Categories
Categories
Forensic Psychology and Profiling
Question 1: What is the most critical factor in determining whether a footwear impression is suitable for individual identification?
- A. The depth of the impression
- B. The presence of random wear characteristics
- C. The brand of the footwear
- D. The size of the impression
Answer
Answer: B. The presence of random wear characteristics
Explanation: Individual identification relies on unique, random wear patterns, cuts, or damage that develop over time – not the manufactured design. While size and depth are important for class characteristics, only random imperfections can potentially link a print to a specific shoe.
Question 2: Which casting material is now considered the gold standard for preserving three-dimensional tire marks in soil?
- A. Plaster of Paris
- B. Dental stone
- C. Silicone rubber
- D. Alginate
Answer
Answer: B. Dental stone
Explanation: Dental stone (modified gypsum) has largely replaced traditional plaster because it produces sharper detail, sets faster, and creates stronger casts. Its fine particles capture tread wear indicators and subtle tread block features better than other materials.
Question 3: What feature of a tire impression is most useful for determining the manufacturer and model of a tire?
- A. The tread pitch sequence
- B> The wear patterns
- C. The groove width variations
- D. The presence of stone holds
Answer
Answer: A. The tread pitch sequence
Explanation: Manufacturers use unique tread pitch sequences (the arrangement of different tread block shapes) as identifiers. These patterns are deliberately varied to reduce noise and are documented in tire reference databases, making them more reliable for manufacturer identification than wear features.
Question 4: When analyzing a footwear impression in dust, which enhancement technique would be most appropriate?
- A. Electrostatic lifting
- B. Gel lifting
- C. Chemical developers
- D. Alternate light source
Answer
Answer: A. Electrostatic lifting
Explanation: Electrostatic lifting is ideal for dry, dusty impressions on non-porous surfaces. It uses an electric charge to transfer the dust pattern to a lifting film without disturbing the delicate particles. Gel lifters would compress the dust, while chemical developers work best on porous surfaces.
Question 5: What information can be determined from the “stagger” measurement in tire tracks?
- A> The wheelbase of the vehicle
- B. The turning radius
- C. The tread depth
- D. The inflation pressure
Answer
Answer: A. The wheelbase of the vehicle
Explanation: Stagger refers to the difference in distances between left and right tire marks in a full rotation. Measuring multiple rotation cycles allows calculation of the wheelbase (distance between front and rear axles), which can help identify vehicle class or eliminate certain models.
Question 6: Which feature of a shoe impression would most strongly indicate the suspect’s gait or movement pattern?
- A. Toe drag marks
- B. Edge wear patterns
- C. Pressure distribution within the print
- D. Transfer material patterns
Answer
Answer: C. Pressure distribution within the print
Explanation: The varying depth and material displacement within a print reveals weight distribution during foot strike. Forensic gait analysis examines these pressure patterns to determine if the person was running, limping, or carrying heavy objects – more indicative than static wear patterns.
Question 7: What is the primary limitation of using tire track evidence for positive vehicle identification?
- A. Tires are frequently replaced
- B. Track width varies with load
- C. Lack of databases for comparison
- D. All of the above
Answer
Answer: D. All of the above
Explanation: Tire evidence has multiple limitations: tires get replaced (removing unique wear), track dimensions change with passenger/load weight, and unlike footwear, comprehensive tire databases with wear patterns don’t exist. This makes absolute identification extremely difficult.
Question 8: When photographing a footwear impression at a crime scene, what technique ensures accurate size representation?
- A. Using oblique lighting
- B. Placing a scale on the same plane as the impression
- C. Shooting from directly overhead
- D. All of the above
Answer
Answer: D. All of the above
Explanation: Proper footwear documentation requires: 1) oblique lighting to enhance detail, 2) scales placed precisely at the impression’s depth to prevent parallax error, and 3) 90-degree overhead shots to avoid distortion. All three techniques are essential for creating forensically valid photographs.
Question 9: What characteristic would help distinguish snow impressions from other impression types during recovery?
Answer
Answer: D. All of the above
Explanation: Snow impressions require unique handling: 1) wax or sulfur-based chemicals must harden the snow first, 2) casting materials generate heat that can melt/expand the impression, and 3) low-angle lighting is needed for photography due to snow’s reflectivity.
Question 10: Which database is most commonly used by forensic examiners to compare shoe print patterns?
- A. TreadMark
- B. SoleMate
- C. Footwear Intelligence Tool (FIT)
- D. SICAR (Shoeprint Image Capture and Retrieval)
Answer
Answer: D. SICAR (Shoeprint Image Capture and Retrieval)
Explanation: SICAR is the most widely used commercial system, containing thousands of sole patterns from manufacturers worldwide. It uses pattern coding algorithms to match crime scene impressions to known designs, helping identify shoe brands and models.
Question 1: Which of the following tools is primarily used for dynamic analysis of malware?
- A. IDA Pro
- B. Ghidra
- C. Process Monitor
- D. Hex-Rays Decompiler
Answer
Answer: C. Process Monitor
Explanation: Process Monitor is a Windows-based tool that captures real-time file system, registry, and process/thread activity, making it ideal for observing malware behavior during dynamic analysis.
Question 2: What is the main purpose of a sandbox environment in malware analysis?
- A. To decrypt encrypted malware samples
- B. To reverse-engineer malware binary code
- C. To isolate and monitor malware behavior safely
- D. To compile source code of malware
Answer
Answer: C. To isolate and monitor malware behavior safely
Explanation: A sandbox provides a controlled and isolated environment where malware can be executed without risk to the host system, allowing analysts to observe its behavior and impact.
Question 3: Which malware detection technique compares a file’s binary code to known malicious code patterns?
- A. Behavioral detection
- B. Signature-based detection
- C. Heuristic analysis
- D. Anomaly-based detection
Answer
Answer: B. Signature-based detection
Explanation: Signature-based detection identifies malware by matching its code to a database of known malware signatures. It’s fast and efficient but ineffective against zero-day threats or obfuscated code.
Question 4: What is the primary goal of code obfuscation in malware?
- A. To reduce the size of the malware
- B. To improve malware performance
- C. To hide the malware’s true functionality
- D. To exploit system vulnerabilities
Answer
Answer: C. To hide the malware’s true functionality
Explanation: Obfuscation is a technique used by attackers to make malware code more difficult to read or analyze, thereby evading detection and delaying reverse engineering efforts.
Question 5: Which malware type disguises itself as legitimate software to deceive users?
- A. Worm
- B. Trojan horse
- C. Rootkit
- D. Adware
Answer
Answer: B. Trojan horse
Explanation: A Trojan horse appears to be a legitimate application but carries malicious payloads that compromise the system once executed by the user.
Question 6: Which of the following is a key indicator of a packed malware sample?
- A. Presence of clear-text strings
- B. Unusual section names in PE header
- C. Large import table
- D. Absence of suspicious API calls
Answer
Answer: B. Unusual section names in PE header
Explanation: Packed executables often have abnormal or custom section names in the PE (Portable Executable) header, such as .UPX or .packed, which are strong indicators of packing or compression.
Question 7: In reverse engineering malware, what is the role of disassemblers like IDA Pro or Ghidra?
- A. Encrypt the malware code for secure storage
- B. Emulate malware behavior in real-time
- C. Convert binary code into assembly code
- D. Analyze network traffic from malware
Answer
Answer: C. Convert binary code into assembly code
Explanation: Disassemblers translate compiled binary code into human-readable assembly instructions, helping analysts understand the underlying logic and behavior of the malware.
Question 8: What is a common sign of malware persistence on a Windows system?
- A. Malware deletes itself after execution
- B. Registry key entries in Run or RunOnce paths
- C. Use of standard system calls only
- D. No change to system boot sequence
Answer
Answer: B. Registry key entries in Run or RunOnce paths
Explanation: Malware often modifies registry keys such as Run or RunOnce to automatically execute itself upon system startup, maintaining persistence across reboots.
Question 9: Which of the following is a primary limitation of static malware analysis?
- A. Requires an internet connection
- B. Cannot analyze the network behavior of malware
- C. Detects only macro-based malware
- D. Cannot be performed on compiled binaries
Answer
Answer: B. Cannot analyze the network behavior of malware
Explanation: Static analysis examines malware code without execution, so it cannot reveal runtime behaviors such as communication with command-and-control servers or dynamic file creation.
Question 10: Which Windows API function is commonly used by malware for process injection?
- A. CreateProcess()
- B. VirtualAllocEx()
- C. GetProcAddress()
- D. MessageBox()
Answer
Answer: B. VirtualAllocEx()
Explanation: VirtualAllocEx() is used to allocate memory in another process’s address space, a critical step in process injection techniques like DLL injection or code injection used by malware.