer

Settings, then system, then advanced, then developer options, then the debugging entry

Correct Incorrect Correct answer

Settings, then security, then developer options

Correct Incorrect Correct answer

Settings, then about phone, then build number which reveals the developer options rather than the debugging entry

Correct Incorrect Correct answer

Question 198 of 562

What does the restricted bus mode do on the closed platform?

It wipes the device after ten failed passcode attempts

Correct Incorrect Correct answer

It allows no new data connections once an hour has passed since the last one, until the device is unlocked

Correct Incorrect Correct answer

It blocks all wireless connections while the device is locked until the passcode has been entered on the screen again

Correct Incorrect Correct answer

It disables the charging port entirely

Correct Incorrect Correct answer

Question 199 of 562

What two options does the courseware give for collecting evidence once the restricted bus mode is active?

Enter the firmware upgrade mode, or install a jailbreak

Correct Incorrect Correct answer

Contact the vendor, or contact the carrier

Correct Incorrect Correct answer

Replace the cable, or replace the battery

Correct Incorrect Correct answer

Boot into recovery mode, or perform a factory reset

Correct Incorrect Correct answer

Question 200 of 562

Why does the courseware tell investigators to use appropriate cables at the crime scene?

To avoid draining the battery of the device

Correct Incorrect Correct answer

To keep the device from pairing with the wrong workstation

Correct Incorrect Correct answer

To stop the device from installing an update

Correct Incorrect Correct answer

To prevent the device from entering the restricted bus mode

Correct Incorrect Correct answer

Question 201 of 562

What is the first step in collecting a mobile device?

Obtain the passcode from the owner

Correct Incorrect Correct answer

Place the device in a signal containment bag at the scene of the seizure

Correct Incorrect Correct answer

Check whether the mobile device is connected to a computer

Correct Incorrect Correct answer

Confirm the power state of the device

Correct Incorrect Correct answer

Question 202 of 562

What is the second step in collecting a mobile device?

Photograph the display of the device

Correct Incorrect Correct answer

Remove the subscriber card

Correct Incorrect Correct answer

Confirm the power state of the device

Correct Incorrect Correct answer

Check whether the device is connected to a computer

Correct Incorrect Correct answer

Question 203 of 562

What does the courseware say to do with a device found powered on and unlocked?

Remove the battery to freeze its state

Correct Incorrect Correct answer

Enable the stay awake setting to keep it active, and connect it to a power source to charge it

Correct Incorrect Correct answer

Connect it to a power source only, without changing any setting and leave the screen to time out as it normally would

Correct Incorrect Correct answer

Turn it off so that no further changes occur

Correct Incorrect Correct answer

Question 204 of 562

What does the courseware say to do with a device found powered on but locked?

Connect it to a power source to ensure that it does not shut down

Correct Incorrect Correct answer

Enable the stay awake setting from the developer options

Correct Incorrect Correct answer

Turn it off until a warrant is obtained

Correct Incorrect Correct answer

Place it in airplane mode and remove the card before it is carried to the forensic laboratory

Correct Incorrect Correct answer

Question 205 of 562

What does the courseware say to do with a device found powered off?

Turn it on immediately to capture volatile data

Correct Incorrect Correct answer

Turn it on only after placing it in a shielded bag and photographing the screen as it starts

Correct Incorrect Correct answer

Connect it to a power source and let it boot

Correct Incorrect Correct answer

Leave it in the turned-off state, because turning it on could alter the evidence

Correct Incorrect Correct answer

Question 206 of 562

What does the courseware say about obtaining the passcode at the scene?

The passcode may only ever be obtained under a warrant even where the owner is present and offers it freely and never on the strength of consent alone

Correct Incorrect Correct answer

The passcode must be requested from the carrier

Correct Incorrect Correct answer

The passcode may be bypassed without any legal step

Correct Incorrect Correct answer

If the owner is present the agents may obtain it from them, and if they refuse the investigators get a warrant and proceed legally

Correct Incorrect Correct answer

Question 207 of 562

What caveat does the courseware attach to the collection procedure?

The procedure applies only where the owner is absent

Correct Incorrect Correct answer

The procedure must be repeated for every application on the device in which the seizure was made

Correct Incorrect Correct answer

The laws involving mobile device forensic investigation may vary depending on the jurisdiction

Correct Incorrect Correct answer

The procedure applies only to devices of the open platform

Correct Incorrect Correct answer

Question 208 of 562

Why does the courseware tell investigators not to remove the subscriber card from a locked device of the closed platform?

Because the card is needed to charge the device

Correct Incorrect Correct answer

Because removing it could lock the device, disable the biometric unlock feature, and activate the restricted bus mode

Correct Incorrect Correct answer

Because the card holds the only copy of the message database that the examiner will need for the report

Correct Incorrect Correct answer

Because removing it voids the warranty of the device

Correct Incorrect Correct answer

Question 209 of 562

How many attempts do the fingerprint and face identification features allow before the passcode is required?

Five

Correct Incorrect Correct answer

Three

Correct Incorrect Correct answer

Ten

Correct Incorrect Correct answer

One

Correct Incorrect Correct answer

Question 210 of 562

Why does the courseware say data acquisition becomes difficult once a device of the closed platform is powered off?

The encryption keys are wiped from memory, the before-first-unlock state applies, and the lockdown records become useless

Correct Incorrect Correct answer

The device requires a firmware update before it will connect

Correct Incorrect Correct answer

The device erases its user data on the next boot and cannot be stopped once the device is started

Correct Incorrect Correct answer

The device disables its bus port permanently

Correct Incorrect Correct answer

Question 211 of 562

What do the lockdown records allow an investigator to do?

Reset the passcode of the device without data loss while it is connected to the workstation

Correct Incorrect Correct answer

Decrypt the cloud backups of the account

Correct Incorrect Correct answer

Bypass the biometric attempt limit

Correct Incorrect Correct answer

Perform logical acquisition on a powered-on and locked device of the closed platform

Correct Incorrect Correct answer

Question 212 of 562

Which two tools does the courseware name as able to import lockdown files from a suspect phone?

A cloud explorer and a mobile evidence suite

Correct Incorrect Correct answer

A repository extractor and an app manager

Correct Incorrect Correct answer

A forensic product from one vendor and a platform forensic toolkit from another

Correct Incorrect Correct answer

A screen unlocking suite and a rooting tool which remove locks rather than reading the records

Correct Incorrect Correct answer

Question 213 of 562

Why is evidence documented during the mobile forensics process?

To register the case with the service provider

Correct Incorrect Correct answer

To maintain a chain of custody that can be used as reference in the court of law

Correct Incorrect Correct answer

To satisfy the terms of service of the device vendor

Correct Incorrect Correct answer

To allow the device to be returned to the owner sooner once the examination has been completed

Correct Incorrect Correct answer

Question 214 of 562

What does phone identification record first?

The account credentials of the owner

Correct Incorrect Correct answer

All information on the display, photographed if possible, and the date and time when the device was collected

Correct Incorrect Correct answer

The full contents of the message database together with the attachments that travelled with each message at the time of the seizure

Correct Incorrect Correct answer

The list of installed applications

Correct Incorrect Correct answer

Question 215 of 562

What else does phone identification record?

The physical condition of the phone, and pictures of the subscriber card and memory card with their identifying information

Correct Incorrect Correct answer

The purchase price and the retailer

Correct Incorrect Correct answer

The signal strength at the time of seizure

Correct Incorrect Correct answer

The battery percentage at the time of seizure and the time remaining before the device would have shut down

Correct Incorrect Correct answer

Question 216 of 562

Why does the courseware say the phone should be identified by its brand, model, operating system, and service provider?

Because that information is required on the warrant

Correct Incorrect Correct answer

Because the manufacturer must be notified of the seizure

Correct Incorrect Correct answer

Because the provider will not release records without it once the request has been made in writing

Correct Incorrect Correct answer

Because that information helps in selecting the appropriate tools for the acquisition process

Correct Incorrect Correct answer

Question 217 of 562

Where does the courseware say the identifying information of a phone can be found?

Only in the settings menu of the operating system while the device is still powered on and unlocked and the developer options have been turned on

Correct Incorrect Correct answer

Only on the invoice held by the carrier

Correct Incorrect Correct answer

In the battery cavity, on the subscriber card, or on the board under the battery, whose label carries model, type, code, equipment identity, and commission identifier

Correct Incorrect Correct answer

Only on the retail packaging of the device

Correct Incorrect Correct answer

Question 218 of 562

Which three connection routes does the courseware give between the phone and the forensic workstation?

A cable or a memory card only

Correct Incorrect Correct answer

Wireless networking or the cloud service

Correct Incorrect Correct answer

A cable, infrared, or Bluetooth

Correct Incorrect Correct answer

A cable, wireless networking, or the cellular network

Correct Incorrect Correct answer

Question 219 of 562

What does the choice of connection type depend on?

The carrier and the account status

Correct Incorrect Correct answer

The phone itself, the tool being used, and the acquisition conditions

Correct Incorrect Correct answer

The jurisdiction and the warrant

Correct Incorrect Correct answer

The battery level and the signal strength measured at the moment of seizure

Correct Incorrect Correct answer

Question 220 of 562

Why must mobile devices be protected from signal interruption?

Because signal interruption might lead to data overwriting

Correct Incorrect Correct answer

Because the radio drains the battery quickly

Correct Incorrect Correct answer

Because incoming calls interrupt the acquisition tool

Correct Incorrect Correct answer

Because the carrier records the location of the device

Correct Incorrect Correct answer

Question 221 of 562

How does the courseware say signals are excluded from a seized device?

Remove the subscriber card and the battery

Correct Incorrect Correct answer

Power the device off and seal it in an envelope marked with the case number and the date

Correct Incorrect Correct answer

Connect the device to a private wireless network

Correct Incorrect Correct answer

Enable airplane mode where possible, and store the device in signal containment devices and bags

Correct Incorrect Correct answer

Question 222 of 562

What does a Faraday bag do?

It cushions the device against physical damage

Correct Incorrect Correct answer

It maintains a constant temperature around the device

Correct Incorrect Correct answer

It charges the device while it is sealed through an induction coil built into the fabric

Correct Incorrect Correct answer

It blocks external signals from interacting with the phone, preventing remote communications that might alter the data

Correct Incorrect Correct answer

Question 223 of 562

What does the signal disruption bag do?

It records the signals the device attempts to send

Correct Incorrect Correct answer

It powers the device down when a signal arrives so that no further change can occur on the device

Correct Incorrect Correct answer

It prevents any type of signal from reaching the device and stops the changes that receiving a signal would cause

Correct Incorrect Correct answer

It emits a jamming signal around the device

Correct Incorrect Correct answer

Question 224 of 562

What are arson cans in the context of mobile forensics?

Containers used to hold chemicals during chip cleaning

Correct Incorrect Correct answer

Sturdy containers, also called evidence cans, used to store and protect devices kept as evidence

Correct Incorrect Correct answer

Sealed bags that block radio frequency signals only and offer no physical protection at all

Correct Incorrect Correct answer

Cases used to transport chip-off equipment

Correct Incorrect Correct answer

Question 225 of 562

Which three uses does the courseware give for arson cans during mobile forensics?

Protection from external factors, prevention of tampering, and signal blocking where they are so designed

Correct Incorrect Correct answer

Charging, cooling, and shielding

Correct Incorrect Correct answer

Transport, storage, and disposal

Correct Incorrect Correct answer

Imaging, hashing, and sealing which are the steps of the examination rather than the uses of the container

Correct Incorrect Correct answer

Question 226 of 562

How many layers of aluminium foil does the courseware say a device is wrapped in?

Three

Correct Incorrect Correct answer

One

Correct Incorrect Correct answer

Two

Correct Incorrect Correct answer

Five

Correct Incorrect Correct answer

Question 227 of 562

What distinguishes the shielded forensic pouches from the other containment options?

They are the only option that blocks signals completely

Correct Incorrect Correct answer

They are the only option that can be sealed once the device has been placed inside and the closure fastened with a numbered tamper-evident tag

Correct Incorrect Correct answer

They are the only option approved for transport

Correct Incorrect Correct answer

They preserve devices in a radio frequency tight environment from the moment of capture and include a bus connector for fast and secure extraction

Correct Incorrect Correct answer

Question 228 of 562

What does the courseware say about cell phone signal disruption devices?

They are the preferred method of preserving a device

Correct Incorrect Correct answer

They are prohibited in every form, active and passive alike

Correct Incorrect Correct answer

Actively disrupting signals is illegal and restricted to authorized entities, while there are no regulations against passive blocking

Correct Incorrect Correct answer

They are freely available and may be used by any investigator wherever the investigation happens to be taking place

Correct Incorrect Correct answer

Question 229 of 562

Into which four types of memory storage does the courseware classify the possible evidence locations?

Device, network, data center, and cloud

Correct Incorrect Correct answer

Internal memory, subscriber card memory, external memory, and cloud storage

Correct Incorrect Correct answer

Working memory, read-only memory, flash memory, and cache as the courseware groups them

Correct Incorrect Correct answer

Boot, system, data, and cache partitions

Correct Incorrect Correct answer

Question 230 of 562

What does the internal memory of a phone store?

The synchronized copies held by the cloud service

Correct Incorrect Correct answer

The operating system, the applications, and the other data required to run the phone

Correct Incorrect Correct answer

The personal information, address books, and messages of the subscriber

Correct Incorrect Correct answer

The audio, video, and images placed on a removable card and synchronized to the cloud service

Correct Incorrect Correct answer

Question 231 of 562

How does the courseware say information is extracted from the internal phone memory?

Using attention commands through a bus cable, infrared, or Bluetooth

Correct Incorrect Correct answer

By removing the memory chip and reading it in a programmer

Correct Incorrect Correct answer

By requesting a copy from the service provider

Correct Incorrect Correct answer

By restoring a cloud backup to a second device

Correct Incorrect Correct answer

Question 232 of 562

What does subscriber card memory store?

The operating system and the applications

Correct Incorrect Correct answer

The photographs and videos taken with the camera

Correct Incorrect Correct answer

The cloud backup of the account

Correct Incorrect Correct answer

Personal information, address books, messages, and service-related information

Correct Incorrect Correct answer

Question 233 of 562

What does external memory consist of, and what does it store?

The card memory, storing contacts and messages

Correct Incorrect Correct answer

The cloud drive, storing documents and notes

Correct Incorrect Correct answer

The removable cards in their three sizes, storing personal information such as audio, video, and images

Correct Incorrect Correct answer

The read-only memory of the device, storing the operating system together with the applications that run on it

Correct Incorrect Correct answer

Question 234 of 562

Which cloud services does the courseware associate with each platform?

The storage offered by the carrier in each case and made available to the subscriber as part of the tariff

Correct Incorrect Correct answer

A third-party service chosen by the user

Correct Incorrect Correct answer

The drive service of the vendor of the open platform, and the cloud storage of the closed platform vendor

Correct Incorrect Correct answer

A single shared service used by both platforms

Correct Incorrect Correct answer

Question 235 of 562

What was mobile evidence associated with in the early days of the discipline?

Cellular records and provider logs

Correct Incorrect Correct answer

Short messages, multimedia messages, contact lists, call logs, and the equipment and serial number information

Correct Incorrect Correct answer

Application data, cloud backups, and browser artifacts which belong to the present rather than to the early days

Correct Incorrect Correct answer

Chip-off images and port extractions

Correct Incorrect Correct answer

Question 236 of 562

Which five methods does the courseware name for mobile data acquisition?

Cellular, file system, logical, physical, and cloud data acquisition

Correct Incorrect Correct answer

Manual, automated, hybrid, remote, and local acquisition

Correct Incorrect Correct answer

Static, dynamic, live, dead, and volatile acquisition

Correct Incorrect Correct answer

Port, chip-off, flasher, programmer, and adapter acquisition as the courseware names them

Correct Incorrect Correct answer

Question 237 of 562

What must investigators deal with before performing logical and physical acquisition?

The chain of custody and the warrant

Correct Incorrect Correct answer

The cloud credentials and the carrier records

Correct Incorrect Correct answer

The battery level and the storage capacity of the workstation performing the acquisition

Correct Incorrect Correct answer

Phone locking and the rooting or jailbreaking of the device

Correct Incorrect Correct answer

Question 238 of 562

How does the courseware characterize the acquisition methods?

They are quick, non-invasive, and largely automated

Correct Incorrect Correct answer

They are optional where cloud data is available and can be skipped where the account holder cooperates

Correct Incorrect Correct answer

They are interchangeable and give identical results

Correct Incorrect Correct answer

They are forensically sound, invasive, and technical, so even an expert may require more time

Correct Incorrect Correct answer

Question 239 of 562

On what does the choice of acquisition method depend?

The brand of the device alone

Correct Incorrect Correct answer

The preference of the investigator alone

Correct Incorrect Correct answer

Time constraints, the types the device supports, required live data, recovery of deleted data, third-party application data, and available tools

Correct Incorrect Correct answer

The jurisdiction and the terms of the warrant only as they were settled when the device was first seized

Correct Incorrect Correct answer

Question 240 of 562

How does the courseware describe the forensics process of the open platform?

A single automated workflow provided by the vendor

Correct Incorrect Correct answer

A complex, multifaceted endeavour requiring deep understanding of the operating system, a variety of tools and methods, and a meticulous approach

Correct Incorrect Correct answer

A fixed sequence of five commands run in a terminal that produce the same result on every model of handset

Correct Incorrect Correct answer

A procedure that varies only by device brand

Correct Incorrect Correct answer

Question 241 of 562

Why must the process on the open platform be flexible as well as systematic?

Because of the open nature of the operating system and the variety of devices

Correct Incorrect Correct answer

Because the platform changes its file system every release and the partitions with it at every release

Correct Incorrect Correct answer

Because the vendor supplies no acquisition tools

Correct Incorrect Correct answer

Because the devices cannot be rooted

Correct Incorrect Correct answer

Question 242 of 562

What does the flow say to do where the device is damaged?

Use third-party tools such as the named premium extraction product and forensic product

Correct Incorrect Correct answer

Enable debugging and pull the data

Correct Incorrect Correct answer

Bypass the lock screen manually

Correct Incorrect Correct answer

Perform logical acquisition through the media application with the passcode supplied by the account holder

Correct Incorrect Correct answer

Question 243 of 562

What does the flow say to do where the device is locked?

Return the device to the owner for unlocking so that the passcode can be entered by its rightful holder

Correct Incorrect Correct answer

Perform chip-off forensics immediately

Correct Incorrect Correct answer

Enable the stay awake setting

Correct Incorrect Correct answer

Bypass the lock screen, either through an automated process using tools or through a manual process

Correct Incorrect Correct answer

Question 244 of 562

What does the flow say to do where the device is already rooted?

Use the media application to take a backup

Correct Incorrect Correct answer

Bypass the lock screen first

Correct Incorrect Correct answer

Perform logical and physical acquisition directly

Correct Incorrect Correct answer

Enable debugging and use the pull command only

Correct Incorrect Correct answer

Question 245 of 562

What does the flow say to do where the device is not rooted?

Acquire the cloud data instead

Correct Incorrect Correct answer

Enable debugging, connect the device to the forensic workstation, and perform logical acquisition with the pull command

Correct Incorrect Correct answer

Perform physical acquisition with the dump command

Correct Incorrect Correct answer

Use the port technique to read the memory chip after the board has been exposed and the wires soldered

Correct Incorrect Correct answer

Question 246 of 562

Which command does the flow name for physical acquisition on the open platform?

The devices command

Correct Incorrect Correct answer

The disk dump command

Correct Incorrect Correct answer

The pull command

Correct Incorrect Correct answer

The forward command

Correct Incorrect Correct answer

Question 247 of 562

What does the flow say about cloud data on the open platform?

Cloud data is also acquired, using tools such as a mobile suite from one vendor and a cloud explorer from another

Correct Incorrect Correct answer

Cloud data is out of scope for the process

Correct Incorrect Correct answer

Cloud data is acquired only where the device is damaged and left alone in every other circumstance whatever the state of the handset

Correct Incorrect Correct answer

Cloud data is acquired by the carrier on request

Correct Incorrect Correct answer

Question 248 of 562

What does the courseware say the forensics process of the closed platform requires?

Only the passcode of the device

Correct Incorrect Correct answer

Only a licensed copy of the vendor desktop application obtained from the vendor for the examination

Correct Incorrect Correct answer

Only physical access to the device

Correct Incorrect Correct answer

A deep understanding of the architecture, the security features, and the legal considerations

Correct Incorrect Correct answer

Question 249 of 562

What does the flow say to do where the device of the closed platform is jailbroken?

Enable debugging and use the pull command

Correct Incorrect Correct answer

Use the port technique on the circuit board

Correct Incorrect Correct answer

Establish a working secure shell connection in order to perform physical acquisition

Correct Incorrect Correct answer

Take a backup through the media application with the passcode once the tools have failed

Correct Incorrect Correct answer

Question 250 of 562

What does the flow say to do where the device of the closed platform is not jailbroken?

Root the device and pull the data

Correct Incorrect Correct answer

Remove the memory chip and read it in a programmer

Correct Incorrect Correct answer

Connect it by cable and perform logical acquisition using the media application with a known passcode

Correct Incorrect Correct answer

Establish a secure shell connection and image the file system once the secure shell package has been installed on it

Correct Incorrect Correct answer

Question 251 of 562

What does the flow fall back to where the device of the closed platform is damaged and the tools fail?

A secure shell connection over the wireless network established after the device has been jailbroken

Correct Incorrect Correct answer

The port technique or chip-off forensics, to extract a physical image of the device

Correct Incorrect Correct answer

A cloud acquisition with the account credentials

Correct Incorrect Correct answer

A logical acquisition through the media application

Correct Incorrect Correct answer

Question 252 of 562

How does the courseware define a cellular network?

A network made up of cells served by a transmitter, which helps a user connect and communicate with another user

Correct Incorrect Correct answer

A network of base stations connected by fibre

Correct Incorrect Correct answer

A network in which every device connects directly to every other without any transmitter or provider between them under a single network provider

Correct Incorrect Correct answer

A network operated by a device manufacturer

Correct Incorrect Correct answer

Question 253 of 562

What does a network provider require for a complete cellular network?

A switching center and a billing system

Correct Incorrect Correct answer

A home register and a visitor register

Correct Incorrect Correct answer

A transceiver station and an antenna array

Correct Incorrect Correct answer

A base station subsystem and a network subsystem

Correct Incorrect Correct answer

Question 254 of 562

What sensitive data does the subscriber module store as a network component?

The encryption keys of the network operator

Correct Incorrect Correct answer

The location history of the device

Correct Incorrect Correct answer

User contacts, messages, and the time stamps associated with them

Correct Incorrect Correct answer

The call detail records for the account held by the operator for that account

Correct Incorrect Correct answer

Question 255 of 562

Which four technical items on the subscriber module help a forensic investigator during acquisition?

The ciphering key, the sequence number, the access class, and the language preference

Correct Incorrect Correct answer

The circuit card identifier, the international subscriber identity, the last dialled numbers, and the service provider name

Correct Incorrect Correct answer

The equipment identity, the type allocation code, the serial number, and the model

Correct Incorrect Correct answer

The country code, the network code, the area code, and the routing code which identify areas rather than the subscriber

Correct Incorrect Correct answer

Question 256 of 562

Which component processes calls and messages within a network and routes them between landline and wireless networks?

The home location register

Correct Incorrect Correct answer

The mobile switching center

Correct Incorrect Correct answer

The base station controller

Correct Incorrect Correct answer

The base transceiver station

Correct Incorrect Correct answer

Question 257 of 562

Which component is the radio transceiver equipment that communicates with mobile phones?

The base transceiver station

Correct Incorrect Correct answer

The base station controller

Correct Incorrect Correct answer

The base station subsystem

Correct Incorrect Correct answer

The mobile switching center

Correct Incorrect Correct answer

Question 258 of 562

Which component manages the transceiver equipment and performs channel assignment?

The base transceiver station

Correct Incorrect Correct answer

The mobile switching center

Correct Incorrect Correct answer

The equipment identity register

Correct Incorrect Correct answer

The base station controller

Correct Incorrect Correct answer

Question 259 of 562

Which section of a cellular network controls the controller and transceiver units and handles the traffic?

The mobile switching center

Correct Incorrect Correct answer

The home location register

Correct Incorrect Correct answer

The base station subsystem

Correct Incorrect Correct answer

The network subsystem

Correct Incorrect Correct answer

Question 260 of 562

Which database at the switching center stores the data related to subscribers and other services?

The authentication center

Correct Incorrect Correct answer

The equipment identity register

Correct Incorrect Correct answer

The home location register

Correct Incorrect Correct answer

The visitor location register

Correct Incorrect Correct answer

Question 261 of 562

Which database is used for mobile phones roaming outside their service area?

The authentication center

Correct Incorrect Correct answer

The visitor location register

Correct Incorrect Correct answer

The home location register

Correct Incorrect Correct answer

The equipment identity register

Correct Incorrect Correct answer

Question 262 of 562

Which component stores the subscriber identity of the user along with the encryption and authentication keys?

The authentication center

Correct Incorrect Correct answer

The home location register

Correct Incorrect Correct answer

The visitor location register

Correct Incorrect Correct answer

The base station controller

Correct Incorrect Correct answer

Question 263 of 562

Which database contains a list of mobile devices along with their equipment identity numbers?

The home location register

Correct Incorrect Correct answer

The authentication center

Correct Incorrect Correct answer

The visitor location register

Correct Incorrect Correct answer

The equipment identity register

Correct Incorrect Correct answer

Question 264 of 562

What can a network operator do by analysing the equipment identity register?

Recover the messages sent from that device

Correct Incorrect Correct answer

Determine the current location of the subscriber

Correct Incorrect Correct answer

Read the encryption keys used by the device and decrypt the traffic passing over the air interface

Correct Incorrect Correct answer

Track the equipment identity of a device and check whether it is valid, suspected, or stolen and blocked

Correct Incorrect Correct answer

Question 265 of 562

According to what do cellular networks differ from each other?

The frequency band and the antenna height only

Correct Incorrect Correct answer

The billing model and the contract length

Correct Incorrect Correct answer

The service providers, the geographical location, and the enhancement in techniques

Correct Incorrect Correct answer

The manufacturer of the handset and its operating system as the courseware presents them

Correct Incorrect Correct answer

Question 266 of 562

Which network does the courseware describe as the major and popularly used cellular network?

Long-term evolution

Correct Incorrect Correct answer

The global system for mobile communications

Correct Incorrect Correct answer

Code division multiple access

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

Question 267 of 562

Which network employs spread-spectrum technology where the communication channels are defined in terms of codes?

Code division multiple access

Correct Incorrect Correct answer

Time-division multiple access

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Question 268 of 562

Which network is a backward-compatible digital technology delivering high bit rates per radio channel for packet-switched applications?

Enhanced data rates for evolution

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

High speed downlink packet access

Correct Incorrect Correct answer

Voice over long-term evolution

Correct Incorrect Correct answer

Question 269 of 562

Which network is a packet-oriented mobile data service using frequency-division duplex and time-division multiple access?

Enhanced data rates for evolution

Correct Incorrect Correct answer

Code division multiple access

Correct Incorrect Correct answer

The universal telecommunications system

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

Question 270 of 562

Which network is the third generation technology using wideband access as its underlying air interface?

Long-term evolution

Correct Incorrect Correct answer

Evolved high speed packet access

Correct Incorrect Correct answer

The universal telecommunications system

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Question 271 of 562

Which network extends and improves the performance of existing third generation networks using wideband protocols?

The universal telecommunications system

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Evolved high speed packet access

Correct Incorrect Correct answer

High speed downlink packet access

Correct Incorrect Correct answer

Question 272 of 562

Which network is sometimes referred to as three and a half generation?

Enhanced data rates for evolution

Correct Incorrect Correct answer

Evolved high speed packet access

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Long-term evolution

Correct Incorrect Correct answer

Question 273 of 562

Which third generation protocol allows high data transfer speeds for networks based on the universal telecommunications system?

High speed downlink packet access

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Code division multiple access

Correct Incorrect Correct answer

Time-division multiple access

Correct Incorrect Correct answer

Question 274 of 562

Which network provides a single-frequency channel to multiple users over a divided time slot?

Code division multiple access

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

High speed packet access

Correct Incorrect Correct answer

Time-division multiple access

Correct Incorrect Correct answer

Question 275 of 562

Which network is the standard fourth generation wireless broadband for mobile devices and data terminals?

The universal telecommunications system

Correct Incorrect Correct answer

Evolved high speed packet access

Correct Incorrect Correct answer

Long-term evolution

Correct Incorrect Correct answer

Voice over long-term evolution

Correct Incorrect Correct answer

Question 276 of 562

Which technology allows voice calls over the fourth generation network, including for connected and wearable devices?

High speed packet access

Correct Incorrect Correct answer

The general packet radio service

Correct Incorrect Correct answer

Voice over long-term evolution

Correct Incorrect Correct answer

Long-term evolution

Correct Incorrect Correct answer

Question 277 of 562

Why does the courseware say service provider data matters to an investigation?

It holds the application data of the user

Correct Incorrect Correct answer

It holds call history and text messages with their date and time, and acts as backup evidence where the user deleted such content

Correct Incorrect Correct answer

It holds the passcode of the device

Correct Incorrect Correct answer

It holds the encryption keys of the handset in a form the examiner can read without a court order held on the card inside the handset

Correct Incorrect Correct answer

Question 278 of 562

What else can the service provider supply that the device may not?

The location of the mobile device at the time of the incident, even where the user turned off the geolocation feature

Correct Incorrect Correct answer

The passcode used to unlock the device

Correct Incorrect Correct answer

The contents of the cloud backup

Correct Incorrect Correct answer

The list of applications installed on the device together with the version of each one at the time of seizure

Correct Incorrect Correct answer

Question 279 of 562

In which two further cases does the courseware say service provider data may be required?

Where the device is rooted, and where the device is jailbroken

Correct Incorrect Correct answer

Where the device is damaged, and where the device is locked

Correct Incorrect Correct answer

Where the warrant has expired, and where the owner is absent and no further legal instrument can be obtained

Correct Incorrect Correct answer

Where the deleted data cannot be recovered, and where the location-based services are not turned on in the phone

Correct Incorrect Correct answer

Question 280 of 562

Which four items of potential evidence can be obtained from service provider data?

The message content, the photographs, the contacts, and the applications

Correct Incorrect Correct answer

The passcode, the encryption key, the equipment identity, and the card identifier which identify the card and the handset rather than the events

Correct Incorrect Correct answer

The browser history, the cookies, the cache, and the bookmarks

Correct Incorrect Correct answer

The location of the phone owner, the call detail records, the billing information, and whether the phone was stationary or moving during an interval

Correct Incorrect Correct answer

Question 281 of 562

What should law enforcement agents submit to the service provider to reduce the risk of data loss?

A subpoena

Correct Incorrect Correct answer

A chain of custody form

Correct Incorrect Correct answer

A preservation form

Correct Incorrect Correct answer

A search warrant

Correct Incorrect Correct answer

Question 282 of 562

What do call data records provide?

The physical location of every cell tower

Correct Incorrect Correct answer

Information regarding mobile phone usage in the network and the services accessed by the user

Correct Incorrect Correct answer

The content of the calls and messages themselves as they were carried over the network

Correct Incorrect Correct answer

The applications installed on the handset

Correct Incorrect Correct answer

Question 283 of 562

Who maintains the call data records?

The service provider, for each mobile user

Correct Incorrect Correct answer

The device manufacturer, for each handset

Correct Incorrect Correct answer

The investigator, once the records are received

Correct Incorrect Correct answer

The registry that allocated the number range

Correct Incorrect Correct answer

Question 284 of 562

When does a provider or telecommunications operator disclose confidential user information?

Upon verifying the related documents produced by the investigators, so as to avoid legal issues

Correct Incorrect Correct answer

As soon as an investigator makes an informal request

Correct Incorrect Correct answer

Only after the case has been decided in court and never while the enquiry is still open

Correct Incorrect Correct answer

Only where the subscriber consents in writing

Correct Incorrect Correct answer

Question 285 of 562

What does the courseware say investigators should examine to find potential evidence?

The service provider data alone, because it is more complete and the device data adds nothing to it

Correct Incorrect Correct answer

The device data alone, because provider data is inadmissible

Correct Incorrect Correct answer

The cloud data alone, because it holds everything else

Correct Incorrect Correct answer

Both the device data, meaning internal, external, and card data, and the service provider data

Correct Incorrect Correct answer

Question 286 of 562

What do the calling and called party fields of a record hold?

The exchange identifier and the sequence number

Correct Incorrect Correct answer

The subscriber identity and the equipment identity

Correct Incorrect Correct answer

The number from which the call originated and the number receiving the call

Correct Incorrect Correct answer

The billing number and the account holder name as they appear in the account of that subscriber

Correct Incorrect Correct answer

Question 287 of 562

Which fields of a record carry the timing of the communication?

The location label at the start and end

Correct Incorrect Correct answer

The starting time as a date and time, the date and time of the end, and the call duration

Correct Incorrect Correct answer

The route in and the route out of the exchange as the exchange recorded them while the call was set up

Correct Incorrect Correct answer

The disposition and the fault condition

Correct Incorrect Correct answer

Question 288 of 562

Which fields of a record concern who pays and who is registered?

The identity of the calling and called equipment

Correct Incorrect Correct answer

The billing phone number charged for the call, and the names and addresses of the subscribers or registered users

Correct Incorrect Correct answer

The exchange writing the record and its sequence number

Correct Incorrect Correct answer

The additional digits used to route or charge the call which are appended by the exchange rather than by the biller

Correct Incorrect Correct answer

Question 289 of 562

Which fields identify the equipment that wrote the record and the record itself?

The identification of the telephone exchange or equipment writing the record, and a unique sequence number identifying the record

Correct Incorrect Correct answer

The subscriber identity and the equipment identity of the parties

Correct Incorrect Correct answer

The cell identifier at the start and end of the communication

Correct Incorrect Correct answer

The route through which the call entered and left the exchange as the call was switched from one trunk to the next

Correct Incorrect Correct answer

Question 290 of 562

Which fields of a record identify the subscriber and the handset of each party?

The billing number and the registered address

Correct Incorrect Correct answer

The exchange identifier and the sequence number

Correct Incorrect Correct answer

The service used and the fault encountered which describe the outcome rather than the parties involved

Correct Incorrect Correct answer

The international mobile subscriber identity and the equipment identity of both the calling and the called party

Correct Incorrect Correct answer

Question 291 of 562

Which fields of a record tie the communication to a place?

The additional digits on the called number

Correct Incorrect Correct answer

The names and addresses of the subscribers

Correct Incorrect Correct answer

The location label or cell identifier at the start and end, and the mapping between those identifiers and their geographical location

Correct Incorrect Correct answer

The route through which the call entered and left the exchange as the call was switched from one trunk group to another

Correct Incorrect Correct answer

Question 292 of 562

Which fields of a record describe the path the call took through the exchange?

The identification of the exchange writing the record

Correct Incorrect Correct answer

The disposition or result of the call

Correct Incorrect Correct answer

The route through which the call entered the exchange and the route through which it left

Correct Incorrect Correct answer

The cell identifier at the start and end of the communication together with the duration measured between them

Correct Incorrect Correct answer

Question 293 of 562

What does the additional digits field of a record hold?

The duration of the call in seconds

Correct Incorrect Correct answer

Extra digits on the called number used to route or to charge the call

Correct Incorrect Correct answer

The country code and the network code of the subscriber as printed on the card of that subscriber

Correct Incorrect Correct answer

The sequence number of the record

Correct Incorrect Correct answer

Question 294 of 562

What does the disposition field of a record indicate?

The result of the call, indicating for example whether the call was connected

Correct Incorrect Correct answer

The service used, such as voice or a message

Correct Incorrect Correct answer

The fault condition encountered during the call

Correct Incorrect Correct answer

The route by which the call left the exchange as recorded by the outbound exchange

Correct Incorrect Correct answer

Question 295 of 562

Which two remaining fields does the courseware name in a call detail record?

The billing number and the registered address of the subscriber as they were held by the provider at the time of the call

Correct Incorrect Correct answer

The cell identifier and its geographical mapping

Correct Incorrect Correct answer

The calling party and the called party numbers

Correct Incorrect Correct answer

The telephone service used, such as voice, conference call, short message, or multimedia message, and any fault condition encountered

Correct Incorrect Correct answer

Question 296 of 562

How does the courseware describe the subscriber identity module?

A removable universal integrated circuit card containing essential information about the subscriber, which lets a device connect to the cellular network

Correct Incorrect Correct answer

A fixed chip soldered to the board of the device and replaced only when the whole handset is replaced issued by the network operator

Correct Incorrect Correct answer

A software identity issued by the operating system

Correct Incorrect Correct answer

A record held by the service provider only

Correct Incorrect Correct answer

Question 297 of 562

What is the main function of the subscriber module?

Storing the operating system of the device

Correct Incorrect Correct answer

Encrypting the internal storage of the device

Correct Incorrect Correct answer

Providing the working memory of the device so that applications have somewhere to run

Correct Incorrect Correct answer

Authenticating a cell phone user to the network, thereby allowing access to the subscribed services

Correct Incorrect Correct answer

Question 298 of 562

What kinds of memory does the subscriber module carry, and where does its file system sit?

Non-volatile memory only, with no volatile memory at all

Correct Incorrect Correct answer

Shared memory with the device, with the file system on the device held in the card memory

Correct Incorrect Correct answer

Both volatile and non-volatile memory, with the file system residing in the non-volatile memory

Correct Incorrect Correct answer

Volatile memory only, with the file system rebuilt at each power-on

Correct Incorrect Correct answer

Question 299 of 562

In which kind of memory is the card file system stored?

Dynamic random access memory

Correct Incorrect Correct answer

Electrically erasable programmable read-only memory

Correct Incorrect Correct answer

Static random access memory

Correct Incorrect Correct answer

Flash translation layer memory

Correct Incorrect Correct answer

Question 300 of 562

Which three parts make up the card file system?

The root, the applications, and the user data as the specification defines them

Correct Incorrect Correct answer

The master file, the dedicated files, and the elementary files

Correct Incorrect Correct answer

The boot, system, and data partitions

Correct Incorrect Correct answer

The header, the body, and the trailer

Correct Incorrect Correct answer

Question 301 of 562

What is the master file of the card file system?

The root of the file system, containing one or more dedicated files and possibly elementary files, with a reserved two-byte identifier

Correct Incorrect Correct answer

A directory containing only a header with structure and security information

Correct Incorrect Correct answer

A file containing both a header and a body storing the actual data in one of the four structures the specification defines

Correct Incorrect Correct answer

The serial number of the individual card

Correct Incorrect Correct answer

Question 302 of 562

What does a dedicated file on the card contain?

Both a header and a body storing the actual data in one of the four defined structures

Correct Incorrect Correct answer

The root of the whole file system

Correct Incorrect Correct answer

The unique serial number of the card

Correct Incorrect Correct answer

Only the header, which holds information related to the file structure and security

Correct Incorrect Correct answer

Question 303 of 562

What does an elementary file on the card contain?

Only the two-byte identifier of the file

Correct Incorrect Correct answer

The dedicated files beneath the root

Correct Incorrect Correct answer

Both a header and a body, which stores the actual data in transparent, linear-fixed, and cyclic forms

Correct Incorrect Correct answer

Only a header holding structure and security information and no body in which any data could be held

Correct Incorrect Correct answer

Question 304 of 562

What does the elementary file hold that is unique to the individual card?

The temporary subscriber identity generated at power-on

Correct Incorrect Correct answer

The ciphering key used to encrypt traffic

Correct Incorrect Correct answer

The unique serial number of the card, which is useful in personalizing the mobile equipment to that card

Correct Incorrect Correct answer

The country and network codes of the subscriber which identify the network rather than the individual card

Correct Incorrect Correct answer

Question 305 of 562

How do investigators recognise the origin of a card?

By decrypting the ciphering key

Correct Incorrect Correct answer

By using the serial number of the card together with the elementary file

Correct Incorrect Correct answer

By reading the country code printed on the plastic beside the number of the operator

Correct Incorrect Correct answer

By querying the equipment identity register

Correct Incorrect Correct answer

Question 306 of 562

Which four types of elementary file exist in the card file system?

The transparent, the linear-fixed, the linear-variable, and the cyclic files

Correct Incorrect Correct answer

The master, the dedicated, the elementary, and the reserved files

Correct Incorrect Correct answer

The header, the body, the record, and the block files

Correct Incorrect Correct answer

The transparent, the encrypted, the signed, and the cyclic files

Correct Incorrect Correct answer

Question 307 of 562

What kind of device is the subscriber card, technically?

A passive memory chip with no processing capability

Correct Incorrect Correct answer

A magnetic stripe card read by the handset and carrying no processing capability of its own

Correct Incorrect Correct answer

A software token issued by the network

Correct Incorrect Correct answer

A microcontroller-based smart card storing identification details, phone memories, billing information, text messages, and roaming information

Correct Incorrect Correct answer

Question 308 of 562

What do the parts of the subscriber identity string indicate?

The first three digits indicate the operator, the next the country, and the rest the account balance held on the card at the time of issue

Correct Incorrect Correct answer

The first digits indicate the card manufacturer and the rest the issue date

Correct Incorrect Correct answer

The digits indicate the equipment identity of the handset

Correct Incorrect Correct answer

The first three digits indicate the origin country, the next digits the operator, and the rest the identity in the home network

Correct Incorrect Correct answer

Question 309 of 562

How long is the integrated circuit card identifier, and what does it do?

Ten digits, identifying the provider within a carrier network

Correct Incorrect Correct answer

Two or three digits, representing the country of the user and printed on the plastic of the card

Correct Incorrect Correct answer

Nineteen or twenty digits, identifying each card internationally and helping trace a lost mobile

Correct Incorrect Correct answer

Fifteen digits, identifying the handset internationally

Correct Incorrect Correct answer

Question 310 of 562

How long is the international subscriber identity, and what does it define?

Three digits, used for emergency dialling

Correct Incorrect Correct answer

Fourteen or fifteen digits, defining a subscriber in the wireless world including the country and network they belong to

Correct Incorrect Correct answer

Nineteen or twenty digits, identifying the card internationally

Correct Incorrect Correct answer

Ten digits, identifying the service provider within a carrier network which is a shorter number serving a different purpose entirely

Correct Incorrect Correct answer

Question 311 of 562

What does the service provider name field signify, and what must the investigator attend to?

It signifies the service provider of the card, and the investigator must attend to the authenticity and verifiability of the provider records

Correct Incorrect Correct answer

It signifies the manufacturer of the card, and the investigator must attend to the production batch in which that card was manufactured

Correct Incorrect Correct answer

It signifies the country of issue, and the investigator must attend to the roaming agreements

Correct Incorrect Correct answer

It signifies the network technology, and the investigator must attend to the frequency band

Correct Incorrect Correct answer

Question 312 of 562

What does the mobile country code represent, and how long is it?

The country of the card user internationally on the network, in two to three digits

Correct Incorrect Correct answer

The network of the card user, in ten digits

Correct Incorrect Correct answer

The area location of the phone, in four digits

Correct Incorrect Correct answer

The origin country of the handset, in fifteen digits as it was approved for sale in that market

Correct Incorrect Correct answer

Question 313 of 562

What is the mobile network code used for?

It is used to identify the make and model of the handset

Correct Incorrect Correct answer

It is used to encrypt traffic between the phone and the tower once the handset has registered on the network

Correct Incorrect Correct answer

It is used to fix the language of the card services

Correct Incorrect Correct answer

It is used along with the country code to identify the user on a mobile phone network

Correct Incorrect Correct answer

Question 314 of 562

What does the ten-digit mobile subscriber identification number help identify?

The equipment identity of the handset

Correct Incorrect Correct answer

The current cell in which the phone is registered

Correct Incorrect Correct answer

The mobile phone service provider within a mobile carrier network

Correct Incorrect Correct answer

The country of origin of the card

Correct Incorrect Correct answer

Question 315 of 562

What is the mobile international subscriber directory number?

The number assigned to a department within an organization

Correct Incorrect Correct answer

The number used for international identification of mobile phone numbers, containing the country code and nationwide destination code, up to fifteen digits after prefixes

Correct Incorrect Correct answer

The number used to reach emergency services from a locked phone and dialled without unlocking the handset first whatever code the owner has chosen

Correct Incorrect Correct answer

The number of the last call dialled from the handset

Correct Incorrect Correct answer

Question 316 of 562

What are abbreviated dialing numbers, and what is notable about them?

The numbers permitted when fixed dialling is on

Correct Incorrect Correct answer

Three-digit numbers for emergencies and fast dialling, accessible even when the mobile phone is locked

Correct Incorrect Correct answer

Ten-digit numbers assigned by the provider for service enquiries and reachable only from the contacts menu

Correct Incorrect Correct answer

The numbers most recently dialled from the handset

Correct Incorrect Correct answer

Question 317 of 562

What are the last dialed numbers, and how are they reached?

The recently dialled phone numbers on the handset, reached through the redial option

Correct Incorrect Correct answer

The numbers permitted by the fixed dialling list, reached from the settings menu

Correct Incorrect Correct answer

The three-digit emergency numbers, reached from the lock screen

Correct Incorrect Correct answer

The numbers supplied by the provider, reached from the contacts menu

Correct Incorrect Correct answer

Question 318 of 562

What does the short message service field describe?

The parameters a sender must follow when composing a message

Correct Incorrect Correct answer

The status of a message as reported by the message centre once the message centre has attempted delivery over the messaging service

Correct Incorrect Correct answer

The multimedia message service used for images and video

Correct Incorrect Correct answer

The text message service in which the sender gets a delivery report, using standardized protocols to exchange short text messages

Correct Incorrect Correct answer

Question 319 of 562

What do the text message parameters hold?

The count of messages stored on the card

Correct Incorrect Correct answer

The encryption key used to protect the message

Correct Incorrect Correct answer

The messaging protocols a sender should follow, with input data such as the recipient number, the message body, and the file format

Correct Incorrect Correct answer

The delivery status returned by the message centre once the message has reached the concerned recipient or has failed to reach them at all

Correct Incorrect Correct answer

Question 320 of 562

What does the text message status field record?

The number of unread messages on the card

Correct Incorrect Correct answer

The time at which the message was composed

Correct Incorrect Correct answer

The status of the message received by the sender, sent by the message centre to clarify whether it reached the recipient

Correct Incorrect Correct answer

The protocols the sender must follow when composing before the message is handed to the network for delivery across the air interface to the centre

Correct Incorrect Correct answer

Question 321 of 562

What does the phase identifier of a card indicate?

The remaining storage capacity of the card

Correct Incorrect Correct answer

A version number reflecting the capabilities, standards, and functionality supported by the card, defined during manufacture

Correct Incorrect Correct answer

The generation of the cellular network the card is registered on when the handset last attached to it

Correct Incorrect Correct answer

The number of times the card has been reissued

Correct Incorrect Correct answer

Question 322 of 562

What does the service table on the card hold?

The service data provided by the subscriber, stored in the form of a table, with associated services such as menu selection and the packet radio service

Correct Incorrect Correct answer

The list of numbers the subscriber may dial

Correct Incorrect Correct answer

The tariff table used to price a call

Correct Incorrect Correct answer

The list of networks the card may not use after a location request has been refused by one of them and refused registration by the operator

Correct Incorrect Correct answer

Question 323 of 562

What is the home network search period?

The interval at which the phone scans for available networks while it is registered on a network of its own operator

Correct Incorrect Correct answer

The period after which a roaming agreement lapses

Correct Incorrect Correct answer

The time allowed for a call before it disconnects

Correct Incorrect Correct answer

The area location information of a mobile phone on a network, given as a unique identification number by the service provider

Correct Incorrect Correct answer

Question 324 of 562

What does the network selector field provide?

The list of networks the phone is forbidden to use

Correct Incorrect Correct answer

The temporary identity used between the phone and the network and regenerated each time the handset is switched on

Correct Incorrect Correct answer

The ciphering keys used to protect traffic

Correct Incorrect Correct answer

The information used to identify the area location of a phone on a network and its roaming information

Correct Incorrect Correct answer

Question 325 of 562

When is a network added to the forbidden network list?

When the network fails to authenticate the card

Correct Incorrect Correct answer

When the roaming agreement between operators expires

Correct Incorrect Correct answer

When the mobile station receives a not-allowed message in response to a location register request from a visiting network

Correct Incorrect Correct answer

When the subscriber manually blocks the network in the settings from the list of available operators shown on the screen

Correct Incorrect Correct answer

Question 326 of 562

What does the capability configuration parameter contain?

The list of services the subscriber has purchased and charged for on the monthly account of that subscriber

Correct Incorrect Correct answer

Information about the calls dialled in the required network, emergency calls, the last call dialled, and rejected dialled numbers

Correct Incorrect Correct answer

The capabilities of the handset radio

Correct Incorrect Correct answer

The configuration of the card file system

Correct Incorrect Correct answer

Question 327 of 562

How is the access control class structured?

Two bytes of information in fifteen classes, of which the first ten are for normal subscribers and the remaining five for high-priority users

Correct Incorrect Correct answer

One byte in eight classes, split evenly between normal and priority users with no separation between the ordinary and the privileged as the specification allots them

Correct Incorrect Correct answer

Four bytes in twenty classes, all for normal subscribers

Correct Incorrect Correct answer

Two bytes in ten classes, all for high-priority users

Correct Incorrect Correct answer

Question 328 of 562

What are the broadcast control channels, and what do they provide?

Point-to-multipoint downlink broadcast channels sent by the transceiver station, providing network information such as services, access parameters, and neighbour lists

Correct Incorrect Correct answer

Point-to-point uplink channels used to place a call and released again when the conversation has ended by the handset that placed the call

Correct Incorrect Correct answer

Channels reserved for emergency traffic only

Correct Incorrect Correct answer

Channels used to synchronize the ciphering keys

Correct Incorrect Correct answer

Question 329 of 562

What is the language preference field on the card?

The language in which the network sends its broadcast messages when it announces its services to the handsets in the cell

Correct Incorrect Correct answer

The character set used to store text messages

Correct Incorrect Correct answer

The language of the operating system of the handset

Correct Incorrect Correct answer

The preferred language selected by the user in order to understand and operate the services of the card

Correct Incorrect Correct answer

Question 330 of 562

What is the purpose of cardholder verification?

To check whether the card has been cloned

Correct Incorrect Correct answer

To check whether the handset matches the card

Correct Incorrect Correct answer

To check whether the cardholder is an authorized person, with file access granted only after successful verification of the personal number

Correct Incorrect Correct answer

To check whether the card is registered on the correct network before the handset is allowed to attach to it at all

Correct Incorrect Correct answer

Question 331 of 562

What is the ciphering key used for?

To unlock the card after too many failed attempts once the personal number has been entered incorrectly too often held on the card itself

Correct Incorrect Correct answer

To encrypt or decrypt data for security purposes, with hashing algorithms provided so data can be returned to its original state

Correct Incorrect Correct answer

To authenticate the subscriber to the network

Correct Incorrect Correct answer

To sign the messages sent from the card

Correct Incorrect Correct answer

Question 332 of 562

What does the ciphering key sequence number refer to, and what does it improve?

It refers to the roaming networks visited, and it improves network selection

Correct Incorrect Correct answer

It refers to the ciphering keys, and it improves key consistency if the same user accesses the network again

Correct Incorrect Correct answer

It refers to the order in which calls were made, and it improves billing accuracy

Correct Incorrect Correct answer

It refers to the sequence of records on the card, and it improves file access speed as records are added to the card

Correct Incorrect Correct answer

Question 333 of 562

How does the courseware describe the emergency call code?

A fast-dialling service used in emergencies, where the service management takes the request as a code and categorises codes by user priority

Correct Incorrect Correct answer

A three-digit number accessible only when the phone is unlocked and therefore unavailable to a caller in an emergency once the correct passcode has been entered

Correct Incorrect Correct answer

A code that disables the fixed dialling restriction

Correct Incorrect Correct answer

A code that resets the personalization of the card

Correct Incorrect Correct answer

Question 334 of 562

What happens when the fixed dialing number feature is switched on?

The user can only receive calls from the numbers listed, and outgoing calls are unaffected whatever the number of the caller happens to be

Correct Incorrect Correct answer

All outgoing and incoming calls are blocked until it is switched off

Correct Incorrect Correct answer

The card refuses to register on any visiting network

Correct Incorrect Correct answer

The user can only make calls to the numbers listed, incoming calls are unaffected, and the feature is not available on all cards

Correct Incorrect Correct answer

Question 335 of 562

What is the dialing extension on a card?

The country and network codes prefixed to a number

Correct Incorrect Correct answer

The extension of the file holding the dialled numbers

Correct Incorrect Correct answer

An extended number assigned to a person or department in an organization, used in conjunction with the phone number

Correct Incorrect Correct answer

The additional digits appended by the exchange to route a call before the call is passed on to the destination network

Correct Incorrect Correct answer

Question 336 of 562

What is notable about the two group files on a card?

They are stored outside the card file system

Correct Incorrect Correct answer

They hold the ciphering keys of the subscriber

Correct Incorrect Correct answer

Their locks can be changed but not removed, which makes them useful during forensic investigations

Correct Incorrect Correct answer

They can be deleted only by the service provider when the account is closed by the subscriber

Correct Incorrect Correct answer

Question 337 of 562

What does the first of the two group files prevent?

It does not allow the card to be cloned

Correct Incorrect Correct answer

It does not allow users to put a card from the main network into a phone on a virtual network

Correct Incorrect Correct answer

It does not allow the card to be used outside its home country while roaming on the network of another operator

Correct Incorrect Correct answer

It does not allow the phone to place emergency calls

Correct Incorrect Correct answer

Question 338 of 562

What is the second of the two group files?

The normal lock that users can put on any card other than one belonging to the same network

Correct Incorrect Correct answer

The lock that prevents the card being removed from the handset once the handset has been switched on

Correct Incorrect Correct answer

The lock that restricts the card to a single subscriber

Correct Incorrect Correct answer

The lock that disables the card after failed attempts

Correct Incorrect Correct answer

Question 339 of 562

What are the preferred network messages on a card?

Messages the subscriber has marked as favourites

Correct Incorrect Correct answer

Messages held pending delivery by the message centre

Correct Incorrect Correct answer

Messages exchanged between the card and the authentication center while the handset is being authenticated onto the network

Correct Incorrect Correct answer

Messages from the network prompted on the handset, such as network not registered, registration failure, or network not available

Correct Incorrect Correct answer

Question 340 of 562

What does the calls per unit field allow?

The maximum number of calls the subscriber may make in a period before further calls are barred by the network for the remainder of that billing period

Correct Incorrect Correct answer

The number of units of credit remaining on the account

Correct Incorrect Correct answer

The number of calls recorded in the call meter

Correct Incorrect Correct answer

The price per unit and currency table on the card, which allows the phone to calculate the cost of a call in the selected currency

Correct Incorrect Correct answer

Question 341 of 562

What does the accumulated call meter record?

The price per unit set by the subscriber

Correct Incorrect Correct answer

The duration of the last call only

Correct Incorrect Correct answer

The charges for current, ongoing, and proceeding calls, presented in home units by the station and stored on the card

Correct Incorrect Correct answer

The number of minutes remaining on the tariff as reported by the operator to the handset at the close of each billing period

Correct Incorrect Correct answer

Question 342 of 562

What does the call limit field do?

It restricts the card to a single network

Correct Incorrect Correct answer

It restricts the call time for the caller, and the call automatically disconnects once the limit is reached

Correct Incorrect Correct answer

It restricts the number of calls that may be made in a day whatever the duration of each of them

Correct Incorrect Correct answer

It restricts calls to the numbers on the fixed dialling list

Correct Incorrect Correct answer

Question 343 of 562

What does the location information field contain?

The temporary subscriber identity and the location update status, updated as the phone moves to new locations

Correct Incorrect Correct answer

The permanent subscriber identity and the home network code

Correct Incorrect Correct answer

The cell identifiers of every tower the phone has seen since the handset was first switched on

Correct Incorrect Correct answer

The geographic coordinates reported by the positioning system

Correct Incorrect Correct answer

Question 344 of 562

What is the local area identity useful for?

Identifying mobile phones internationally by their particular location area within a network, and its code holds both the network and country codes

Correct Incorrect Correct answer

Identifying the handset by its equipment number

Correct Incorrect Correct answer

Identifying the subscriber by their directory number

Correct Incorrect Correct answer

Identifying the card by its circuit card identifier which is printed on the card rather than describing its area at the time the card was issued

Correct Incorrect Correct answer

Question 345 of 562

What is the own-dialing number on a card?

The number most recently dialled from the handset

Correct Incorrect Correct answer

The number of the message centre used for text messages and stored on the card when the account is first opened by the operator of that network

Correct Incorrect Correct answer

The number reserved for emergency services

Correct Incorrect Correct answer

The number of the card itself, unique to the mobile network and therefore referred to as the phone number, issued by the service provider

Correct Incorrect Correct answer

Question 346 of 562

What is the temporary mobile subscriber identity, and what does it prevent?

A number generated per call, preventing billing disputes

Correct Incorrect Correct answer

A number stored in the equipment register, preventing use of stolen handsets

Correct Incorrect Correct answer

A number generated randomly when the phone is turned on, working as the temporary identity between phone and network and stopping tracing of the subscriber by intercepting traffic

Correct Incorrect Correct answer

A number issued by the provider when a card is replaced, preventing reuse of the old card and printed on the replacement when it is issued over the air interface

Correct Incorrect Correct answer

Question 347 of 562

What does the routing area identifier comprise?

The temporary identity and the update status

Correct Incorrect Correct answer

The location area code and the routing area code, by which the different areas in a network are identified

Correct Incorrect Correct answer

The country code and the network code of the subscriber which identify the operator rather than the areas within it

Correct Incorrect Correct answer

The cell identifier and its geographic mapping

Correct Incorrect Correct answer

Question 348 of 562

What is the routing network code useful for?

Identifying the tariff applied to a call

Correct Incorrect Correct answer

Identifying a particular network within a large network, and for paging and registration purposes

Correct Incorrect Correct answer

Identifying the country in which the card was issued and the operator that issued it there

Correct Incorrect Correct answer

Identifying the handset within the network

Correct Incorrect Correct answer

Question 349 of 562

How does the courseware say the service dialing numbers are viewed?

Through contacts, then the menu key, then settings, then the service numbers entry

Correct Incorrect Correct answer

Through the dialer, by entering a star and hash code while the handset is powered on

Correct Incorrect Correct answer

Through the developer options menu

Correct Incorrect Correct answer

Through the message centre settings

Correct Incorrect Correct answer

Question 350 of 562

What are the depersonalization control keys?

The keys used to encrypt and decrypt traffic

Correct Incorrect Correct answer

The keys used to authenticate the subscriber to the network

Correct Incorrect Correct answer

The keys used to sign the firmware of the handset before it is accepted by the boot read-only memory at every power-on of the handset

Correct Incorrect Correct answer

Specific codes or passwords used to reset or unlock a card, removing the personalization settings that tie it to a specific user or carrier

Correct Incorrect Correct answer

Question 351 of 562

How long can the identifier of a subscriber card be, and where is it held?

Up to ten digits, held only on the handset

Correct Incorrect Correct answer

Exactly eight digits, printed on the packaging

Correct Incorrect Correct answer

Up to twenty digits, printed and stored on the card itself

Correct Incorrect Correct answer

Exactly fifteen digits, held only in the network register at the time of issue

Correct Incorrect Correct answer

Question 352 of 562

Which four components make up the card identifier?

A manufacturer code, a model code, a batch number, and a serial number

Correct Incorrect Correct answer

A type allocation code, a serial number, and two check digits

Correct Incorrect Correct answer

An industry identifier prefix of eighty-nine for telecommunications, a country code, an issuer identifier number, and an account identification number

Correct Incorrect Correct answer

A country code, a network code, a subscriber number, and a check digit which identify the subscriber rather than the card

Correct Incorrect Correct answer

Question 353 of 562

What does the card identifier help identify?

The tariff applied to the account

Correct Incorrect Correct answer

The country and the network operator name batches to which the card belongs

Correct Incorrect Correct answer

The manufacturer and model of the handset as approved for sale in that market

Correct Incorrect Correct answer

The current location of the subscriber

Correct Incorrect Correct answer

Question 354 of 562

What should an investigator do if a card does not contain an identifier?

Obtain it using card acquisition tools such as the named forensic product

Correct Incorrect Correct answer

Read it from the equipment identity register held by the network operator instead

Correct Incorrect Correct answer

Request it from the handset manufacturer

Correct Incorrect Correct answer

Calculate it from the subscriber identity

Correct Incorrect Correct answer

Question 355 of 562

What does the international mobile equipment identifier represent, and how long is it?

The country, the operator, and the subscriber, in a fifteen-digit number

Correct Incorrect Correct answer

The industry, the country, the issuer, and the account, in a twenty-digit number

Correct Incorrect Correct answer

The model and the origin, in an eight-digit number

Correct Incorrect Correct answer

The manufacturer, the model type, and the approved country, in a unique fifteen-digit number

Correct Incorrect Correct answer

Question 356 of 562

What are the first eight digits of the equipment identifier called, and what do they provide?

The industry identifier prefix, which shows the sector

Correct Incorrect Correct answer

The country code, which shows where the device was sold rather than where it was manufactured

Correct Incorrect Correct answer

The issuer identifier, which shows the network operator

Correct Incorrect Correct answer

The type allocation code, which provides information about the model and the origin of the device

Correct Incorrect Correct answer

Question 357 of 562

How can the equipment identifier be retrieved from a powered-on phone?

By querying the home location register

Correct Incorrect Correct answer

By opening the developer options menu

Correct Incorrect Correct answer

By typing a short star and hash code on the mobile keypad

Correct Incorrect Correct answer

By reading it from the subscriber card once it has been placed in a reader

Correct Incorrect Correct answer

Question 358 of 562

Where is the equipment identifier usually printed on a device?

Inside the settings menu only

Correct Incorrect Correct answer

Usually on the battery, and in some devices on the card tray or the back of the mobile case

Correct Incorrect Correct answer

Always on the retail packaging only

Correct Incorrect Correct answer

On the screen of the device at every boot while the vendor logo is displayed on the screen

Correct Incorrect Correct answer

Question 359 of 562

What is the equipment identifier used for?

To identify devices and to prevent access to stolen mobile phones

Correct Incorrect Correct answer

To identify the subscriber to the billing system

Correct Incorrect Correct answer

To encrypt the traffic between the phone and the tower

Correct Incorrect Correct answer

To personalize the handset to a particular card

Correct Incorrect Correct answer

Question 360 of 562

Why do forensic investigators clone subscriber cards?

For further investigation, in order to avoid accidental tampering with the original card data

Correct Incorrect Correct answer

To restore service to the owner of the device as soon as the examination has finished

Correct Incorrect Correct answer

To test whether the card is genuine

Correct Incorrect Correct answer

To transfer the account to a new provider

Correct Incorrect Correct answer

Question 361 of 562

What can the cloning tool do with the original card?

Clone it only after the personal number has been recovered

Correct Incorrect Correct answer

Clone it only where the provider supplies a key

Correct Incorrect Correct answer

Clone it only if the card is unlocked in the handset and the personal number has been entered

Correct Incorrect Correct answer

Clone it even without knowing the personal number, or create new cards with any circuit card identifier

Correct Incorrect Correct answer

Question 362 of 562

What is the purpose of cloning a card for an investigation?

To recover the deleted messages from the card

Correct Incorrect Correct answer

To transfer the evidence onto a second handset

Correct Incorrect Correct answer

To isolate a phone from its network so that the investigation can be conducted securely

Correct Incorrect Correct answer

To let the phone continue receiving calls during the examination while the acquisition of the card is under way

Correct Incorrect Correct answer

Question 363 of 562

Which two further capabilities does the courseware attribute to the cloning product?

Reading the equipment identity register and the home location register that the network operator maintains

Correct Incorrect Correct answer

Formatting the card to renew it for future use, and connecting multiple card readers simultaneously

Correct Incorrect Correct answer

Bypassing the lock screen and rooting the device

Correct Incorrect Correct answer

Decrypting the keychain and dumping the memory

Correct Incorrect Correct answer

Question 364 of 562

What does the cloning product extract from a phone?

Only the data held in the cloud account that the account holder has synchronized from the handset over the network of that provider

Correct Incorrect Correct answer

All data including deleted data, call history, contacts, messages, photos, videos, recordings, calendar items, notes, files, passwords, and app data

Correct Incorrect Correct answer

Only the contents of the subscriber card

Correct Incorrect Correct answer

Only the messages and the call history

Correct Incorrect Correct answer

Question 365 of 562

What is the extractor used for, and what does it connect to?

Data extraction from mobile devices, connecting to a wide range of devices of both platforms and importing device backups

Correct Incorrect Correct answer

Network capture, connecting to the base station of the carrier while the handset is attached and passing traffic

Correct Incorrect Correct answer

Chip reading, connecting to a programmer and adapters

Correct Incorrect Correct answer

Log analysis, connecting to a desktop workstation only

Correct Incorrect Correct answer

Question 366 of 562

What can be done with the data once the extractor has finished?

It can only be printed as a paper report

Correct Incorrect Correct answer

It must be uploaded to the vendor cloud for processing before any of it can be read by the examiner

Correct Incorrect Correct answer

It can only be viewed inside the extractor itself

Correct Incorrect Correct answer

It can be saved to a backup for later import into the detective product, or exported immediately to report formats

Correct Incorrect Correct answer

Question 367 of 562

What physical setup does card forensics require?

The card is imaged in place using a chip programmer

Correct Incorrect Correct answer

The card is read wirelessly by a nearby transceiver

Correct Incorrect Correct answer

The card is removed from the mobile device and placed in a card reader, which is attached to the forensic workstation

Correct Incorrect Correct answer

The card is left in the device and the device is connected by cable so that the reader can address it in place

Correct Incorrect Correct answer

Question 368 of 562

What is the first step of the card acquisition with the extractor?

Choose the options for storing the extracted evidence

Correct Incorrect Correct answer

Select the message category and view the data

Correct Incorrect Correct answer

Open the main menu of the extractor and click the universal circuit card acquisition entry

Correct Incorrect Correct answer

Contact the provider for the personal or unblocking code before the reader will release the card data

Correct Incorrect Correct answer

Question 369 of 562

What is the second step of the card acquisition?

View the results of the extraction in the program

Correct Incorrect Correct answer

Contact the communication provider to obtain the personal or unblocking code needed to retrieve the identifier information

Correct Incorrect Correct answer

Open the main menu and click the acquisition entry

Correct Incorrect Correct answer

Analyse the contents of each file in the browser once the extraction of that card has finished

Correct Incorrect Correct answer

Question 370 of 562

What does the card data extraction window display?

Details regarding the card reader, details regarding the card, and the entry fields for the personal and unblocking codes

Correct Incorrect Correct answer

The list of messages recovered from the card

Correct Incorrect Correct answer

The hash value of the extracted evidence

Correct Incorrect Correct answer

The file browser showing the card file system as it stood when the card was last used in a handset

Correct Incorrect Correct answer

Question 371 of 562

What is the third step of the card acquisition?

Contact the provider for the unblocking code before the reader will unlock the card for reading in the extraction window

Correct Incorrect Correct answer

Open the file browser category

Correct Incorrect Correct answer

Choose the message category

Correct Incorrect Correct answer

Provide additional information regarding the extraction, choose the options for storing the evidence, and click next to start

Correct Incorrect Correct answer

Question 372 of 562

Which four categories of information does the tool retrieve from the card?

System files, geolocation, user accounts, and deleted data which are the artifacts of a handset rather than of a card

Correct Incorrect Correct answer

Chat history, calls, shared images, and geodata

Correct Incorrect Correct answer

Cookies, cache, bookmarks, and history

Correct Incorrect Correct answer

General details regarding the card, contact details, phone calls and messages, and additional details, along with deleted entries

Correct Incorrect Correct answer

Question 373 of 562

What happens at the fourth step of the card acquisition?

The message category is selected for viewing

Correct Incorrect Correct answer

The card file is analysed in the file browser

Correct Incorrect Correct answer

On completion of the data extraction, the information regarding that extraction is displayed in the forensic program

Correct Incorrect Correct answer

The card reader details are displayed for the first time once the card has been unlocked with that code

Correct Incorrect Correct answer

Question 374 of 562

What is the fifth step of the card acquisition?

Click the universal circuit card acquisition entry

Correct Incorrect Correct answer

Choose the short message category and view the data that was retrieved

Correct Incorrect Correct answer

Choose the file browser category and analyse each file once the extraction has finished running

Correct Incorrect Correct answer

Provide additional information about the extraction

Correct Incorrect Correct answer

Question 375 of 562

What is the sixth and last step of the card acquisition?

Go to the main window, select the file browser category, view the card file, and analyse the contents of each file

Correct Incorrect Correct answer

Choose the message category and view the retrieved data as they were recovered from the card by the tool as the tool recovered them

Correct Incorrect Correct answer

Obtain the unblocking code from the provider

Correct Incorrect Correct answer

Attach the card reader to the forensic workstation

Correct Incorrect Correct answer

Question 376 of 562

What does the named forensic product allow investigators to do?

View, search for, or retrieve data from mobile devices and from the subscriber cards inside them

Correct Incorrect Correct answer

Bypass the lock screen of a device without a password so that the acquisition can begin at once

Correct Incorrect Correct answer

Read a memory chip removed from a device

Correct Incorrect Correct answer

Capture the traffic between a device and its network

Correct Incorrect Correct answer

Question 377 of 562

Which data does the forensic product handle?

Only the contents of the subscriber card

Correct Incorrect Correct answer

Only the deleted items recovered from unallocated space rather than the live entries beside them

Correct Incorrect Correct answer

Only the cloud backups of the account

Correct Incorrect Correct answer

Call history, phonebook, text messages, multimedia messages, files, calendars, notes, reminders, and raw application data

Correct Incorrect Correct answer

Question 378 of 562

What do the multiple communication protocols of the forensic product achieve?

They encrypt the extracted evidence in transit

Correct Incorrect Correct answer

They let the product bypass the device passcode

Correct Incorrect Correct answer

They help investigators get the maximum data from each phone and operating system

Correct Incorrect Correct answer

They allow the product to work without a cable even where the handset is locked

Correct Incorrect Correct answer

Question 379 of 562

What do investigators do with the evidence once the forensic product has collected it?

Publish the evidence to a shared case repository

Correct Incorrect Correct answer

Combine all the evidence, remove duplicates, and present it in a comprehensive and easily readable format

Correct Incorrect Correct answer

Hash each item and archive it without further processing without combining it or removing duplicates

Correct Incorrect Correct answer

Return the evidence to the provider for verification

Correct Incorrect Correct answer

Question 380 of 562

Which set of additional card acquisition tools does the courseware list?

A screen unlocker, a rooting tool, and a repository extractor

Correct Incorrect Correct answer

A universal extraction device, a logical extraction product, a card explorer, a card seizure device, and a card data recovery product

Correct Incorrect Correct answer

A cloud explorer, a mobile suite, and a detective product which acquire cloud accounts and analyse handsets instead rather than reading the card itself

Correct Incorrect Correct answer

A programmer, a rework station, and a flasher box

Correct Incorrect Correct answer

Question 381 of 562

What is phone locking, and why do manufacturers provide it?

A basic security feature provided by manufacturers to prevent unauthorized access to a phone, adding a layer of security

Correct Incorrect Correct answer

A carrier feature that ties the handset to one network

Correct Incorrect Correct answer

A developer feature that prevents debugging

Correct Incorrect Correct answer

A recovery feature that restores the device to factory state once the owner has confirmed the request on the screen

Correct Incorrect Correct answer

Question 382 of 562

Which three lock schemes does the courseware give for the open platform?

The number lock, the fingerprint lock, and the face lock

Correct Incorrect Correct answer

The pattern lock, the iris lock, and the voice lock

Correct Incorrect Correct answer

The password lock, the network lock, and the card lock

Correct Incorrect Correct answer

The number lock, the pattern lock, and the password lock

Correct Incorrect Correct answer

Question 383 of 562

Why is a device found locked at a crime scene a problem for the investigator?

It will erase itself within an hour of seizure unless the examiner has already begun the acquisition without any warning to the examiner

Correct Incorrect Correct answer

It cannot be connected to a power source

Correct Incorrect Correct answer

It must be unlocked, which is a challenging task that has to be completed before the device can be examined

Correct Incorrect Correct answer

It cannot be transported until it is unlocked

Correct Incorrect Correct answer

Question 384 of 562

How does the courseware describe the number lock?

A code of four to sixteen characters including punctuation

Correct Incorrect Correct answer

The easiest way to lock a phone for local security, using a code of at least four digits that can also be longer and mix letters with numbers

Correct Incorrect Correct answer

A code of exactly four digits that cannot be lengthened and set by the manufacturer rather than by the user when the handset leaves the factory chosen by the owner of the handset

Correct Incorrect Correct answer

A pattern traced across a grid of dots

Correct Incorrect Correct answer

Question 385 of 562

How does the pattern lock work?

It requires a fingerprint pressed on a sensor

Correct Incorrect Correct answer

It allows the user to trace a unique pattern with a finger over a three by three grid of dots

Correct Incorrect Correct answer

It requires a four-digit number entered on a keypad

Correct Incorrect Correct answer

It requires a facial scan taken by the front camera while the screen is held at the correct distance

Correct Incorrect Correct answer

Question 386 of 562

What trade-off does the courseware attach to the pattern lock?

It is convenient because the user can quickly swipe a path, but swiping a precise pattern is tiring and less secure than the number lock

Correct Incorrect Correct answer

It is more secure than the number lock but slower to use because the path is longer than any code the user would set

Correct Incorrect Correct answer

It is faster than a biometric unlock but easier to guess

Correct Incorrect Correct answer

It works only on devices with a physical keypad

Correct Incorrect Correct answer

Question 387 of 562

How does the password lock differ from the number lock?

It requires a pattern rather than a code

Correct Incorrect Correct answer

It cannot be combined with a biometric feature once the device has been enrolled with a fingerprint or with a face registered on it

Correct Incorrect Correct answer

It is limited to exactly four characters

Correct Incorrect Correct answer

It has the same functionality, except that the four to sixteen digit access code contains letters and punctuation as well as numbers

Correct Incorrect Correct answer

Question 388 of 562

What is the primary task of the forensic investigator at the workstation when a device is found locked?

Recording the equipment identity from the case

Correct Incorrect Correct answer

Isolating the device from the network

Correct Incorrect Correct answer

Unlocking the phone in order to gain access to it

Correct Incorrect Correct answer

Imaging the memory card before touching the device before the examination can begin

Correct Incorrect Correct answer

Question 389 of 562

What does the courseware say about biometric features on mobile devices?

They replace the passcode entirely on modern devices

Correct Incorrect Correct answer

They are available only on devices of the closed platform

Correct Incorrect Correct answer

They vary depending on the device and its manufacturer, and the most widely used are fingerprint and face recognition

Correct Incorrect Correct answer

They are standard across all manufacturers and always use a fingerprint whatever the model of the handset happens to be

Correct Incorrect Correct answer

Question 390 of 562

What example does the courseware give of a manufacturer creating its own biometric feature?

A gait recognition feature using the accelerometer

Correct Incorrect Correct answer

An iris scanner offered on one vendor line of devices

Correct Incorrect Correct answer

A voice recognition unlock offered by a carrier

Correct Incorrect Correct answer

A palm print reader built into the screen on that particular device line

Correct Incorrect Correct answer

Question 391 of 562

Which tool removes all types of lock screen on the open platform without a password?

The named unlock kit, which also bypasses the factory reset protection lock

Correct Incorrect Correct answer

The named rooting tool, which also unlocks the boot loader on the majority of handsets

Correct Incorrect Correct answer

The named repository extractor, which also installs jailbreaks

Correct Incorrect Correct answer

The named file manager, which also grants root access

Correct Incorrect Correct answer

Question 392 of 562

What is the first step of the first unlock method?

Let the tool build a configuration file for the device

Correct Incorrect Correct answer

Keep the device in recovery mode and clear the cache partition so that the removal process can begin on the handset

Correct Incorrect Correct answer

Wait for the screen lock removal completed page

Correct Incorrect Correct answer

Open the tool on the workstation, connect the suspect device by bus cable, and click the screen unlocker entry

Correct Incorrect Correct answer

Question 393 of 562

What happens at the second step of the first unlock method?

The examiner selects the brand of the device from a list from the list of manufacturers the tool supports

Correct Incorrect Correct answer

The device is placed in recovery mode

Correct Incorrect Correct answer

The tool reports that the lock has been removed

Correct Incorrect Correct answer

The tool builds a configuration file for the connected device, and once it is ready the examiner clicks remove now

Correct Incorrect Correct answer

Question 394 of 562

What does the examiner do at the third step of the first unlock method?

Click done to finish the process

Correct Incorrect Correct answer

Select the specific mode for the device brand

Correct Incorrect Correct answer

Follow the on-screen instructions to keep the device in recovery mode and clear the cache partition, which starts the lock screen removal

Correct Incorrect Correct answer

Connect the device and click the screen unlocker and wait for the tool to recognise the handset in the list the tool displays

Correct Incorrect Correct answer

Question 395 of 562

What is the fourth and last step of the first unlock method?

Select the brand of the device

Correct Incorrect Correct answer

Wait until the screen lock removal completed page is displayed, after which the files on the device can be analysed

Correct Incorrect Correct answer

Build the configuration file for the device

Correct Incorrect Correct answer

Clear the cache partition from recovery mode so that the tool can write to the system partition and the boot image with it

Correct Incorrect Correct answer

Question 396 of 562

What does the second named unlock suite evade?

Not only pattern locks but also numbers, passwords, and the factory reset protection lock

Correct Incorrect Correct answer

Only pattern locks on devices of one brand

Correct Incorrect Correct answer

Only the factory reset protection lock

Correct Incorrect Correct answer

Only the passcode on devices of the closed platform and nothing at all on the other platform

Correct Incorrect Correct answer

Question 397 of 562

What is the first step of the second unlock method?

Open the suite on the workstation, connect the suspect device by bus cable, and click unlock screen to start the removal

Correct Incorrect Correct answer

Select the brand of the device from the list so that the tool can choose the correct removal mode from the workstation running it

Correct Incorrect Correct answer

Click done once the removal has completed

Correct Incorrect Correct answer

Clear the cache partition from recovery mode

Correct Incorrect Correct answer

Question 398 of 562

What happens at the second step of the second unlock method?

The tool builds a configuration file for the device and displays it for confirmation before proceeding shown by the tool on completion

Correct Incorrect Correct answer

The device is placed into recovery mode manually

Correct Incorrect Correct answer

The examiner clicks done to finish

Correct Incorrect Correct answer

The examiner selects the brand of the device, which prompts a specific mode, and the unlocking process starts

Correct Incorrect Correct answer

Question 399 of 562

What is the third and last step of the second unlock method?

Connect the device and click unlock screen

Correct Incorrect Correct answer

Select the specific mode for the brand

Correct Incorrect Correct answer

Click done once the lock removal process has completed successfully

Correct Incorrect Correct answer

Wait for the screen lock removal completed page at the end of the process

Correct Incorrect Correct answer

Question 400 of 562

What does the courseware say about setting up a passcode on the closed platform?

It is set by the carrier rather than the user when the handset is first activated on the network each time the device is used

Correct Incorrect Correct answer

It is a significant part of securing data from unauthorized access, and the device prompts for it before use each time

Correct Incorrect Correct answer

It is optional and rarely used on those devices

Correct Incorrect Correct answer

It replaces the need for any biometric feature

Correct Incorrect Correct answer

Question 401 of 562

What is the default security mechanism on devices of the closed platform?

A facial scan with no fallback

Correct Incorrect Correct answer

A six-digit numeric password

Correct Incorrect Correct answer

A four-digit numeric password

Correct Incorrect Correct answer

A pattern traced over a grid

Correct Incorrect Correct answer

Question 402 of 562

Why does the device ask for a passcode after a restart even when face unlock is enabled?

Because that offers enhanced protection in the case of a lost or stolen device

Correct Incorrect Correct answer

Because the camera is disabled until the system finishes booting after each reboot of the handset

Correct Incorrect Correct answer

Because the biometric data is erased on every restart

Correct Incorrect Correct answer

Because the carrier requires it before reconnecting

Correct Incorrect Correct answer

Question 403 of 562

What is face unlock on the closed platform?

A software feature that recognises the user by their typing pattern

Correct Incorrect Correct answer

A carrier feature that unlocks the device on a trusted network

Correct Incorrect Correct answer

A feature that unlocks the device when it recognises a paired watch

Correct Incorrect Correct answer

The facial-recognition technology that replaced the fingerprint mechanism on the later phone models

Correct Incorrect Correct answer

Question 404 of 562

What can an investigator do where a locked device of the closed platform is connected to a computer?

Read the biometric templates stored on the computer

Correct Incorrect Correct answer

Disable the restricted bus mode permanently

Correct Incorrect Correct answer

Use the lockdown records stored on the computer to perform logical acquisition without unlocking the device

Correct Incorrect Correct answer

Reset the passcode from that computer without data loss even where the device has since been rebooted

Correct Incorrect Correct answer

Question 405 of 562

What condition does the courseware attach to the use of lockdown files?

They allow backups only within one hour of seizure

Correct Incorrect Correct answer

They allow backups only on jailbroken devices

Correct Incorrect Correct answer

They allow backups only provided the device was never turned off or rebooted after seizure

Correct Incorrect Correct answer

They allow backups only where the passcode is also known and the device has been rebooted since seizure

Correct Incorrect Correct answer

Question 406 of 562

What is rooting on the open platform?

The process of removing the lock screen of the device

Correct Incorrect Correct answer

The process of attaining privileged control, known as root access, within the subsystem of the platform

Correct Incorrect Correct answer

The process of installing a modified set of kernel patches

Correct Incorrect Correct answer

The process of unlocking the boot loader of the device before any privileged command can be run

Correct Incorrect Correct answer

Question 407 of 562

What is the goal of rooting a device?

To overcome the restrictions imposed by hardware manufacturers and carriers, so system applications and settings can be modified or replaced

Correct Incorrect Correct answer

To improve the battery life of the device

Correct Incorrect Correct answer

To register the device with a different carrier without replacing the subscriber card in the handset or its account with the operator

Correct Incorrect Correct answer

To encrypt the user data partition

Correct Incorrect Correct answer

Question 408 of 562

What privileged commands does rooting enable user-installed applications to run?

Reading the subscriber card memory directly

Correct Incorrect Correct answer

Rewriting the equipment identity of the device

Correct Incorrect Correct answer

Decrypting the traffic between the phone and the tower

Correct Incorrect Correct answer

Modifying or deleting system files, modules, stock firmware, and kernels

Correct Incorrect Correct answer

Question 409 of 562

Which further capabilities does rooting bring?

Faster charging, longer battery life, and better signal reception

Correct Incorrect Correct answer

Free access to paid applications and services

Correct Incorrect Correct answer

Automatic backup of the user data to the cloud whenever the handset is connected to a charger overnight on the rooted handset

Correct Incorrect Correct answer

Removing carrier or manufacturer applications, low-level hardware access, improved performance, tethering, installing apps on a card, and a better interface

Correct Incorrect Correct answer

Question 410 of 562

Which risks does the courseware attach to rooting?

Permanent disabling of the cellular radio

Correct Incorrect Correct answer

Automatic reporting of the device to the carrier

Correct Incorrect Correct answer

Voiding the warranty of the phone, poor performance, malware infection, and bricking the device

Correct Incorrect Correct answer

Loss of the subscriber card and the equipment identity from the handset during the process

Correct Incorrect Correct answer

Question 411 of 562

Which tools does the courseware name for rooting devices of the open platform?

A chip programmer and a rework station

Correct Incorrect Correct answer

A one-click rooting product and a desktop root tool from a media suite

Correct Incorrect Correct answer

A screen unlocking suite and a configuration builder

Correct Incorrect Correct answer

A repository extractor and a third-party app manager which serve the closed platform instead

Correct Incorrect Correct answer

Question 412 of 562

What must happen before a device of the open platform can be rooted?

The boot loader must be unlocked, a security feature available since version five of the platform

Correct Incorrect Correct answer

The device must be connected to the cloud account of the user before the tool will recognise it

Correct Incorrect Correct answer

The device must be placed in the firmware upgrade mode

Correct Incorrect Correct answer

The subscriber card must be removed

Correct Incorrect Correct answer

Question 413 of 562

What should the investigator do before rooting a device, and why?

Take a backup of the device data or perform logical acquisition first, in order to avoid data loss

Correct Incorrect Correct answer

Remove the memory card so that it is not overwritten

Correct Incorrect Correct answer

Disable the lock screen so that the tool can connect

Correct Incorrect Correct answer

Record the equipment identity so the device can be traced if the handset should later be reported stolen

Correct Incorrect Correct answer

Question 414 of 562

Which form of acquisition can only be performed on a rooted device of the open platform?

Logical acquisition

Correct Incorrect Correct answer

Cloud data acquisition

Correct Incorrect Correct answer

Card acquisition

Correct Incorrect Correct answer

Physical acquisition

Correct Incorrect Correct answer

Question 415 of 562

Which sequence roots a device using a computer?

Unlock the boot loader, flash a custom recovery, then sideload a package

Correct Incorrect Correct answer

Place the device in recovery mode and clear the cache partition

Correct Incorrect Correct answer

Download and install the desktop version, run the tool, connect the device by cable, enable debugging, let the drivers install, then click the root button

Correct Incorrect Correct answer

Enable installation from unknown sources, download the package, install and launch it, then press one click root and wait a few seconds for the result to appear

Correct Incorrect Correct answer

Question 416 of 562

Which sequence roots a device without a computer?

Clear the cache partition from recovery mode

Correct Incorrect Correct answer

Enable installation from unknown sources, download the package from the store, install and launch it, press one click root, and wait for the result

Correct Incorrect Correct answer

Connect the device by cable and click the root button on the desktop once the drivers supplied with the tool have installed from the store on the handset

Correct Incorrect Correct answer

Unlock the boot loader from the developer options

Correct Incorrect Correct answer

Question 417 of 562

What does the courseware say to do if the rooting fails?

Return the device for chip-off forensics

Correct Incorrect Correct answer

Attempt the rooting multiple times, or try the computer version of the tool instead

Correct Incorrect Correct answer

Perform a factory reset and try again

Correct Incorrect Correct answer

Flash a custom recovery image and retry before attempting the rooting again with the same tool as before

Correct Incorrect Correct answer

Question 418 of 562

What consequence does the courseware attach to unlocking the boot loader and rooting the device manually?

It results in the removal of the data held on the device

Correct Incorrect Correct answer

It voids only the warranty and leaves the data intact held on that handset

Correct Incorrect Correct answer

It disables the lock screen permanently

Correct Incorrect Correct answer

It prevents the device from receiving updates

Correct Incorrect Correct answer

Question 419 of 562

Why does the courseware say rooting matters to the investigator?

Because it removes the passcode from the device

Correct Incorrect Correct answer

Because it decrypts the cloud backups of the account

Correct Incorrect Correct answer

Because it reveals the equipment identity of the device from the label under the battery

Correct Incorrect Correct answer

Because it allows access to system-level files and analysis of critical data during the investigation

Correct Incorrect Correct answer

Question 420 of 562

What else does root access help investigators do?

Transfer the account to another provider

Correct Incorrect Correct answer

Read the records held by the service provider once a court order has been granted

Correct Incorrect Correct answer

Retrieve and analyse deleted files, reconfigure the system, and retrieve other concealed information

Correct Incorrect Correct answer

Restore the device to its factory state

Correct Incorrect Correct answer

Question 421 of 562

Which of the three methods for accessing root files comes first?

Navigate to the root directory of the file system and read the hierarchy that it exposes there from the ordinary user directories

Correct Incorrect Correct answer

Enable the root explorer from the tools option

Correct Incorrect Correct answer

After the rooting is complete, install a root file manager application from the official store to reach the system files

Correct Incorrect Correct answer

Grant root access to the file manager application

Correct Incorrect Correct answer

Question 422 of 562

Once the manager is installed, what does the second method require?

Tap the icon at the top left of the manager to open the fast access menu there

Correct Incorrect Correct answer

Grant root access to the file manager application, which generally requests it during its initial launch

Correct Incorrect Correct answer

Install a root file manager from the official store

Correct Incorrect Correct answer

Navigate to the root directory to reach the hierarchy

Correct Incorrect Correct answer

Question 423 of 562

With access granted, where does the third method take the examiner?

Navigate to the root directory, which contains the complete file system hierarchy and the important system files and folders

Correct Incorrect Correct answer

Install the file manager from the official store and grant it the access it asks for on first launch

Correct Incorrect Correct answer

Grant root access to the file manager

Correct Incorrect Correct answer

Enable the root explorer switch

Correct Incorrect Correct answer

Question 424 of 562

What is the first step of the file manager procedure on a rooted device?

Tap the icon at the top left to open the fast access menu

Correct Incorrect Correct answer

Find and tap the tools option from the options list

Correct Incorrect Correct answer

Tap the on button beside the root explorer

Correct Incorrect Correct answer

Launch the file manager from the application drawer

Correct Incorrect Correct answer

Question 425 of 562

What is the second step of the file manager procedure?

Launch the manager from the application drawer of the rooted device under examination

Correct Incorrect Correct answer

Find and tap the tools option

Correct Incorrect Correct answer

Enable the root explorer

Correct Incorrect Correct answer

Tap the icon at the top left to open the fast access menu

Correct Incorrect Correct answer

Question 426 of 562

What is the third step of the file manager procedure?

Tap the on button beside the root explorer

Correct Incorrect Correct answer

Launch the manager from the application drawer

Correct Incorrect Correct answer

Find and tap the tools option from the options list

Correct Incorrect Correct answer

Open the fast access menu with the top-left icon

Correct Incorrect Correct answer

Question 427 of 562

What is the fourth step of the file manager procedure?

Grant root access when the manager first requests it

Correct Incorrect Correct answer

Find the root explorer in the list and tap the on button to enable it, after which the root files can be reached

Correct Incorrect Correct answer

Find and tap the tools option from the options list so that the list of available utilities is displayed beside the other menu entries

Correct Incorrect Correct answer

Open the fast access menu with the top-left icon

Correct Incorrect Correct answer

Question 428 of 562

How does the courseware define jailbreaking?

The process of installing a modified set of kernel patches that allow users to run third-party applications not signed by the operating system vendor

Correct Incorrect Correct answer

The process of attaining privileged control within the subsystem of the open platform once the boot loader of that device has been unlocked

Correct Incorrect Correct answer

The process of removing the lock screen of a device

Correct Incorrect Correct answer

The process of unlocking the boot loader of a device

Correct Incorrect Correct answer

Question 429 of 562

Which user limitations does jailbreaking bypass?

Those set by the vendor, such as modifying the operating system, attaining admin privileges, and installing unapproved apps by side loading

Correct Incorrect Correct answer

Those set by the carrier on network selection

Correct Incorrect Correct answer

Those set by the user in the parental controls to keep a child from installing unapproved applications or reaching an unsuitable website

Correct Incorrect Correct answer

Those set by the enterprise mobile management profile

Correct Incorrect Correct answer

Question 430 of 562

What does jailbreaking provide?

A copy of the device backup on the computer taken through the media application before the seizure and never refreshed afterwards

Correct Incorrect Correct answer

The passcode of the device

Correct Incorrect Correct answer

A permanent bypass of the restricted bus mode

Correct Incorrect Correct answer

Root access to the operating system, and the downloading of third-party applications, themes, and extensions unavailable through the official store

Correct Incorrect Correct answer

Question 431 of 562

What does jailbreaking remove, and what does that allow?

The kernel patch protection, which allows any firmware to be installed

Correct Incorrect Correct answer

The cloud account link, which allows the device to be resold through the official store

Correct Incorrect Correct answer

Sandbox restrictions, which allows malicious apps to access restricted mobile resources and information

Correct Incorrect Correct answer

The passcode requirement, which allows anyone to open the device

Correct Incorrect Correct answer

Question 432 of 562

Why do users jailbreak their devices, according to the courseware?

To reduce the storage used by the operating system so that more space is left for the user files

Correct Incorrect Correct answer

To expand the feature set restricted by the vendor and its store, or to install third-party security tools for testing

Correct Incorrect Correct answer

To extend the battery life of the device

Correct Incorrect Correct answer

To transfer the device to another carrier

Correct Incorrect Correct answer

Question 433 of 562

Which tools does the courseware name for jailbreaking devices of the closed platform?

A chip programmer and a flasher box

Correct Incorrect Correct answer

A repository extractor, a fruit-named tool, a bootrom-based tool, a further tool, and a package manager

Correct Incorrect Correct answer

A one-click rooting product and a desktop root tool

Correct Incorrect Correct answer

A screen unlock kit and a screen unlock suite which remove locks rather than kernel restrictions

Correct Incorrect Correct answer

Question 434 of 562

Which three conditions must be met before an investigator jailbreaks a device?

The device is unlocked, the device pairs with the computer, and the tool is selected for the version with a known vulnerability

Correct Incorrect Correct answer

The device is powered off, the card is removed, and a warrant is held

Correct Incorrect Correct answer

The device is rooted, debugging is enabled, and a cable is connected

Correct Incorrect Correct answer

The device is backed up, the passcode is known, and the cloud is disabled before the tool is allowed to touch the handset

Correct Incorrect Correct answer

Question 435 of 562

Why does jailbreaking help the acquisition?

It removes the need for a warrant

Correct Incorrect Correct answer

It converts the file system to a readable format

Correct Incorrect Correct answer

It uploads the device data to the cloud automatically as soon as the connection to the network is restored that other methods miss

Correct Incorrect Correct answer

The device should be jailbroken to perform logical and physical acquisition, and jailbreaking extracts additional pieces of information other methods miss

Correct Incorrect Correct answer

Question 436 of 562

Which risks does the courseware attach to jailbreaking?

Automatic notification of the vendor

Correct Incorrect Correct answer

Permanent loss of cellular service

Correct Incorrect Correct answer

Voiding the warranty of the phone, malware infection, poor performance, and bricking the device

Correct Incorrect Correct answer

Loss of the subscriber card and the equipment identity from the handset while the process runs

Correct Incorrect Correct answer

Question 437 of 562

On what do the risks of a particular jailbreak depend?

The carrier and the country of purchase

Correct Incorrect Correct answer

The size of the storage in the device

Correct Incorrect Correct answer

The jailbreaking tool chosen and the installation procedure followed

Correct Incorrect Correct answer

The age of the device and its battery health

Correct Incorrect Correct answer

Question 438 of 562

Why does jailbreaking create a forensic validity problem?

Because it prevents the device from being imaged

Correct Incorrect Correct answer

Because it violates the standards guidelines for mobile phone forensics, bypassing the security restrictions imposed by the manufacturer

Correct Incorrect Correct answer

Because it deletes the system logs of the device

Correct Incorrect Correct answer

Because it requires a warrant that courts rarely grant and would therefore delay the examination for months

Correct Incorrect Correct answer

Question 439 of 562

What is the first of the four forensic guidelines the courseware quotes?

No action performed by the investigator should change the data on the devices or storage media that may subsequently be relied upon in court

Correct Incorrect Correct answer

Individuals accessing the original data must be competent to do so

Correct Incorrect Correct answer

An audit trail suitable for replication by an independent third party must be created and preserved for as long as the case remains open

Correct Incorrect Correct answer

The person in charge has overall responsibility for compliance

Correct Incorrect Correct answer

Question 440 of 562

What is the second of the four forensic guidelines?

No action should change the data relied upon in court and that is the principle counsel usually cites first

Correct Incorrect Correct answer

An audit trail must be created and preserved

Correct Incorrect Correct answer

The person in charge has overall responsibility

Correct Incorrect Correct answer

Individuals accessing the original data must be competent to do so and have the ability to explain their actions

Correct Incorrect Correct answer

Question 441 of 562

What is the third of the four forensic guidelines?

Individuals accessing the data must be competent

Correct Incorrect Correct answer

No action should change the data relied upon in court and that guideline is the first of the four quoted rather than the third of them

Correct Incorrect Correct answer

The person in charge has overall responsibility

Correct Incorrect Correct answer

An audit trail or other record of applied processes, suitable for replicating the results by an independent third party, must be created and preserved

Correct Incorrect Correct answer

Question 442 of 562

What is the fourth of the four forensic guidelines?

Individuals accessing the data must be competent

Correct Incorrect Correct answer

No action should change the data relied upon in court and that guideline is the first rather than the last under the governing laws

Correct Incorrect Correct answer

The person in charge of the investigation has overall responsibility for ensuring the procedures are followed in compliance with the governing laws

Correct Incorrect Correct answer

An audit trail must be created and preserved

Correct Incorrect Correct answer

Question 443 of 562

Why does the courseware say a jailbreak may fail?

Because the passcode changes during the process

Correct Incorrect Correct answer

Because the process exploits chains of vulnerabilities on the device to obtain root privileges, and because several are exploited the process may fail

Correct Incorrect Correct answer

Because the tool must be signed by the vendor

Correct Incorrect Correct answer

Because the device must be connected to the carrier network and authenticated by the operator before it will start before the patches will apply

Correct Incorrect Correct answer

Question 444 of 562

Why could jailbreaks developed for earlier versions make a device unbootable?

Because they patched the device kernel and attempted to bypass the kernel patch protection by patching other parts of the system

Correct Incorrect Correct answer

Because they erased the user data partition first

Correct Incorrect Correct answer

Because they replaced the boot loader with an unsigned one which the device then refused to load at the next boot

Correct Incorrect Correct answer

Because they disabled the recovery mode

Correct Incorrect Correct answer

Question 445 of 562

Why are modern jailbreaks safer in this respect?

Because those targeting later versions do not modify the device kernel, so the kernel patch protection need not be dealt with

Correct Incorrect Correct answer

Because they run only from the recovery partition and leave the system partition entirely untouched at every reboot of the handset

Correct Incorrect Correct answer

Because they are signed by the vendor

Correct Incorrect Correct answer

Because they take a backup before starting

Correct Incorrect Correct answer

Question 446 of 562

What risk does connecting the device to the Internet during a jailbreak create?

It causes the device to download a firmware update automatically as soon as the connection is made

Correct Incorrect Correct answer

It reveals the location of the forensic laboratory

Correct Incorrect Correct answer

It registers the device with the vendor as jailbroken

Correct Incorrect Correct answer

It makes the device susceptible to pending remote commands that could wipe or erase the evidence

Correct Incorrect Correct answer

Question 447 of 562

Which jailbreak leaves the device starting completely with a patched kernel after a power cycle, without a computer?

Tethered jailbreaking

Correct Incorrect Correct answer

Semi-untethered jailbreaking

Correct Incorrect Correct answer

Untethered jailbreaking

Correct Incorrect Correct answer

Semi-tethered jailbreaking

Correct Incorrect Correct answer

Question 448 of 562

Which jailbreak leaves the device starting completely but without a patched kernel, while remaining usable for normal functions?

Semi-untethered jailbreaking

Correct Incorrect Correct answer

Semi-tethered jailbreaking

Correct Incorrect Correct answer

Untethered jailbreaking

Correct Incorrect Correct answer

Tethered jailbreaking

Correct Incorrect Correct answer

Question 449 of 562

Which jailbreak may leave the device stuck in a partially started state until it is re-jailbroken with a computer?

Semi-untethered jailbreaking

Correct Incorrect Correct answer

Tethered jailbreaking

Correct Incorrect Correct answer

Semi-tethered jailbreaking

Correct Incorrect Correct answer

Untethered jailbreaking

Correct Incorrect Correct answer

Question 450 of 562

Which jailbreak leaves the kernel unpatched on reboot but allows it to be patched without a computer?

Semi-untethered jailbreaking

Correct Incorrect Correct answer

Semi-tethered jailbreaking

Correct Incorrect Correct answer

Tethered jailbreaking

Correct Incorrect Correct answer

Untethered jailbreaking

Correct Incorrect Correct answer

Question 451 of 562

What is the repository extractor used for?

It is a lock screen removal tool for the open platform that removes number, pattern, and password locks alike without touching the kernel at all

Correct Incorrect Correct answer

It is a rooting tool for the open platform

Correct Incorrect Correct answer

It is a chip reading tool for damaged devices

Correct Incorrect Correct answer

It is a jailbreak repository extractor for the latest version of the closed platform, allowing investigators to install third-party solutions during an investigation

Correct Incorrect Correct answer

Question 452 of 562

Why is the repository extractor the most popular method of installing jailbreak apps?

Because it is the only method approved by the vendor

Correct Incorrect Correct answer

Because it works on devices of both platforms

Correct Incorrect Correct answer

Because it installs them without untethered or semi-untethered jailbreaking

Correct Incorrect Correct answer

Because it is distributed through the official store

Correct Incorrect Correct answer

Question 453 of 562

What do the repositories reached through the extractor contain?

The firmware images published by the vendor

Correct Incorrect Correct answer

The configuration profiles of enterprise management systems held in those repositories

Correct Incorrect Correct answer

Thousands of jailbreak tweaks, themes, games, and similar additions

Correct Incorrect Correct answer

Backups of the devices previously examined

Correct Incorrect Correct answer

Question 454 of 562

What must the investigator install before the repository extractor itself?

A root file manager

Correct Incorrect Correct answer

A third-party app manager, which allows the extractor to be installed free of charge

Correct Incorrect Correct answer

The desktop media application of the vendor installed on the examination workstation onto the device itself

Correct Incorrect Correct answer

A screen unlocking suite

Correct Incorrect Correct answer

Question 455 of 562

What are the first two steps of installing the repository extractor?

Tap the full entry in the third-party store, then click the install button in the upper right corner to receive the configuration profile

Correct Incorrect Correct answer

Navigate to settings and click the downloaded profile

Correct Incorrect Correct answer

Enter the screen password and click install again so that the profile can be trusted by the device before the extractor icon will appear

Correct Incorrect Correct answer

Open the extractor and select get repositories

Correct Incorrect Correct answer

Question 456 of 562

What is the third step of installing the repository extractor?

Tap the full entry in the third-party store

Correct Incorrect Correct answer

Enter the screen password and click install again

Correct Incorrect Correct answer

Paste the copied repository address into the extract option after the repository has been chosen

Correct Incorrect Correct answer

Navigate to settings, click the profile downloaded in the previous step, and click the install button

Correct Incorrect Correct answer

Question 457 of 562

What are the next two steps after the profile has been installed?

Open the extractor and select get repositories

Correct Incorrect Correct answer

Choose a repository and copy its address

Correct Incorrect Correct answer

Tap install to install the chosen jailbreaker once the repository address has been pasted and extracted from the categories the tool offers

Correct Incorrect Correct answer

Enter the screen password and click install again, after which the repository extractor icon appears on the home screen

Correct Incorrect Correct answer

Question 458 of 562

Which sequence describes the repository steps?

Navigate to settings and install the downloaded profile

Correct Incorrect Correct answer

Enter the screen password and click install again

Correct Incorrect Correct answer

Open the extractor, select get repositories, choose the repository of a desired jailbreaker, and copy its address from the given categories

Correct Incorrect Correct answer

Go to the extract option, paste the address, and select the confirmation button which are the extraction steps rather than the repository ones

Correct Incorrect Correct answer

Question 459 of 562

Which sequence describes the extraction steps?

Navigate to settings and click the downloaded profile

Correct Incorrect Correct answer

Go to the extract repository option, paste the copied address, extract by selecting the confirmation button, then tap install

Correct Incorrect Correct answer

Open the extractor and select get repositories

Correct Incorrect Correct answer

Tap the full entry in the third-party store and click install which are the first two installation steps of the extractor

Correct Incorrect Correct answer

Question 460 of 562

What happens at the end of the repository extractor procedure?

The icon of the selected jailbreaker app appears on the home screen of the device

Correct Incorrect Correct answer

The device reboots into recovery mode

Correct Incorrect Correct answer

The configuration profile is removed from settings and the third-party store closes by itself

Correct Incorrect Correct answer

The third-party app manager is uninstalled

Correct Incorrect Correct answer

Question 461 of 562

What is logical acquisition in mobile forensics?

The creation of a bit-by-bit copy of the logical storage on a mobile device, which generally recovers data that has not been deleted

Correct Incorrect Correct answer

The creation of a bit-by-bit copy of the physical storage, including hidden and deleted data which is the other of the two acquisition types

Correct Incorrect Correct answer

The extraction of the subscriber card in a card reader

Correct Incorrect Correct answer

The retrieval of the call records held by the provider

Correct Incorrect Correct answer

Question 462 of 562

What does the logical storage of a device contain?

The unallocated space of the file system

Correct Incorrect Correct answer

The system files hidden from the user which the platform keeps out of reach

Correct Incorrect Correct answer

The contents of the volatile memory

Correct Incorrect Correct answer

Objects such as the directories and files that are accessible to the user

Correct Incorrect Correct answer

Question 463 of 562

What cannot be captured under logical acquisition?

Contact lists and application data

Correct Incorrect Correct answer

Saved photos and videos

Correct Incorrect Correct answer

System files and deleted data

Correct Incorrect Correct answer

Call logs and text messages

Correct Incorrect Correct answer

Question 464 of 562

Which live data does logical acquisition recover?

The provider records and the cell site data

Correct Incorrect Correct answer

Call logs and text messages, passwords to active social media accounts, equipment and serial number data, contact lists, application data, and saved photos and videos

Correct Incorrect Correct answer

Deleted messages, unallocated space, and system files

Correct Incorrect Correct answer

The keychain, the boot loader, and the kernel which are system components rather than live user data held by the platform rather than the user

Correct Incorrect Correct answer

Question 465 of 562

What else does the courseware say can be considered logical acquisition?

A cloud account download

Correct Incorrect Correct answer

A full device backup

Correct Incorrect Correct answer

A physical image of the memory chip

Correct Incorrect Correct answer

A card extraction taken in a reader

Correct Incorrect Correct answer

Question 466 of 562

How is logical acquisition performed manually on each platform?

By running bridge commands in a terminal window on the open platform, and through the desktop file browser application on the closed platform

Correct Incorrect Correct answer

By running bridge commands on both platforms

Correct Incorrect Correct answer

By using the desktop file browser on both platforms with the bridge commands used only for the physical image and never over the bus cable

Correct Incorrect Correct answer

By using a card reader on both platforms

Correct Incorrect Correct answer

Question 467 of 562

Under what condition can manual logical acquisition be performed?

Only when the device has been rooted or jailbroken before the tool will connect at all

Correct Incorrect Correct answer

Only when the device is powered off

Correct Incorrect Correct answer

Only when the memory card has been removed

Correct Incorrect Correct answer

Only when the investigator has determined or bypassed the passcode of the device

Correct Incorrect Correct answer

Question 468 of 562

What is the debug bridge?

A network service that relays traffic between two devices

Correct Incorrect Correct answer

A background service that syncs the device with the cloud

Correct Incorrect Correct answer

A command-line utility that establishes a connection between a mobile device and a computer over the bus

Correct Incorrect Correct answer

A hardware adapter that connects a memory chip to a programmer after the chip has been removed from the board

Correct Incorrect Correct answer

Question 469 of 562

Which device actions do the bridge commands facilitate?

Reading the subscriber card and the equipment identity from the reader attached to the forensic workstation

Correct Incorrect Correct answer

Downloading the cloud backup of the account

Correct Incorrect Correct answer

Copying files back and forth, installing and uninstalling applications, and running shell commands on the device

Correct Incorrect Correct answer

Unlocking the screen and resetting the passcode

Correct Incorrect Correct answer

Question 470 of 562

What do the bridge commands allow an investigator to acquire?

The lockdown records held on the workstation

Correct Incorrect Correct answer

The root shell of the device, which can then be used to run various commands on it

Correct Incorrect Correct answer

The passcode of the device

Correct Incorrect Correct answer

The encryption keys of the file system as they are held in the secure element of the handset

Correct Incorrect Correct answer

Question 471 of 562

Which three components make up the debug bridge?

The client, the daemon, and the server

Correct Incorrect Correct answer

The shell, the terminal, and the driver

Correct Incorrect Correct answer

The bridge, the cable, and the port

Correct Incorrect Correct answer

The tool, the profile, and the report

Correct Incorrect Correct answer

Question 472 of 562

Where does the bridge client run, and what does it do?

On the mobile device, running the commands it receives

Correct Incorrect Correct answer

On the workstation, managing communication between the other two components between the process on the device and the one issuing commands

Correct Incorrect Correct answer

On the device, managing the connection to the cloud

Correct Incorrect Correct answer

On the forensic workstation, issuing the commands that install or uninstall applications and acquire data from the device

Correct Incorrect Correct answer

Question 473 of 562

What is the bridge daemon?

The background process on the workstation that manages communication

Correct Incorrect Correct answer

The component that issues commands from the workstation

Correct Incorrect Correct answer

The driver that installs when the device is connected when it is first plugged in

Correct Incorrect Correct answer

The background process that runs the issued commands on the device itself

Correct Incorrect Correct answer

Question 474 of 562

What is the bridge server?

The component that issues the commands from the workstation

Correct Incorrect Correct answer

A remote service operated by the platform vendor

Correct Incorrect Correct answer

The background process on the forensic workstation that manages the communication between the client and the daemon

Correct Incorrect Correct answer

The background process on the device that runs the commands once the commands have reached it over the bus

Correct Incorrect Correct answer

Question 475 of 562

What must be done before the bridge commands can control a device over the bus?

The investigator should first take a cloud backup

Correct Incorrect Correct answer

The investigator should first enable the debugging feature

Correct Incorrect Correct answer

The investigator should first root the device

Correct Incorrect Correct answer

The investigator should first remove the subscriber card

Correct Incorrect Correct answer

Question 476 of 562

What does the pull command do?

It fetches files and folders from the mobile device to the forensic workstation

Correct Incorrect Correct answer

It pushes files from the workstation onto the device in the opposite direction entirely

Correct Incorrect Correct answer

It sets up port forwarding between the two

Correct Incorrect Correct answer

It lists the devices connected to the workstation

Correct Incorrect Correct answer

Question 477 of 562

What is the syntax of the pull command?

The command name followed by the source directory and then the destination directory

Correct Incorrect Correct answer

The command name followed by the destination directory and then the source directory

Correct Incorrect Correct answer

The command name followed by an input file and an output file

Correct Incorrect Correct answer

The command name followed by a port number

Correct Incorrect Correct answer

Question 478 of 562

What happens if no destination directory is given to the pull command?

The command fails with an error

Correct Incorrect Correct answer

The files are pulled to the root of the workstation drive

Correct Incorrect Correct answer

The files are left on the device

Correct Incorrect Correct answer

The files are pulled to the current directory location in the terminal

Correct Incorrect Correct answer

Question 479 of 562

In what state must the device be for the pull command to be used?

Powered off and connected to a power source

Correct Incorrect Correct answer

Locked but connected to a trusted computer

Correct Incorrect Correct answer

Unlocked and unrooted, connected to the forensic workstation by a bus cable

Correct Incorrect Correct answer

Rooted and jailbroken, connected over the wireless network rather than by a bus cable

Correct Incorrect Correct answer

Question 480 of 562

How does a commercial tool perform logical acquisition?

The tool downloads the account backup from the cloud

Correct Incorrect Correct answer

The tool communicates with the device using its own programming language and extracts saved media files, contact lists, and call and text logs

Correct Incorrect Correct answer

The tool images the memory chip after it is removed

Correct Incorrect Correct answer

The tool reads the records held by the service provider once a court order for those records has been granted by the court hearing the case

Correct Incorrect Correct answer

Question 481 of 562

What limit does the courseware place on commercial logical acquisition?

It cannot be performed over a bus cable

Correct Incorrect Correct answer

It cannot be performed on locked or password-protected devices

Correct Incorrect Correct answer

It cannot be performed on rooted devices

Correct Incorrect Correct answer

It cannot recover contact lists

Correct Incorrect Correct answer

Question 482 of 562

How does the courseware describe the physical analyzer product?

A complete collection solution that examines more types of device and data in order to produce meaningful insights quickly

Correct Incorrect Correct answer

A card reader and its accompanying software

Correct Incorrect Correct answer

A chip programmer used to read removed memory after the chip has been cleaned and re-balled in the laboratory beforehand

Correct Incorrect Correct answer

A network capture appliance

Correct Incorrect Correct answer

Question 483 of 562

Which extractions does the physical analyzer perform, and by what methods?

Logical extractions only, using the bridge

Correct Incorrect Correct answer

Physical extractions only, using a chip programmer attached to the board after the chip has been removed that the vendor supports

Correct Incorrect Correct answer

Cloud extractions only, using account credentials

Correct Incorrect Correct answer

Logical, file system, and physical extractions, using exclusive boot loaders, the advanced bridge, the download mode, and other methods

Correct Incorrect Correct answer

Question 484 of 562

Which set of additional logical acquisition tools does the courseware list for the open platform?

A cloud edition and a cloud explorer

Correct Incorrect Correct answer

A programmer, a rework station, and a flasher box

Correct Incorrect Correct answer

A logical extraction product, a mobile evidence suite, a detective product, a forensic express edition, and a next-generation acquisition tool

Correct Incorrect Correct answer

A detective product, a universal extraction device, an evidence center, a forensic product, and an acquisition tool which serve the closed platform instead

Correct Incorrect Correct answer

Question 485 of 562

On what kind of device can the desktop file browser be used to obtain a backup?

A rooted device of the open platform

Correct Incorrect Correct answer

A device that has been powered off since seizure

Correct Incorrect Correct answer

An unlocked and unjailbroken device of the closed platform

Correct Incorrect Correct answer

A locked device of the closed platform

Correct Incorrect Correct answer

Question 486 of 562

What is the first step of the file browser backup?

Click the back up now button

Correct Incorrect Correct answer

Connect the phone to the desktop computer by a bus cable

Correct Incorrect Correct answer

Select the connected device name in the sidebar

Correct Incorrect Correct answer

Choose to back up all the data to this computer

Correct Incorrect Correct answer

Question 487 of 562

What happens at the second step of the file browser backup?

The device asks for the device passcode, or asks the examiner to trust this computer

Correct Incorrect Correct answer

The examiner selects the device name in the sidebar from the list the file browser presents

Correct Incorrect Correct answer

The backup begins immediately

Correct Incorrect Correct answer

The examiner sets the encryption password

Correct Incorrect Correct answer

Question 488 of 562

What is the third step of the file browser backup?

Connect the phone by a bus cable and answer the trust prompt that appears on the screen

Correct Incorrect Correct answer

Select encrypt local backup

Correct Incorrect Correct answer

Click back up now

Correct Incorrect Correct answer

Select the connected device name displayed in the sidebar of any window in the file browser

Correct Incorrect Correct answer

Question 489 of 562

What is selected under the backups heading at the fourth step?

The option to back up the most important data to the cloud rather than to the local machine

Correct Incorrect Correct answer

The option to encrypt the local backup

Correct Incorrect Correct answer

The option to restore a previous backup

Correct Incorrect Correct answer

The option to back up all of the data on the phone to this computer

Correct Incorrect Correct answer

Question 490 of 562

What does the examiner do at the fifth step of the file browser backup?

Click the back up now button

Correct Incorrect Correct answer

Connect the device by cable

Correct Incorrect Correct answer

Select the encrypt local backup option, then set or change the password that will protect the backup

Correct Incorrect Correct answer

Select the device name in the sidebar once the device has been trusted by the computer

Correct Incorrect Correct answer

Question 491 of 562

What is the sixth and last step of the file browser backup?

Trust the computer on the device

Correct Incorrect Correct answer

Click the back up now button to start the backup running

Correct Incorrect Correct answer

Select the encrypt local backup option

Correct Incorrect Correct answer

Select the connected device in the sidebar from the list the browser shows

Correct Incorrect Correct answer

Question 492 of 562

What can the investigator retrieve from the file browser even where the device is not jailbroken?

Shared files, media files, and property list files, which can serve as potential evidence

Correct Incorrect Correct answer

The full file system image of the device including the areas the user cannot reach

Correct Incorrect Correct answer

The keychain and its encryption keys

Correct Incorrect Correct answer

The deleted messages held in unallocated space

Correct Incorrect Correct answer

Question 493 of 562

Where is the backup created by the file browser stored on the computer?

Under the library directory, then application support, then the mobile synchronization folder, then the backup folder

Correct Incorrect Correct answer

Under the documents directory of the user

Correct Incorrect Correct answer

Under the temporary directory of the operating system where files are cleared at every restart of the machine

Correct Incorrect Correct answer

Under the applications directory of the computer

Correct Incorrect Correct answer

Question 494 of 562

Why must the passcode of the device be known for this backup?

Because the backup is encrypted with the passcode itself and cannot be opened again without that same code

Correct Incorrect Correct answer

Because the computer refuses to pair without it

Correct Incorrect Correct answer

Because the platform vendor requires it for licensing

Correct Incorrect Correct answer

Because when the investigator attempts to take a backup through the file browser, the device prompts for a passcode

Correct Incorrect Correct answer

Question 495 of 562

Why should the investigator create password-protected backups?

Because they are smaller and quicker to create

Correct Incorrect Correct answer

Because they can be restored to a different device

Correct Incorrect Correct answer

Because they contain more data than unprotected backups

Correct Incorrect Correct answer

Because they are the only kind the tool will produce

Correct Incorrect Correct answer

Question 496 of 562

What does the named forensic toolkit allow investigators to perform?

A network capture between the device and the tower

Correct Incorrect Correct answer

A full file system and logical acquisition of the phone, tablet, and media player devices of the closed platform

Correct Incorrect Correct answer

A physical acquisition of any device of the open platform once that device has been rooted and debugging enabled

Correct Incorrect Correct answer

A card acquisition using a reader

Correct Incorrect Correct answer

Question 497 of 562

What else does the forensic toolkit allow?

Wiping the device after acquisition

Correct Incorrect Correct answer

Imaging the device file system, extracting device secrets such as passwords, encryption keys, and protected data, and decrypting the file system image

Correct Incorrect Correct answer

Removing the passcode from the device permanently so that no passcode is needed on any later occasion and without any further authority

Correct Incorrect Correct answer

Rooting the device without a computer

Correct Incorrect Correct answer

Question 498 of 562

What can the toolkit extract from a locked device of the closed platform?

Media files, the camera roll, books, voice recordings, the media library, device information, shared files, and crash and diagnostic logs

Correct Incorrect Correct answer

The full unallocated space of the file system carved from the image after the acquisition has finished by a separate carving pass

Correct Incorrect Correct answer

The keychain in decrypted form only

Correct Incorrect Correct answer

The provider call detail records

Correct Incorrect Correct answer

Question 499 of 562

How is a locked device of the closed platform acquired logically?

Using the bridge commands after enabling debugging

Correct Incorrect Correct answer

Using the recovery mode of the device

Correct Incorrect Correct answer

Using the memory card of the device after it has been removed and read in a card reader

Correct Incorrect Correct answer

Using the lockdown files present on the computer of the user, unless the restricted bus mode has been activated

Correct Incorrect Correct answer

Question 500 of 562

Which set of additional logical acquisition tools does the courseware list for the closed platform?

A cloud edition and a cloud explorer

Correct Incorrect Correct answer

A screen unlock kit and a screen unlock suite

Correct Incorrect Correct answer

A detective product, a universal extraction device, an evidence center, a forensic product, and an acquisition tool

Correct Incorrect Correct answer

A logical extraction product, a mobile evidence suite, and a next-generation acquisition tool which serve the open platform instead

Correct Incorrect Correct answer

Question 501 of 562

What does the named acquisition imaging tool recover, and from what?

Call records from the service provider

Correct Incorrect Correct answer

Memory chip images after chip removal

Correct Incorrect Correct answer

Forensic images as evidence from devices of both platforms, from hard drives, and from bus drives

Correct Incorrect Correct answer

Card data from a reader attached to the workstation once that card has been removed from the handset

Correct Incorrect Correct answer

Question 502 of 562

What is the first step of the imaging tool procedure?

View the status of the image being created and wait until the creation of that image is complete

Correct Incorrect Correct answer

Open the tool, select the device from which data is to be acquired, and click the next button

Correct Incorrect Correct answer

Click the options button and select preferences

Correct Incorrect Correct answer

Create an evidence folder and click acquire

Correct Incorrect Correct answer

Question 503 of 562

What must be true before the imaging tool can acquire from a device, and what does the tool then do?

Debugging must be enabled on the device, and the tool searches automatically for connected devices

Correct Incorrect Correct answer

The device must be rooted, and the tool installs a root agent

Correct Incorrect Correct answer

The device must be jailbroken, and the tool opens a secure shell

Correct Incorrect Correct answer

The card must be removed, and the tool reads it in a reader in the tool window

Correct Incorrect Correct answer

Question 504 of 562

What is the second step of the imaging tool procedure?

Select the device and click next

Correct Incorrect Correct answer

Create an evidence folder and click acquire

Correct Incorrect Correct answer

Open the archive named for the device and read the contacts, logs, and messages inside it named for that device

Correct Incorrect Correct answer

Click the options button at the top right, select preferences, enable the app downgrading option, and click save

Correct Incorrect Correct answer

Question 505 of 562

What is the third step of the imaging tool procedure?

Enable the app downgrading option and click save

Correct Incorrect Correct answer

View the status of the image being created

Correct Incorrect Correct answer

Click open folder to view the extracted evidence once the image has been created successfully on the workstation running the tool

Correct Incorrect Correct answer

Create an evidence folder, then click the acquire button to start acquiring the evidence from the selected device

Correct Incorrect Correct answer

Question 506 of 562

What happens at the fourth step of the imaging tool procedure?

The examiner opens the archive of acquired files

Correct Incorrect Correct answer

The examiner selects the device to acquire from from the list of devices the tool has found automatically

Correct Incorrect Correct answer

The examiner views the status of the image being created and waits until the creation is complete

Correct Incorrect Correct answer

The examiner creates the evidence folder

Correct Incorrect Correct answer

Question 507 of 562

What is the fifth step of the imaging tool procedure?

Double-click the archive to view the acquired files

Correct Incorrect Correct answer

Once the image has been created successfully, click the open folder button to view the extracted evidence

Correct Incorrect Correct answer

Click the acquire button to start the process after the evidence folder has been created for it

Correct Incorrect Correct answer

Enable app downgrading in the preferences

Correct Incorrect Correct answer

Question 508 of 562

What is the sixth and last step of the imaging tool procedure?

Double-click the archive created with the name of the selected device and open it to view the acquired files, including contacts, logs, and messages

Correct Incorrect Correct answer

Click the open folder button to view the evidence once the image creation has finished on the workstation and hashed by the tool itself

Correct Incorrect Correct answer

View the status of the image creation

Correct Incorrect Correct answer

Select preferences and enable app downgrading

Correct Incorrect Correct answer

Question 509 of 562

How does the courseware define cloud forensics as it applies to mobile devices?

The part of digital forensics focused on the extraction of digital evidence from cloud storage, including network assets, application data, and server data

Correct Incorrect Correct answer

The extraction of evidence from the memory card of the device

Correct Incorrect Correct answer

The extraction of evidence from the records of the service provider

Correct Incorrect Correct answer

The extraction of evidence from the internal memory of the device which is where the acquisition methods already reach through the ordinary acquisition route

Correct Incorrect Correct answer

Question 510 of 562

Why does synchronization matter to a mobile investigation?

Because synchronization erases the local copy of the data as soon as the account has been signed into again

Correct Incorrect Correct answer

Because synchronization encrypts the device storage

Correct Incorrect Correct answer

Because synchronization prevents remote wiping

Correct Incorrect Correct answer

Because when synchronization is turned on, the activities of the user are recorded in the cloud storage

Correct Incorrect Correct answer

Question 511 of 562

Which cloud service does each mobile platform use?

Both platforms use the storage of the carrier

Correct Incorrect Correct answer

Devices of both platforms use a third-party service chosen by the user and configure it themselves when the handset is set up

Correct Incorrect Correct answer

Devices of the open platform use the drive storage of their vendor, and devices of the closed platform use their own cloud storage

Correct Incorrect Correct answer

Both platforms use the same shared cloud service

Correct Incorrect Correct answer

Question 512 of 562

What does the cloud data of the open platform include?

The call detail records of the subscriber

Correct Incorrect Correct answer

Mail, contacts, data stored on the drive, browser bookmarks, the location history of the user, and the registered devices of the account

Correct Incorrect Correct answer

The full device backup including settings and app data as it would have been written by the desktop application onto the machine of the user

Correct Incorrect Correct answer

The keychain and its stored credentials

Correct Incorrect Correct answer

Question 513 of 562

Why must investigators obtain credentials from the provider for the open platform cloud?

Because the provider deletes the data after thirty days

Correct Incorrect Correct answer

Because the latest versions do not provide cloud backups, so the identifier and password must be legally obtained to reach the stored data

Correct Incorrect Correct answer

Because the platform encrypts the cloud data with a key held by the provider and releases that key only under a court order

Correct Incorrect Correct answer

Because the account cannot be reached from a workstation

Correct Incorrect Correct answer

Question 514 of 562

What do the cloud backups of the closed platform contain?

The same information as the backups created through the desktop media application

Correct Incorrect Correct answer

Only the photographs and videos of the account and nothing else of the account

Correct Incorrect Correct answer

Only the contacts and calendar entries

Correct Incorrect Correct answer

Only the settings of the device

Correct Incorrect Correct answer

Question 515 of 562

What does an investigator need in order to obtain the cloud backups of the closed platform?

A warrant addressed to the device manufacturer

Correct Incorrect Correct answer

The passcode of the device and a bus cable which serve a local backup rather than a cloud download taken at the forensic workstation

Correct Incorrect Correct answer

The lockdown records held on the workstation

Correct Incorrect Correct answer

An account identifier and password, or a binary authentication token taken from the computer of the user that is synced with the device

Correct Incorrect Correct answer

Question 516 of 562

What should an investigator do where the account identifier and password are not available?

Recover the credentials from the keychain of the device once it has been decrypted there

Correct Incorrect Correct answer

Abandon the cloud line of enquiry

Correct Incorrect Correct answer

Obtain that information directly from the cloud service providers in a legal manner

Correct Incorrect Correct answer

Reset the account password using the device

Correct Incorrect Correct answer

Question 517 of 562

Which tools does the courseware name for cloud data acquisition?

A screen unlock kit and a rooting product which remove locks and gain root instead

Correct Incorrect Correct answer

A chip programmer and a rework station

Correct Incorrect Correct answer

A cloud edition of one mobile suite and a cloud explorer from another vendor

Correct Incorrect Correct answer

A physical analyzer and a forensic toolkit

Correct Incorrect Correct answer

Question 518 of 562

What can the cloud tools extract from the account synced with a mobile device?

The call detail records held by the carrier

Correct Incorrect Correct answer

Contacts, messages, browsing history, files and documents held on the drive, the location history of the user, and calendar data

Correct Incorrect Correct answer

The unallocated space of the device file system

Correct Incorrect Correct answer

The keychain and the encryption keys of the device which are extracted from the handset by a platform toolkit

Correct Incorrect Correct answer

Question 519 of 562

What is physical acquisition in mobile forensics?

The creation of a bit-by-bit copy of the data stored in the physical storage media of a phone, including hidden and deleted data

Correct Incorrect Correct answer

The creation of a copy of the logical storage accessible to the user which is the other of the two acquisition types named

Correct Incorrect Correct answer

The retrieval of the records held by the service provider

Correct Incorrect Correct answer

The download of the cloud backup for the account

Correct Incorrect Correct answer

Question 520 of 562

What does physical acquisition extract from the device?

Only the files visible to the user

Correct Incorrect Correct answer

Only the deleted files in unallocated space

Correct Incorrect Correct answer

Only the data held on the memory card and nothing held in the internal memory

Correct Incorrect Correct answer

All data from the device, including both the allocated and the unallocated space

Correct Incorrect Correct answer

Question 521 of 562

Why is performing physical acquisition of mobile phone data challenging?

Because the process always destroys the evidence

Correct Incorrect Correct answer

Because no tool supports more than one platform

Correct Incorrect Correct answer

Because mobile device manufacturers often do not allow users to read the device memory arbitrarily

Correct Incorrect Correct answer

Because the devices have no physical storage to image or none that a tool could reach

Correct Incorrect Correct answer

Question 522 of 562

What can a successful physical acquisition provide?

Only the current contents of the volatile memory at the moment the acquisition tool was connected

Correct Incorrect Correct answer

Deleted text messages, contacts, call logs, passwords, location and positioning data, deleted files, photos, and videos

Correct Incorrect Correct answer

Only the contacts and the call logs

Correct Incorrect Correct answer

Only the records held by the provider

Correct Incorrect Correct answer

Question 523 of 562

On which devices can physical acquisition be performed manually?

Only devices that are powered off

Correct Incorrect Correct answer

Rooted devices of the open platform and jailbroken devices of the closed platform

Correct Incorrect Correct answer

Any device with a memory card inserted whatever the lock state of that device

Correct Incorrect Correct answer

Any device that is unlocked

Correct Incorrect Correct answer

Question 524 of 562

What advantage does the courseware attach to physical data acquisition?

It eliminates the risk of compromising data integrity by using a write-blocker mechanism on the interface to create the copy

Correct Incorrect Correct answer

It is faster than logical acquisition in every case whatever the size of the storage in the handset on the interface in use

Correct Incorrect Correct answer

It requires no legal authority

Correct Incorrect Correct answer

It works on damaged devices without special equipment

Correct Incorrect Correct answer

Question 525 of 562

What does physical data acquisition leave on the device once it is complete?

A log entry recording the acquisition

Correct Incorrect Correct answer

A forensic agent that must be uninstalled

Correct Incorrect Correct answer

A modified boot loader

Correct Incorrect Correct answer

No traces of the investigation at all

Correct Incorrect Correct answer

Question 526 of 562

Which tools does the courseware name as able to perform physical acquisition without rooting or jailbreaking?

A chip programmer, a rework station, and a flasher box

Correct Incorrect Correct answer

A cloud edition, a cloud explorer, and a detective product

Correct Incorrect Correct answer

A premium extraction product, a forensic express edition, and a platform forensic toolkit

Correct Incorrect Correct answer

A screen unlock kit, a rooting product, and a repository extractor without rooting the handset

Correct Incorrect Correct answer

Question 527 of 562

How does the courseware describe the first physical acquisition scenario?

A forensic image acquired through a secure shell connection

Correct Incorrect Correct answer

A forensic image acquired with a chip programmer

Correct Incorrect Correct answer

A forensic image acquired from a rooted device using the disk dump command, which it calls a local acquisition

Correct Incorrect Correct answer

A forensic image acquired using the network utility, which it calls a remote acquisition rather than a local one written to a card

Correct Incorrect Correct answer

Question 528 of 562

What must be in place before the local physical acquisition can run?

A write-blocker attached to the workstation

Correct Incorrect Correct answer

A memory card inserted in the device with enough storage space to hold the evidence file

Correct Incorrect Correct answer

A wireless network with a static address

Correct Incorrect Correct answer

A secure shell package installed on the device so that a remote login can be established over the network

Correct Incorrect Correct answer

Question 529 of 562

What is the first step of the local physical acquisition?

Connect the device to the forensic workstation using a bus cable

Correct Incorrect Correct answer

Acquire the root shell of the device

Correct Incorrect Correct answer

Identify the source and destination drives

Correct Incorrect Correct answer

Run the dump command with a block size before any command is issued

Correct Incorrect Correct answer

Question 530 of 562

What is the second step of the local physical acquisition?

Connect the device by a bus cable

Correct Incorrect Correct answer

Run the dump command against the source drive against the drive identified as the source of the image

Correct Incorrect Correct answer

Insert a memory card with enough space

Correct Incorrect Correct answer

Use the development kit platform tools and the bridge commands to acquire the root shell of the device

Correct Incorrect Correct answer

Question 531 of 562

What is done at the third step of the local physical acquisition?

Set up port forwarding between the device and the workstation so that the two can reach each other over the network

Correct Incorrect Correct answer

Establish a secure shell connection to the device

Correct Incorrect Correct answer

Open the archive of acquired files

Correct Incorrect Correct answer

After entering the root shell, identify the source and destination drives and use the dump command to acquire the physical image

Correct Incorrect Correct answer

Question 532 of 562

Which arguments does the dump command take in the local acquisition?

A port number and an address

Correct Incorrect Correct answer

A device name and a profile name

Correct Incorrect Correct answer

An input file naming the source drive, an output file naming the destination, and a block size

Correct Incorrect Correct answer

A source directory and a destination directory named in that order after the command itself given after the command name

Correct Incorrect Correct answer

Question 533 of 562

How does the courseware describe the second physical acquisition scenario?

A forensic image acquired by removing the memory chip

Correct Incorrect Correct answer

A forensic image acquired from a rooted device using the network utility, which it calls a remote acquisition

Correct Incorrect Correct answer

A forensic image acquired using the dump command written to a memory card rather than sent across the network

Correct Incorrect Correct answer

A forensic image acquired through the desktop file browser

Correct Incorrect Correct answer

Question 534 of 562

Why is the remote scenario used rather than the local one?

Because the device has no external storage feature by default, so the image cannot be written to a card

Correct Incorrect Correct answer

Because the device is locked and cannot be rooted

Correct Incorrect Correct answer

Because the workstation has no bus port

Correct Incorrect Correct answer

Because the dump command is unavailable on that device and no substitute for it exists on that platform

Correct Incorrect Correct answer

Question 535 of 562

What does the network utility allow?

The transfer of files across network connections using the connection-oriented and datagram transport protocols

Correct Incorrect Correct answer

The imaging of a memory chip removed from the device in a programmer with an adapter

Correct Incorrect Correct answer

The bypass of the lock screen on the device

Correct Incorrect Correct answer

The recovery of deleted files from unallocated space

Correct Incorrect Correct answer

Question 536 of 562

What does the shell toolbox software installed on the device provide?

A graphical file manager for the device

Correct Incorrect Correct answer

A secure shell server for remote login

Correct Incorrect Correct answer

A write blocker for the bus interface placed between the device and the workstation

Correct Incorrect Correct answer

Access to the root commands that help investigators during the physical acquisition process

Correct Incorrect Correct answer

Question 537 of 562

What limit does the courseware place on the shell toolbox software?

It works on the closed platform only

Correct Incorrect Correct answer

It works over the bus only

Correct Incorrect Correct answer

It works on rooted devices only

Correct Incorrect Correct answer

It works on locked devices only

Correct Incorrect Correct answer

Question 538 of 562

What is the first step of the remote physical acquisition?

Initiate the connection from the workstation

Correct Incorrect Correct answer

Install the toolbox program on the mobile device and the network utility on the forensic workstation

Correct Incorrect Correct answer

Set up arbitrary port forwarding with the bridge forward command before the utility has been installed

Correct Incorrect Correct answer

Set up a listening connection on the mobile device

Correct Incorrect Correct answer

Question 539 of 562

What is done at the second step of the remote physical acquisition?

Read the image from the current directory

Correct Incorrect Correct answer

On the workstation, set up arbitrary port forwarding with the bridge forward command to establish a connection between device and workstation

Correct Incorrect Correct answer

Install the toolbox program on the device

Correct Incorrect Correct answer

Pipe the dump output through the network utility on a port chosen by the examiner for the transfer and left listening for a connection

Correct Incorrect Correct answer

Question 540 of 562

What is done at the third step of the remote physical acquisition?

Set up a listening connection on the mobile device, piping the output of the dump command through the network utility on a chosen port

Correct Incorrect Correct answer

Set up port forwarding on the workstation

Correct Incorrect Correct answer

Initiate the connection from the workstation to the device address on the port the listening utility has already opened and left open for the transfer

Correct Incorrect Correct answer

Install the network utility on the device

Correct Incorrect Correct answer

Question 541 of 562

What does the listening network utility do when a connection is made on the chosen port?

It writes the incoming data to the memory card of the device as the transfer proceeds over the network

Correct Incorrect Correct answer

It forwards the connection to a second device

Correct Incorrect Correct answer

It closes the connection and logs the attempt

Correct Incorrect Correct answer

It reads the disk partition and transfers all the data to the workstation that made the connection

Correct Incorrect Correct answer

Question 542 of 562

What is the fourth step of the remote physical acquisition?

Install the toolbox on the device

Correct Incorrect Correct answer

Set up port forwarding on the device

Correct Incorrect Correct answer

On the forensic workstation, initiate a connection on the same port to the specific address of the device

Correct Incorrect Correct answer

Set up the listening connection on the device so that it waits for a connection on the chosen port

Correct Incorrect Correct answer

Question 543 of 562

Where does the image file land at the end of the remote acquisition?

In the evidence folder created by the tool

Correct Incorrect Correct answer

In the root directory of the device file system beside the partitions it mounts

Correct Incorrect Correct answer

In the current directory location in the terminal of the forensic workstation

Correct Incorrect Correct answer

On the memory card inserted in the device

Correct Incorrect Correct answer

Question 544 of 562

Which tools does the courseware name for logical and physical extraction of the latest devices of the open platform?

A programmer, a rework station, and a burn-in adapter

Correct Incorrect Correct answer

A detective product, a forensic express edition, and a premium extraction product

Correct Incorrect Correct answer

A screen unlock kit, a rooting product, and a file manager

Correct Incorrect Correct answer

A cloud edition and a cloud explorer

Correct Incorrect Correct answer

Question 545 of 562

Which device artifacts do those commercial tools help investigators extract and examine?

System files, the geolocation of the device, user accounts, and deleted data

Correct Incorrect Correct answer

The call detail records held by the provider under a court order for them

Correct Incorrect Correct answer

The keychain and its stored credentials

Correct Incorrect Correct answer

The cloud backups of the account

Correct Incorrect Correct answer

Question 546 of 562

What is the first step of physical acquisition on a jailbroken device?

Connect the device to the network by secure shell

Correct Incorrect Correct answer

Use the network utility to initiate a socket

Correct Incorrect Correct answer

Take a backup of the device

Correct Incorrect Correct answer

Create a wireless network with a static address

Correct Incorrect Correct answer

Question 547 of 562

Why must the device and the workstation be on the same network?

To speed up the transfer of the image

Correct Incorrect Correct answer

To allow the device to reach the cloud service

Correct Incorrect Correct answer

To let the device receive a firmware update

Correct Incorrect Correct answer

To maintain data integrity during the acquisition

Correct Incorrect Correct answer

Question 548 of 562

What does the second step of the jailbroken acquisition achieve?

Acquiring the image file with the dump command

Correct Incorrect Correct answer

Taking a backup of the device before acquisition

Correct Incorrect Correct answer

Connecting the device to the network by secure shell, which lets the investigator control it and run commands to reach the file system

Correct Incorrect Correct answer

Creating the wireless network with a static address to which both the device and the workstation attach before the secure shell package is installed

Correct Incorrect Correct answer

Question 549 of 562

What does the courseware say jailbroken devices allow, which makes the remote connection possible?

The removal of the restricted bus mode

Correct Incorrect Correct answer

The installation of the open secure shell package

Correct Incorrect Correct answer

The installation of the shell toolbox software

Correct Incorrect Correct answer

The enabling of the debugging mode

Correct Incorrect Correct answer

Question 550 of 562

What is done at the third step of the jailbroken acquisition?

Use the network utility to initiate a socket between device and workstation, then use the dump command to acquire the image file

Correct Incorrect Correct answer

Create the wireless network with the static address and attach the workstation to that same network over a static address chosen by the examiner

Correct Incorrect Correct answer

Establish the secure shell connection

Correct Incorrect Correct answer

Enable app downgrading in the tool preferences

Correct Incorrect Correct answer

Question 551 of 562

What does the courseware say the investigator should do before performing physical acquisition?

Take a backup of the device

Correct Incorrect Correct answer

Remove the subscriber card

Correct Incorrect Correct answer

Disable the wireless network

Correct Incorrect Correct answer

Reset the passcode of the device

Correct Incorrect Correct answer

Question 552 of 562

What do the named passcode-bypassing tools allow investigators to do?

Bypass the boot loader lock on devices of the open platform so that a custom image can be flashed

Correct Incorrect Correct answer

Recover the cloud credentials of the account

Correct Incorrect Correct answer

Read a memory chip removed from the device

Correct Incorrect Correct answer

Bypass the passcodes of the latest devices of the closed platform without jailbreaking them

Correct Incorrect Correct answer

Question 553 of 562

What evidence do those tools let investigators examine?

The cell site data held by the operator held on the device

Correct Incorrect Correct answer

The registration details of the device

Correct Incorrect Correct answer

Third-party application data, system logs, deleted content, and chat conversations

Correct Incorrect Correct answer

The call detail records of the subscriber

Correct Incorrect Correct answer

Question 554 of 562

What can those tools do on a device that is still locked?

Perform a cloud acquisition instead

Correct Incorrect Correct answer

Perform only a partial file system extraction

Correct Incorrect Correct answer

Perform a full physical acquisition as usual

Correct Incorrect Correct answer

Perform no extraction at all

Correct Incorrect Correct answer

Question 555 of 562

Which file on the closed platform contains the geolocation data of applications and system services?

The photos database

Correct Incorrect Correct answer

The clients property list

Correct Incorrect Correct answer

The cookies property list

Correct Incorrect Correct answer

The keyboard cache

Correct Incorrect Correct answer

Question 556 of 562

Which file contains the cookies saved for websites accessed in the built-in browser?

The cookies property list

Correct Incorrect Correct answer

The clients property list

Correct Incorrect Correct answer

The bookmarks database

Correct Incorrect Correct answer

The safe browsing database

Correct Incorrect Correct answer

Question 557 of 562

What does the keyboard cache comprise?

The clipboard contents of the device

Correct Incorrect Correct answer

The autocorrect dictionary supplied by the vendor

Correct Incorrect Correct answer

The keystroke timings recorded by the system as the user pressed each key on the software keyboard

Correct Incorrect Correct answer

The texts entered by the user that are cached by the device, which may include a cached password

Correct Incorrect Correct answer

Question 558 of 562

Why does a password found in the keyboard cache matter to the examiner?

It unlocks the subscriber card

Correct Incorrect Correct answer

It decrypts the cloud backups automatically

Correct Incorrect Correct answer

It can be used for tasks such as taking the backup of an encrypted device or performing a brute-force attack

Correct Incorrect Correct answer

It proves that the device belongs to the suspect and that no other person could have used it cached by the device

Correct Incorrect Correct answer

Question 559 of 562

Which database contains the information of all contacts on the device?

The message database

Correct Incorrect Correct answer

The calendar database

Correct Incorrect Correct answer

The address book database

Correct Incorrect Correct answer

The call history database

Correct Incorrect Correct answer

Question 560 of 562

Which database maintains a log of missed, incoming, and received calls with their metadata?

The message database

Correct Incorrect Correct answer

The call history database

Correct Incorrect Correct answer

The address book database

Correct Incorrect Correct answer

The voicemail database

Correct Incorrect Correct answer

Question 561 of 562

Which database stores received, sent, and deleted text messages?

The message database

Correct Incorrect Correct answer

The draft message file

Correct Incorrect Correct answer

The call history database

Correct Incorrect Correct answer

The address book database

Correct Incorrect Correct answer

Question 562 of 562

Which file contains the messages that were composed but never sent?

The message database

Correct Incorrect Correct answer

The voicemail database

Correct Incorrect Correct answer

The calendar database

Correct Incorrect Correct answer

The draft message file

Correct Incorrect Correct answer

CHFI Fast Track Module 14 Quiz Level 1 – Keyword Recall

CHFI Fast Track Module 14 Quiz Level 1 – Keyword Recall

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

41. Question

42. Question

43. Question

44. Question

45. Question

46. Question

47. Question

48. Question

49. Question

50. Question

51. Question

52. Question

53. Question

54. Question

55. Question

56. Question

57. Question

58. Question

59. Question

60. Question

61. Question

62. Question

63. Question

64. Question

65. Question

66. Question

67. Question

68. Question

69. Question

70. Question

71. Question

72. Question

73. Question