212-89 Pre-Exam Practice Tests (Updated 165 Questions) [Q85-Q100]

NO.85 A malicious security-breaking code that is disguised as any useful program that installs an executable
programs when a file is opened and allows others to control the victim’s system is called:

NO.86 Bit stream image copy of the digital evidence must be performed in order to:

NO.87 The policy that defines which set of events needs to be logged in order to capture and review the important data in a timely manner is known as:

NO.88 Incidents such as DDoS that should be handled immediately may be considered as:

NO.89 The correct sequence of Incident Response and Handling is:

NO.90 Which of the following may be considered as insider threat(s):

NO.91 Which of the following incidents are reported under CAT -5 federal agency category?

NO.92 The Linux command used to make binary copies of computer media and as a disk imaging tool if given a raw
disk device as its input is:

NO.93 Electronic evidence may reside in the following:

NO.94 The product of intellect that has commercial value and includes copyrights and trademarks is called:

NO.95 What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP
addresses on a victim computer to identify the established connections on it:

NO.96 Removing or eliminating the root cause of the incident is called:

NO.97 A Malicious code attack using emails is considered as:

NO.98 Identify a standard national process which establishes a set of activities, general tasks and a management
structure to certify and accredit systems that will maintain the information assurance (IA) and security posture
of a system or site.

NO.99 The left over risk after implementing a control is called:

NO.100 An incident is analyzed for its nature, intensity and its effects on the network and systems. Which stage of the incident response and handling process involves auditing the system and network log files?