MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Time stamps in cybersecurity primarily record which event?
   a. File access times
   b. Password strength
   c. Encryption type
   d. Attack vector
   Answer: alinkedin+1​
2. Which file system attribute represents the “created” timestamp?
   a. M time
   b. A time
   c. C time
   d. B time
   Answer: dwikipedia+1​
3. The “MACB” acronym in digital forensics stands for what?
   a. Modified, Accessed, Changed, Birth
   b. Metadata, Access, Create, Binary
   c. Modified, Altered, Checked, Binary
   d. Managed, Accessed, Cloned, Backup
   Answer: alinkedin​
4. Which timestamp modification technique is commonly used in malware?
   a. Hashing
   b. Keylogging
   c. Timestomping
   d. Phishing
   Answer: ctwingate+1​
5. Timestomping helps attackers by:
   a. Increasing data encryption strength
   b. Concealing file creation or modification times
   c. Enhancing log integrity
   d. Authenticating network connections
   Answer: battack.mitre+1​
6. NTP synchronization ensures:
   a. Protocol redundancy
   b. Time consistency across systems
   c. File deletion speed
   d. Bandwidth limitation
   Answer: bituonline​
7. Which port does NTP primarily use?
   a. TCP 80
   b. UDP 123
   c. TCP 53
   d. UDP 161
   Answer: bituonline​
8. What is the main purpose of a timestamp in an audit log?
   a. Record event timing
   b. Encrypt data
   c. Hide attacker presence
   d. Manage policies
   Answer: aexabeam+1​
9. Forged timestamps in logs may indicate:
   a. Normal operations
   b. Anti-forensic manipulation
   c. Software update
   d. Patch deployment
   Answer: bdfrws+1​
10. Timestamp analysis in forensic science assists in:
    a. User authentication
    b. Timeline reconstruction
    c. Memory encryption
    d. Network routing
    Answer: bnbftools+1​
11. NTFS records timestamps with what level of precision?
    a. Seconds
    b. Milliseconds
    c. Nanoseconds
    d. Minutes
    Answer: clinkedin​
12. Which timestamp usually changes when metadata is modified?
    a. A time
    b. C time
    c. M time
    d. B time
    Answer: bwikipedia+1​
13. Access times in some operating systems may be disabled to:
    a. Improve performance
    b. Encrypt metadata
    c. Store logs
    d. Prevent hacking
    Answer: alinkedin​
14. Timestamp inconsistency across systems often suggests a failure of:
    a. Access control
    b. NTP synchronization
    c. Network load balancing
    d. Encryption
    Answer: bituonline​
15. In digital forensics, a “super timeline” is created by:
    a. Aggregating multiple timestamp sources
    b. Compressing event logs
    c. Deleting unused time data
    d. Hashing user passwords
    Answer: anbftools​
16. Which of the following is NOT a MACB timestamp?
    a. Accessed
    b. Changed
    c. Blocked
    d. Modified
    Answer: clinkedin​
17. Attackers use timestomping to:
    a. Maintain password histories
    b. Mislead investigators
    c. Improve system performance
    d. Backup forensic evidence
    Answer: btwingate​
18. A log entry with future timestamps commonly suggests:
    a. Legitimate scheduling
    b. System clock error or tampering
    c. Firewall downtime
    d. Sync success
    Answer: btwingate+1​
19. Timestamps can be stored using which time standard?
    a. UTC
    b. GMT only
    c. Local daylight
    d. Country specific
    Answer: aituonline​
20. The file “ctime” in Linux denotes:
    a. Change time
    b. Creation time
    c. Compress time
    d. Cache time
    Answer: awikipedia+1​
21. Timestamp metadata in APFS updates after:
    a. File rename or move operations
    b. Hard disk shutdown
    c. Kernel panic
    d. User login
    Answer: ajoshlemon​
22. When forensic experts compare timestamps from multiple logs, they are performing:
    a. Time correlation
    b. Hashing
    c. Identity proofing
    d. Encryption
    Answer: acriminallegalnews+1​
23. Which factor can contaminate timestamp evidence?
    a. System timezone changes
    b. Static IP assignment
    c. Antivirus logs
    d. Protocol filtering
    Answer: anbftools​
24. The command “fsutil behavior set disablelastaccess 0” in Windows enables:
    a. Access timestamps
    b. Encrypted partitions
    c. Deleted file recovery
    d. Log rotation
    Answer: alinkedin​
25. Timestamp tampering attacks fall under which MITRE ATT&CK sub-technique?
    a. Credential dumping
    b. Indicator Removal – Timestomp
    c. Rootkit deployment
    d. Network beaconing
    Answer: battack.mitre​
26. Timestamp granularity differs primarily across:
    a. File systems and operating systems
    b. User access levels
    c. Network topologies
    d. Antivirus programs
    Answer: awikipedia+1​
27. Ext4 file system introduces timestamp precision up to:
    a. Milliseconds
    b. Nanoseconds
    c. Seconds
    d. Microseconds
    Answer: blinkedin​
28. Which format is commonly used to represent timestamps?
    a. ISO 8601
    b. ASCII
    c. JSON
    d. Base32
    Answer: acriminallegalnews​
29. Timestamp data from an IoT device log assists with:
    a. Device authentication
    b. Event timeline verification
    c. MAC address recovery
    d. Firmware installation
    Answer: bcriminallegalnews+1​
30. What forensic tool helps in analyzing timestamp patterns?
    a. TRIOS
    b. VLC
    c. NMAP
    d. MSIExec
    Answer: anbftools​
31. The main forensic challenge with timestamps is:
    a. Tampering and synchronization inconsistency
    b. Network congestion
    c. Memory overflows
    d. Storage capacity
    Answer: adfrws+1​
32. Timestamp metadata is typically stored in:
    a. File system records
    b. BIOS tables
    c. IP headers
    d. Logon scripts
    Answer: acriminallegalnews+1​
33. Timestamp alteration can be detected through:
    a. Cross-verification with other logs
    b. Disk cleanup
    c. Application updates
    d. Network firewalls
    Answer: atwingate+1​
34. The process of aligning multiple clocks is known as:
    a. Time synchronization
    b. Clock deviation
    c. Temporal shifting
    d. System calibration
    Answer: aituonline​
35. In forensic timelines, timestamps without direct references are called:
    a. Implicit timing information
    b. Deleted markers
    c. Unused metadata
    d. Suspicious records
    Answer: adfrws​
36. Attackers using timestomping often modify:
    a. File headers
    b. Creation and modification times
    c. Registry keys only
    d. Password hashes
    Answer: battack.mitre+1​
37. Timestamp correlation is most difficult when:
    a. Systems are in different time zones
    b. Logs are centralized
    c. NTP is enforced
    d. UTC is standardized
    Answer: aituonline​
38. Timestamp verification supports which digital forensic goal?
    a. Event reconstruction
    b. Application installation
    c. Disk fragmentation
    d. Password rotation
    Answer: anbftools+1​
39. A key example of an anti-forensic timestamp tool is:
    a. SKTimeStamp
    b. Wireshark
    c. Nessus
    d. Nmap
    Answer: atwingate​
40. Which timestamp is typically least altered during file modification?
    a. Birth
    b. Modified
    c. Changed
    d. Accessed
    Answer: alinkedin​
41. Timestamp drift is a:
    a. Gradual desynchronization of system clocks
    b. Reboot failure symptom
    c. Encryption misconfiguration
    d. Data exfiltration pattern
    Answer: aituonline​
42. Cross-verifying timestamps helps mitigate which issue?
    a. Evidence contamination
    b. CPU overload
    c. Storage leak
    d. DNS poisoning
    Answer: anbftools​
43. Which forensic term describes who accessed a system and when?
    a. Audit trail
    b. Hash table
    c. ACL
    d. Session list
    Answer: aituonline​
44. A suspicious log with “no timestamp” entries indicates:
    a. Logging misconfiguration
    b. File encryption
    c. Secure session
    d. Threat playback
    Answer: aexabeam+1​
45. Timestamp-enabled logs help analysts determine:
    a. Chronological event sequence
    b. File ownership
    c. Digital signature size
    d. Driver dependencies
    Answer: acriminallegalnews+1​
46. Timestamp forgery can be detected by examining:
    a. Metadata anomalies
    b. Data compression
    c. Kernel logs
    d. Binary sizes
    Answer: asciencedirect+1​
47. A time synchronization error can complicate:
    a. Security incident correlation
    b. Software installation
    c. Storage partitioning
    d. System boot
    Answer: aituonline​
48. What is the core function of UTC timestamps in cybersecurity logs?
    a. Time unification across global systems
    b. Generate authentication keys
    c. Encrypt session logs
    d. Allocate RAM
    Answer: aituonline​
49. Inconsistent MAC times across files may indicate:
    a. Timestamp manipulation
    b. File compression
    c. Normal system usage
    d. Software update
    Answer: atwingate+1​
50. Timestomping manipulation directly targets which forensic capability?
    a. Timeline accuracy
    b. Encryption key derivation
    c. Data compression
    d. Identity federation
    Answer: aattack.mitre+1​

1. https://www.linkedin.com/pulse/understanding-macb-times-modern-operating-systems-fabio-fernandes-ksx8f
2. https://www.criminallegalnews.org/news/2025/jan/15/understanding-timestamps-digital-forensics/
3. https://en.wikipedia.org/wiki/MAC_times
4. https://www.twingate.com/blog/glossary/timestomping
5. https://attack.mitre.org/techniques/T1070/006/
6. https://www.ituonline.com/blogs/mastering-log-file-analysis/
7. https://www.exabeam.com/explainers/log-management/what-is-log-analysis-process-techniques-and-best-practices/
8. https://dfrws.org/wp-content/uploads/2024/07/Beyond-timestamps-Integrating-implicit-timin_2024_Forensic-Science-Internat.pdf
9. https://www.nbftools.com/important-role-of-timestamps-in-forensic-science/
10. https://blog.joshlemon.com.au/file-timestamps-for-apple-apfs-5a2ff3e34607
11. https://www.sciencedirect.com/science/article/abs/pii/S0957417425022493
12. https://www.includehelp.com/mcq/dbms-timestamp-ordering-protocol-mcqs.aspx
13. https://www.sanfoundry.com/cryptography-questions-answers-public-key-xcertificates-i/
14. https://automationforum.co/cybersecurity-in-plc-systems-advanced-25-mcq-quiz/
15. https://examradar.com/blockchain-and-its-security-implications-mcqs-multiple-choice-questions-with-answer/
16. https://www.scribd.com/document/632244657/Internet-Security-Solved-MCQs-set-1-McqMate-com
17. https://www.igmguru.com/blog/cyber-security-mcqs
18. https://www.studocu.com/in/document/chhatrapati-shahu-ji-maharaj-university/biology/cn-2nd-unit-this-pdf-is-very-usefull-for-students/28137958
19. https://www.crowdstrike.com/en-us/cybersecurity-101/next-gen-siem/log-analysis/
20. https://www.cliffsnotes.com/study-notes/12810178