Sarah, a forensic investigator, is conducting a post-compromise investigation on a company's server that contains sensitive data. To ensure the deleted files do not fall into the wrong hands, she follows a media sanitization procedure. The process involves overwriting the deleted data 6 times with alternating sequences of 0x00 and 0xFF, followed by a final overwrite using the pattern
0xAA.
Which of the following media sanitization standards has Sarah followed in this scenario?

• A. NAVSO P-5239-26 (MFM)
• B. GOST P50739-95
• C. DoD 5220.22-M
• D. VSITR

During a cyber espionage investigation at a defense contractor in Washington, D.C., forensic analysts used shared intelligence feeds to pinpoint unusual network beacons matching known adversary tactics, enabling them to trace the intrusion back to specific command-and-control servers and validate the scope of data exfiltration. Which role of threat intelligence in computer forensics is primarily demonstrated in this scenario?

• A. Identifies the threats at the early stage
• B. Recognizes and correlates the known attack patterns
• C. Discovers the indicators of compromise for further investigation
• D. Provides appropriate guidance throughout the forensic investigation process

An attacker, seeking to anonymize their internet activity, utilizes the Tor network, which routes their traffic through a series of relays to obscure the original source. This method is designed to protect the user's identity and location. However, despite these measures, the attacker's traffic is traced and identified at the exit relay, potentially exposing them to legal consequences. In response, the attacker turns to a bridge node to circumvent stringent network censorship in a region where access to the Tor network is blocked, thereby regaining access to Tor and attempting to preserve their anonymity. Which role does the bridge node play in the attacker's attempt to bypass censorship?

• A. It decrypts the encrypted traffic and forwards it to the destination server.
• B. It serves as an undetectable entry point, helping bypass local network restrictions.
• C. It encrypts the data before sending it to the middle relay.
• D. It hides the exit relay's IP address to prevent detection.

Which of the following is a requirement for senders as per the CAN-SPAM act?

• A. Emails must not contain information regarding how to stop receiving emails from the sender in future
• B. Senders should never share their physical postal address in the email
• C. Senders cannot use misleading or false header information
• D. Senders must use deceptive subject lines