Which of the following approaches checks and compares all the fields systematically and intentionally
for positive and negative correlation with each other to determine the correlation across one or multiple
fields?

Data files from original evidence should be used for forensics analysis

Attackers can manipulate variables that reference files with “dot-dot-slash (./)” sequences and their
variations such as: http://www.juggyDoy.corn/GET/process.php./././././././././etc/passwd. Identify the
attack referred.

The Electronic Serial Number (ESN) is a unique __________ recorded on a secure chip in a mobile
phone by the manufacturer.

Subscriber Identity Module (SIM) is a removable component that contains essential information about
the subscriber. Its main function entails authenticating the user of the cell phone to the network to gain
access to subscribed services. SIM contains a 20-digit long Integrated Circuit Card identification (ICCID)
number, identify the issuer identifier Number from the ICCID below.

First response to an incident may involve three different groups of people, and each will have differing
skills and need to carry out differing tasks based on the incident. Who is responsible for collecting,
preserving, and packaging electronic evidence?

Task list command displays a list of applications and services with their Process ID (PID) for all tasks
running on either a local or a remote computer. Which of the following task list commands provides
information about the listed processes, including the image name, PID, name, and number of the
session for the process?

P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server
as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom
of the recipient’s account file, which can be retrieved by the email client at any preferred time. Email
client connects to the POP3 server at _______________by default to fetch emails.

An expert witness is a witness, who by virtue of education, profession, or experience, is believed to
have special knowledge of his/her subject beyond that of the average person, sufficient that others
legally depend upon his/her opinion.

Windows Security Event Log contains records of login/logout activity or other security-related events
specified by the system’s audit policy. What does event ID 531 in Windows Security Event Log
indicates?