112-57 Exam Questions & Answers

The scenario describes the use of BitLocker to lock an entire disk volume with a secret key, preventing access to the contents. In digital forensics, this is a classic example of encryption as an anti-forensics technique. Full-disk or full-volume encryption transforms readable data into ciphertext using cryptographic algorithms so that, without the correct key (password, recovery key, TPM-bound protector, etc.), the data is computationally infeasible to interpret. This directly obstructs evidence acquisition and analysis because a forensic image of the drive will largely contain encrypted blocks rather than interpretable file system structures and user data.

This differs from the other options: file carving is a forensic recovery method (often used by investigators) that reconstructs files from unallocated space; it is not an anti-forensics method used to block access. Artifact wiping attempts to erase traces by deleting or overwriting files, logs, or free space, but it does not inherently prevent access to remaining data if wiping is incomplete. Trail obfuscation involves misleading or altering logs and traces to confuse investigators, whereas encryption primarily denies content visibility by design. Because BitLocker is explicitly a volume encryption mechanism used here to deny access, the correct anti-forensic technique is Encryption (D).

To understand a malware sample's purpose at the instruction level, investigators use reverse-engineering tools that can disassemble compiled binaries into assembly code and often allow interactive debugging to observe runtime behavior (API calls, unpacking routines, decryption loops, process injection, and control-flow decisions). OllyDbg is a classic Windows user-mode debugger widely referenced in malware analysis workflows because it provides an integrated view of disassembly, CPU registers, memory, breakpoints, and execution tracing. This makes it suitable for extracting behavioral insight from the actual assembly instructions, especially when malware uses obfuscation or packers that require stepping through execution to reach the real payload.

The other options do not primarily perform assembly-level analysis. VirtualBox and VMware vSphere are virtualization platforms; they help safely run malware in isolated environments, but they are not disassemblers/debuggers for examining assembly instructions. QualNet is a network simulation tool used for modeling network behavior, not binary reverse engineering. Because the question specifically emphasizes analyzing assembly code instructions to understand malware purpose, the correct tool among the choices is OllyDbg (C).

In forensic examinations, investigators must correctly interpret a disk's partitioning scheme because it determines where volumes begin, where file systems reside, and how to validate acquisition completeness. Modern systems may use GPT (commonly associated with UEFI) while legacy systems often use MBR. A practical forensic command therefore needs to detect and parse partition information regardless of whether the disk uses MBR or GPT, and present the results in a consistent, investigator-friendly output for verification and downstream analysis (e.g., selecting the correct partition offsets for imaging or mounting).

Get-ForensicPartitionTable is designed for exactly this role in forensic PowerShell tooling: it parses partition table structures in a forensically oriented manner and supports disks partitioned using either MBR or GPT. That ''forensic'' emphasis typically means it reads raw structures directly, reports partition entries and offsets, and helps avoid ambiguity when the protective MBR (present on GPT disks) could confuse simplistic parsers.

By contrast, Get-BootSector targets boot sector/VBR data rather than the full partition layout; Get-GPT is GPT-specific and does not cover MBR-only disks; and Get-PartitionTable is a more generic label that may not guarantee dual-scheme forensic parsing. Therefore, the correct option is C.

The Windows net view \\<computer> command is used to enumerate shared resources (SMB shares) that a remote Windows system is publishing. When Jessy runs net view \\10.10.10.11, her goal is to retrieve a list of the target host's visible shares---such as administrative shares (e.g., C$, ADMIN$) and any custom shares created for departments, applications, or users. In forensic and incident-response practice, this is important because attackers commonly use SMB shares for lateral movement, staging tools, dropping payloads, and exfiltrating data. By reviewing the shares exposed by a suspected server, the investigator can quickly identify unexpected or overly permissive shares, locate potential repositories of web content or logs, and determine whether a compromised web server is also exposing file resources that expand the attacker's options.

The other options map to different commands and artifacts: disk space usage is checked with storage utilities (not net view), open sessions are examined with commands like net session, and identifying users accessing files typically involves net file or server auditing logs. Therefore, Jessy's objective was to review file shares on the remote host.

Promiscuous mode is a network interface configuration in which the NIC passes all observed frames to the operating system, not only frames addressed to that host's MAC address. In investigations, this matters because promiscuous mode is commonly enabled by packet sniffers, certain intrusion tools, or misconfigured monitoring software, and it can indicate covert traffic capture on a host.

On UNIX/Linux systems, the traditional command used to view interface flags and status is ifconfig <interface name>. When an interface is set to promiscuous mode, ifconfig displays a PROMISC flag in the interface's status line, allowing an investigator to confirm whether the NIC is accepting all frames. This directly matches Kane's goal of checking if the interface is running in promiscuous mode.

The other commands do not provide this specific interface flag. nmap -sT localhost scans for open TCP ports, not interface modes. ipconfig is a Windows command (and does not take an interface name in that form to show PROMISC status), and it primarily reports IP configuration. netstat -i shows network interface statistics (packets, errors, drops) but typically does not explicitly indicate promiscuous mode. Therefore, the correct command is ifconfig <interface name> (C).