112-57 Exam Dumps and Practice Questions

The command path /bin/rm is a hallmark of UNIX/POSIX-style operating systems, where core userland utilities are commonly stored under directories such as /bin, /sbin, and /usr/bin. The utility rm (remove) is the standard UNIX command used to delete directory entries that reference a file's data blocks on disk. This layout and command structure do not match Windows, which uses different filesystem conventions (drive letters, backslashes, and Windows-native executables) and does not provide /bin/rm as a native path. Android, while Linux-kernel-based, typically exposes shell utilities through environments like /system/bin (and newer systems may use toybox/busybox variants), not the classic /bin hierarchy expected on general-purpose UNIX systems. Between the remaining options, both Linux and macOS are UNIX-like and can include an rm command; however, in digital forensics training and examination contexts, the explicit reference to /bin/rm is most commonly used to indicate a Linux/UNIX command-line environment on a compromised host. Therefore, the best single-choice answer from the provided options is Linux (D).

Spimming is defined in digital forensics and cybercrime references as spam over instant messaging (IM). It is a social-engineering variant where attackers use instant messaging platforms (and sometimes chat apps) to deliver unsolicited bulk messages containing malicious links, fraudulent offers, credential-harvesting lures, or malware downloads. Because IM messages are often delivered in real time and can appear to come from known contacts (via compromised accounts), spimming can achieve higher click-through rates than traditional email spam. For investigators, spimming incidents commonly leave artifacts such as chat logs, message timestamps, sender identifiers, embedded URLs, and sometimes downloaded payload traces on the endpoint. These artifacts help establish attacker infrastructure (domains, IPs), victim interaction (click events, file creation), and timeline correlation with network logs.

The other options do not match the ''IM as a tool to spread spam'' description. Whaling targets high-profile individuals via highly tailored phishing, typically email-based. Pharming redirects users to fraudulent websites (often via DNS or host-file manipulation) without relying on bulk IM spam. Spear phishing is targeted phishing toward specific individuals or groups, not necessarily IM spam. Therefore, the phishing/spam attack that exploits instant messaging platforms is Spimming (C).

The Sarbanes--Oxley Act (SOX) was enacted by the U.S. Congress in 2002 in response to major corporate accounting scandals and was specifically designed to protect investors by improving the accuracy, reliability, and integrity of corporate disclosures and financial reporting. SOX strengthens governance and accountability by requiring executive management (notably the CEO and CFO) to certify the correctness of financial statements and by mandating stronger internal controls over financial reporting. From a digital forensics and compliance perspective, SOX is closely tied to the need for reliable audit trails, proper records retention, and demonstrable control over systems that store or process financial data. Investigators frequently rely on SOX-driven logging, access controls, and change management records to determine who accessed financial systems, what changes were made, and whether those actions align with authorized procedures.

The other options do not match the question's purpose or jurisdiction: the Electronic Communications Privacy Act addresses interception and access to electronic communications, GDPR is an EU data protection regulation (not a 2002 U.S. act focused on investor protection), and ''Information Privacy Act 2014'' is not the 2002 U.S. corporate anti-fraud legislation. Therefore, the correct answer is Sarbanes--Oxley Act (SOX) (C).

The role described---being responsible for evidence gathered at the crime scene and maintaining a record that makes the evidence admissible in court---matches the duties of an Evidence manager. In digital forensics practice, admissibility depends heavily on proving integrity, authenticity, and continuity of possession. The evidence manager ensures these requirements by implementing and documenting the chain of custody, which is the formal, chronological record of who collected the evidence, when and where it was collected, how it was packaged and labeled, how it was transported, where it was stored, and every time it was accessed or transferred. This role also enforces evidence handling procedures such as tamper-evident sealing, secure storage controls, access logging, and verification steps (for example, ensuring hashes are recorded and preserved for forensic images).

An incident responder focuses on containment and immediate actions during an incident; an incident analyzer performs technical analysis and correlation of artifacts; and an evidence examiner conducts detailed forensic examinations on acquired data. While these roles interact with evidence, the specific responsibility for maintaining custody documentation and evidence records to support legal admissibility belongs to the Evidence manager, making D the correct answer.

Steganography is the technique of concealing a message within another seemingly harmless carrier (such as an image, audio file, video, or document) so that the existence of the hidden message is not apparent to an observer. Digital forensics references distinguish steganography from encryption: encryption scrambles content but usually leaves visible indicators that protected data exists (ciphertext), while steganography aims to make the communication look ordinary, reducing suspicion. In practice, steganographic methods often embed data into redundant or less perceptible parts of the carrier, such as modifying least significant bits in pixel values, altering frequency components in audio, or inserting data into metadata or unused file structures.

The other options do not match the definition. Password cracking is an access technique to recover authentication secrets, not a concealment method. Artifact wiping is an anti-forensics method intended to remove traces (logs, files, slack space remnants), but it does not ''hide behind'' other data---it destroys or overwrites evidence. Program packers compress/obfuscate executables to hinder static analysis and detection, but they still produce an executable whose presence is evident; they do not primarily hide messages inside benign files. Therefore, the described ''hiding the existence of the message itself'' corresponds to Steganography (C).