You work as a Network Security Analyzer. You got a suspicious email while working on a forensic
project. Now, you want to know the IP address of the sender so that you can analyze various
information such as the actual location, domain information, operating system being used, contact
information, etc. of the email sender with the help of various tools and resources. You also want to
check whether this email is fake or real. You know that analysis of email headers is a good starting
point in such cases. The email header of the suspicious email is given below:

What is the IP address of the sender of this email?

Peter works as a Technical Representative in a CSIRT for SecureEnet Inc. His team is called to

investigate the computer of an employee, who is suspected for classified data theft. Suspect’s
computer runs on Windows operating system. Peter wants to collect data and evidences for
further analysis. He knows that in Windows operating system, the data is searched in pre-defined
steps for proper and efficient analysis. Which of the following is the correct order for searching
data on a Windows based system?

Which of the following organizations is dedicated to computer security research and information
sharing?

Rick works as a Computer Forensic Investigator for BlueWells Inc. He has been informed that
some confidential information is being leaked out by an employee of the company. Rick suspects
that someone is sending the information through email. He checks the emails sent by some
employees to other networks. Rick finds out that Sam, an employee of the Sales department, is
continuously sending text files that contain special symbols, graphics, and signs. Rick suspects
that Sam is using the Steganography technique to send data in a disguised form. Which of the
following techniques is Sam using?
Each correct answer represents a part of the solution. Choose all that apply.

John works as a Desktop Technician for NetPerfect Inc. The company has a Windows-based
network. For the last few days, the network of the company has become prone to the Man-in-theMiddle attack. John wants to send a confidential MS-Word file to his Manager through e-mail
attachment. He wants to ensure that no one is able to open and understand the file’s message
except the Manager. Which of the following should John use to accomplish the task?
Each correct answer represents a part of the solution. Choose all that apply.

Which of the following statements correctly defines a script kiddie?

Which of the following is allowed by a company to be addressed directly from the public network
and is hardened to screen the rest of its network from security exposure?

Which of the following types of authentication messages are supported by the TACACS+ protocol
by default?
Each correct answer represents a complete solution. Choose all that apply.

Which of the following malware spread through the Internet and caused a large DoS attack in
1988?

According to the case study, the departmental stores can dial in to distribution center computers to
query their order status. Which protocol should they use to provide the highest level of security?
(Click the Exhibit button on the toolbar to see the case study.)