The Electronic Serial Number (ESN) is a unique __________ recorded on a secure chip in a mobile
phone by the manufacturer.

Subscriber Identity Module (SIM) is a removable component that contains essential information about
the subscriber. Its main function entails authenticating the user of the cell phone to the network to gain
access to subscribed services. SIM contains a 20-digit long Integrated Circuit Card identification (ICCID)
number, identify the issuer identifier Number from the ICCID below.

First response to an incident may involve three different groups of people, and each will have differing
skills and need to carry out differing tasks based on the incident. Who is responsible for collecting,
preserving, and packaging electronic evidence?

Task list command displays a list of applications and services with their Process ID (PID) for all tasks
running on either a local or a remote computer. Which of the following task list commands provides
information about the listed processes, including the image name, PID, name, and number of the
session for the process?

An expert witness is a witness, who by virtue of education, profession, or experience, is believed to
have special knowledge of his/her subject beyond that of the average person, sufficient that others
legally depend upon his/her opinion.

P0P3 (Post Office Protocol 3) is a standard protocol for receiving email that deletes mail on the server
as soon as the user downloads it. When a message arrives, the POP3 server appends it to the bottom
of the recipient’s account file, which can be retrieved by the email client at any preferred time. Email
client connects to the POP3 server at _______________by default to fetch emails.

Windows Security Event Log contains records of login/logout activity or other security-related events
specified by the system’s audit policy. What does event ID 531 in Windows Security Event Log
indicates?

When collecting evidence from the RAM, where do you look for data?

A rogue/unauthorized access point is one that Is not authorized for operation by a particular firm or
network

Computer security logs contain information about the events occurring within an organization’s systems
and networks. Application and Web server log files are useful in detecting web attacks. The source,
nature, and time of the attack can be determined by _________of the compromised system.