With the standard Linux second extended file system (Ext2fs), a file is deleted when the inode
internal link count reaches ________.

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

Which part of the Windows Registry contains the users password file?

Lance wants to place a honeypot on his network. Which of the following would be your
recommendations?

An employee is attempting to wipe out data stored on a couple of compact discs (CDs) and digital
video discs (DVDs) by using a large magnet. You inform him that this method will not be effective
in wiping out the data because CDs and DVDs are ______________ media used to store large
amounts of data and are not affected by the magnet.

What does the acronym POST mean as it relates to a PC?

Paula works as the primary help desk contact for her company.Paula has just received a call from
a user reporting that his computer just displayed a Blue Screen of Death screen and he can no
longer work.Paula
walks over to the users computer and sees the Blue Screen of Death screen.The users computer
is running
Windows XP, but the Blue Screen looks like a familiar one that Paula had seen on Windows 2000
computers periodically. The user said he stepped away from his computer for only 15 minutes and
when he got back, the Blue Screen was there.Paula also noticed that the hard drive activity light
was flashing, meaning that the computer was processing something.Paula knew this should not be
the case since the computer should be completely frozen during a Blue Screen. She checks the
network IDS live log entries and notices numerous nmap scan alerts.
What is Paula seeing happen on this computer?

What is the advantage in encrypting the communication between the agent and the monitor in an
Intrusion Detection System?

Which legal document allows law enforcement to search an office, place of business, or other
locale for evidence relating to an alleged crime?

You are working as an investigator for a corporation and you have just received instructions from
your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation.

Your job is to complete the required evidence custody forms to properly document each piece of
evidence as it is collected by other members of your team. Your manager instructs you to
complete one multi-evidence form for the entire case and a single-evidence form for each hard
drive. How will these forms be stored to help preserve the chain of custody of the case?