CSIT D4

What type of forensic investigation-related form is shown here? A. Chain of custody B. Report of examination C. Forensic discovery log D. Policy custody release

A. Chain of custody

If Suki wants to purge a drive, which of the following options will accomplish her goal? A. Cryptographic erase B. Reformat C. Overwrite D. Repartition

A. Cryptographic erase

Adam works for a large university and sees the following graph in his PRTG console when looking at a yearlong view. What behavioral analysis could he leverage based on this pattern? A. Identify unexpected traffic during breaks like the low point at Christmas. B. He can determine why major traffic drops happen on weekends. C. He can identify top talkers. D. Adam cannot make any behavioral determinations based on this chart.

A. Identify unexpected traffic during breaks like the low point at Christmas.

During an incident response process, Alice is assigned to gather details about what data was accessed, if it was exfiltrated, and what type of data was exposed. What type of analysis is she doing? A. Information impact analysis B. Economic impact analysis C. Downtime analysis D. Recovery time analysis

A. Information impact analysis

Because of external factors, Eric has only a limited time period to collect an image from a workstation. If he collects only specific files of interest, what type of acquisition has he performed? A. Logical B. Bit-by-bit C. Sparse D. None of the above

A. Logical

Allison wants to access Chrome logs as part of a forensic investigation. What format is information about cookies, history, and saved form fill information saved in? A. SQLite B. Plain text C. Base64 encoded text D. NoSQL

A. SQLite

Saria is reviewing the contents of a drive as part of a forensic effort and notes that the file she is reviewing takes up more space on the disk than its actual size, as shown here. What has she discovered? A. Slack space B. Hidden content C. Sparse files D. Encryption overhead

A. Slack space

Marta runs the command shown here while checking usage of her Linux system. Which of the following statements is true based on the information shown? A. There are two users logged in remotely via SSH. B. There is an active exploit in progress using the Monkeycom exploit. C. The local system is part of the demo.com domain. D. The system is not providing any UDP services.

A. There are two users logged in remotely via SSH.

Ben works at a U.S. federal agency that has experienced a data breach. Under FISMA, which organization does he have to report this incident to? A. US-CERT B. The National Cyber Security Authority C. The National Cyber Security Centre D. CERT/CC

A. US-CERT

What Windows memory protection methodology is shown here? A. DEP B. ASLR C. StackProtect D. MemShuffle

B. ASLR

Mei is planning to deploy rogue access point detection capabilities for her network. If she wants to deploy the most effective detection capability she can, which of the following detection types should she deploy first? A. Authorized MAC B. Authorized SSID C. Authorized channel D. Authorized vendor

B. Authorized SSID

Stefan wants to prevent evil twin attacks from working on his wireless network. Which of the following is not a useful method for detecting evil twins? A. Check for BSSID. B. Check the SSID. C. Check the attributes (channel, cipher, authentication method). D. Check for tagged parameters like the organizational unique identifier.

B. Check the SSID.

In his role as a forensic examiner, Lukas has been asked to produce forensic evidence related to a civil case. What is this process called? A. Criminal forensics B. E-discovery C. Cyber production D. Civil tort

B. E-discovery

Which of the following issues is not commonly associated with BYOD devices? A. Increased network utilization B. Increased device costs C. Increased support tickets D. Increased security risk

B. Increased device costs

During her forensic analysis of a Windows system, Cynthia accesses the registry and checks \\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogin. What domain was the system connected to, and what was the username that would appear at login? A. Admin, administrator B. No domain, admin C. Legal, admin D. Corporate, no default username

B. No domain, admin

Eric has access to a full suite of network monitoring tools and wants to use appropriate tools to monitor network bandwidth consumption. Which of the following is not a common method of monitoring network bandwidth usage? A. SNMP B. Portmon C. Packet sniffing D. NetFlow

B. Portmon

While reviewing her Nagios logs, Selah discovers the error message shown here. What should she do about this error? A. Check for evidence of a port scan. B. Review the Apache error log. C. Reboot the server to restore the service. D. Restart the Apache service.

B. Review the Apache error log.

While Chris is attempting to image a device, he encounters write issues and cannot write the image as currently set. What issue is he most likely encountering? A. The files need to be compressed. B. The destination drive is formatted FAT32. C. The destination drive is formatted NTFS. D. The files are encrypted.

B. The destination drive is formatted FAT32.

Chris is analyzing Chrome browsing information as part of a forensic investigation. After querying the visits table that Chrome stores, he discovers a 64-bit integer value stored as "visit time" listed with a value of 131355792940000000. What conversion does he need to perform on this data to make it useful? A. The value is in seconds since January 1, 1970. B. The value is in seconds since January 1, 1601. C. The value is a Microsoft timestamp and can be converted using the time utility. D. The value is an ISO 8601-formatted date and can be converted with any ISO time utility.

B. The value is in seconds since January 1, 1601.

As the CISO of her organization, Mei is working on an incident classification scheme and wants to base her design on NIST's definitions. Which of the following options should she use to best describe a user accessing a file that they are not authorized to view? A. An incident B. An event C. An adverse event D. A security incident

C. An adverse event

Adam believes that a system on his network is infected but does not know which system. To detect it, he creates a query for his network monitoring software based on the following pseudocode. What type of traffic is he most likely trying to detect? destip: [*] and duration ˂ 10 packets and destbytes ˂ 3000 and flowcompleted = true and application = http or https or tcp or unknown and content != uripath:* and content != contentencoding:* A. Users browsing malicious sites B. Adware C. Beaconing D. Outbound port scanning

C. Beaconing

What type of attack behavior is shown here? A. Kernel override B. RPC rewrite C. Buffer overflow D. Heap hack

C. Buffer overflow

During an incident response process, Suki heads to a compromised system and pulls its network cable. What phase of the incident response process is Suki performing? A. Preparation B. Detection and analysis C. Containment, eradication, and recovery D. Postincident activity

C. Containment, eradication, and recovery

Susan wants to protect the Windows workstations in her domain from buffer overflow attacks. What should she recommend to the domain administrators at her company? A. Install an antimalware tool. B. Install an antivirus tool. C. Enable DEP in Windows. D. Set VirtualAllocProtection to 1 in the registry.

C. Enable DEP in Windows.

Which of the following mobile device forensic techniques is not a valid method of isolation during forensic examination? A. Use a forensic SIM. B. Buy and use a forensic isolation appliance. C. Place the device in an antistatic bag. D. Put the device in airplane mode.

C. Place the device in an antistatic bag.

Refer to the image shown here to answer the question. What phase should Carol expect to spend the most person-hours in? A. Identification B. Collection and preservation C. Processing, review, and analysis D. Production

C. Processing, review, and analysis

Amanda has been tasked with acquiring data from an iPhone as part of a mobile forensics effort. At what point should she remove the SIM (or UICC) card from the device if she receives the device in a powered-on state? A. While powered on, but after logical collection B. While powered on, prior to logical collection C. While powered off, after logical collection D. While powered off, before logical collection

C. While powered off, after logical collection

While reviewing his OSSEC SIEM logs, Chris notices the following entries. What should his next action be if he wants to quickly identify the new user's creation date and time? A. Check the user.log for a new user. B. Check syslog for a new user. C. Check /etc/passwd for a new user. D. Check auth.log for a new user.

D. Check auth.log for a new user.

Forensic investigation shows that the target of the investigation used the Windows Quick Format command to attempt to destroy evidence on a USB thumb drive. Which of the NIST sanitization techniques has the target of the investigation used in their attempt to conceal evidence? A. Clear B. Purge C. Destroy D. None of the above

D. None of the above

What useful information cannot be determined from the contents of the $HOME/.ssh folder when conducting forensic investigations of a Linux system? A. Remote hosts that have been connected to B. Private keys used to log in elsewhere C. Public keys used for logins to this system D. Passphrases associated with the keys

D. Passphrases associated with the keys

During an incident response process, Cynthia conducts a lessons learned review. What phase of the incident response process is she in? A. Preparation B. Detection and analysis C. Containment, eradication, and recovery D. Postincident recovery

D. Postincident recovery

Sadiq wants to verify that authentication to a Linux service has two-factor authentication settings set as a requirement. Which common Linux directory can he check for this type of setting, listed by application, if the application supports it? A. /etc/pam.d B. /etc/passwd C. /etc/auth.d D. /etc/tfa

A. /etc/pam.d

Cullen wants to ensure that his chain of custody documentation will stand up to examination in court. Which of the following options will provide him with the best documentary proof of his actions? A. A second examiner acting as a witness and countersigning all actions B. A complete forensic log book signed and sealed by a notary public C. A documented forensic process with required sign-off D. Taking pictures of all independent forensic actions

A. A second examiner acting as a witness and countersigning all actions

Kathleen is restoring a critical business system to operation after a major compromise and needs to validate that the operating system and application files are legitimate and do not have any malicious code included in them. What type of tool should she use to validate this? A. A trusted system binary kit B. Dynamic code analysis C. Static code analysis D. File rainbow tables

A. A trusted system binary kit

Ben wants to coordinate with other organizations in the information security community to share data and current events as well as warnings of new security issues. What type of organization should he join? A. An ISAC B. A CSIRT C. A VPAC D. An IRT

A. An ISAC

Scott needs to ensure that the system he just rebuilt after an incident is secure. Which type of scan will provide him with the most useful information to meet his goal? A. An authenticated vulnerability scan from a trusted internal network B. An unauthenticated vulnerability scan from a trusted internal network C. An authenticated scan from an untrusted external network D. An unauthenticated scan from an untrusted external network

A. An authenticated vulnerability scan from a trusted internal network

Chris wants to run John the Ripper against a Linux system's passwords. What does he need to attempt password recovery on the system? A. Both /etc/passwd and /etc/shadow B. /etc/shadow C. /etc/passwd D. Chris cannot recover passwords; only hashes are stored.

A. Both /etc/passwd and /etc/shadow

Jessica wants to access a macOS FileVault 2-encrypted drive. Which of the following methods is not a possible means of unlocking the volume? A. Change the FileVault key using a trusted user account. B. Retrieve the key from memory while the volume is mounted. C. Acquire the recovery key. D. Extract the keys from iCloud.

A. Change the FileVault key using a trusted user account.

Which of the following organizations is not typically involved in postincident communications? A. Developers B. Marketing C. Public relations D. Legal

A. Developers

A server in the datacenter that Chris is responsible for monitoring unexpectedly connects to an off-site IP address and transfers 9 GB of data to the remote system. What type of monitoring should Chris enable to best assist him in detecting future events of this type? A. Flow logs with heuristic analysis B. SNMP monitoring with heuristic analysis C. Flow logs with signature-based detection D. SNMP monitoring with signature-based detection

A. Flow logs with heuristic analysis

While reviewing storage usage on a Windows system, Brian checks the volume shadow copy storage as shown here: C:\WINDOWS\system32˃vssadmin list Shadowstorage vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. Shadow Copy Storage association For volume: (C:)\\?\Volume{c3b53dae-0e54-13e3-97ab-806e6f6e69633}\ Shadow Copy Storage volume: (C:)\\?\Volume{c3b53dae-0e54-13e3-97ab-806e6f6e6963}\ Used Shadow Copy Storage space: 25.6 GB (2%) Allocated Shadow Copy Storage space: 26.0 GB (2%) Maximum Shadow Copy Storage space: 89.4 GB (10%) What purpose does this storage serve, and can he safely delete it? A. It provides a block-level snapshot and can be safely deleted. B. It provides secure hidden storage and can be safely deleted. C. It provides secure hidden storage and cannot be safely deleted. D. It provides a block-level snapshot and cannot be safely deleted.

A. It provides a block-level snapshot and can be safely deleted.

While conducting a forensic review of a system involved in a data breach, Alex discovers a number of Microsoft Word files including files with filenames like critical_data.docx and sales_estimates_2020.docx. When he attempts to review the files using a text editor for any useful information, he finds only unreadable data. What has occurred? A. Microsoft Word files are stored in ZIP format. B. Microsoft Word files are encrypted. C. Microsoft Word files can be opened only by Microsoft Word. D. The user has used antiforensic techniques to scramble the data.

A. Microsoft Word files are stored in ZIP format.

During their organization's incident response preparation, Manish and Linda are identifying critical information assets that the company uses. Included in their organizational data sets is a list of customer names, addresses, phone numbers, and demographic information. How should Manish and Linda classify this information? A. PII B. Intellectual property C. PHI D. PCI DSS

A. PII

John has designed his network as shown here and places untrusted systems that want to connect to the network into the Guests network segment. What is this type of segmentation called? A. Proactive network segmentation B. Isolation C. Quarantine D. Removal

A. Proactive network segmentation

Christina is configuring alerts for rogue devices on her monitoring system and wants to select an appropriate reset condition for rogue MAC address alerts. Which of the options shown here is best suited to handling rogue devices if she wants to avoid creating additional work for her team? A. Reset when no longer true. B. Reset after a time period. C. No reset condition; trigger each time the condition is met. D. No reset action; manually remove the alert from the active alerts list.

A. Reset when no longer true.

Kelly sees high CPU utilization in the Windows Task Manager, as shown here, while reviewing a system's performance issues. If she wants to get a detailed view of the CPU usage by application, with PIDs and average CPU usage, what native Windows tool can she use to gather that detail? A. Resource Monitor B. Task Manager C. iperf D. Perfmon

A. Resource Monitor

Liam notices the following entries in his Squert web console (a web console for Sguil IDS data). What should he do next to determine what occurred? A. Review SSH logs. B. Disable SSH and then investigate further. C. Disconnect the server from the Internet and then investigate. D. Immediately change his password.

A. Review SSH logs.

While reviewing system logs, Charles discovers that the processor for the workstation he is reviewing has consistently hit 100 percent processor utilization by the web browser. After reviewing the rest of the system, no unauthorized software appears to have been installed. What should Charles do next? A. Review the sites visited by the web browser when the CPU utilization issues occur B. Check the browser binary against a known good version C. Reinstall the browser D. Disable TLS

A. Review the sites visited by the web browser when the CPU utilization issues occur

Derek sets up a series of virtual machines that are automatically created in a completely isolated environment. Once created, the systems are used to run potentially malicious software and files. The actions taken by those files and programs are recorded and then reported. What technique is Derek using? A. Sandboxing B. Reverse engineering C. Malware disassembly D. Darknet analysis

A. Sandboxing

Amanda is reviewing the security of a system that was previously compromised. She is searching for signs that the attacker has achieved persistence on the system. Which one of the following should be her highest priority to review? A. Scheduled tasks B. Network traffic C. Running processes D. Application logs

A. Scheduled tasks

While investigating a compromise, Jack discovers four files that he does not recognize and believes may be malware. What can he do to quickly and effectively check the files to see whether they are malware? A. Submit them to a site like VirusTotal. B. Open them using a static analysis tool. C. Run strings against each file to identify common malware identifiers. D. Run a local antivirus or antimalware tool against them.

A. Submit them to a site like VirusTotal.

Susan needs to perform forensics on a virtual machine. What process should she use to ensure she gets all of the forensic data she may need? A. Suspend the machine and copy the contents of the directory it resides in. B. Perform a live image of the machine. C. Suspend the machine and make a forensic copy of the drive it resides on. D. Turn the virtual machine off and make a forensic copy of it.

A. Suspend the machine and copy the contents of the directory it resides in.

Latisha wants to ensure that the two most commonly used methods for preventing Linux buffer overflow attacks are enabled for the operating system she is installing on her servers. What two related technologies should she investigate to help protect her systems? A. The NX bit and ASLR B. StackAntismash and DEP C. Position-independent variables and ASLR D. DEP and the position-independent variables

A. The NX bit and ASLR

Roger's monitoring system provides Windows memory utilization reporting. Use the chart shown here to determine what actions Roger should take based on his monitoring. A. The memory usage is stable and can be left as it is. B. The memory usage is high and must be addressed. C. Roger should enable automatic memory management. D. There is not enough information to make a decision.

A. The memory usage is stable and can be left as it is.

Vlad wants to determine whether the user of a company-owned laptop accessed a malicious wireless access point. Where can he find the list of wireless networks that the system knows about? A. The registry B. The user profile directory C. The wireless adapter cache D. Wireless network lists are not stored after use.

A. The registry

Lukas wants to purge a drive to ensure that data cannot be extracted from it when it is sent off-site. Which of the following is not a valid option for purging hard drives on a Windows system? A. Use the built-in Windows sdelete command line. B. Use Eraser. C. Use DBAN. D. Encrypt the drive and then delete the key.

A. Use the built-in Windows sdelete command line.

Cameron believes that the Ubuntu Linux system that he is restoring to service has already been fully updated. What command can he use to check for new updates, and where can he check for the history of updates on his system? A. apt-get -u upgrade, /var/log/apt B. rpm -i upgrade, /var/log/rpm C. upgrade -l, /var/log/upgrades D. apt-get install -u; Ubuntu Linux does not provide a history of updates.

A. apt-get -u upgrade, /var/log/apt

Casey's search for a possible Linux backdoor account during a forensic investigation has led her to check through the filesystem for issues. Where should she look for back doors associated with services? A. /etc/passwd B. /etc/xinetd.conf C. /etc/shadow D. $HOME/.ssh/

B. /etc/xinetd.conf

NIST defines five major types of threat information types in NIST SP 800-150, "Guide to Cyber Threat Information Sharing." Indicators, which are technical artifacts or observables that suggest an attack is imminent, currently underway, or compromise may have already occurred Tactics, techniques, and procedures that describe the behavior of an actor Security alerts like advisories and bulletins Threat intelligence reports that describe actors, systems, and information being targeted and the methods being used Tool configurations that support collection, exchange, analysis, and use of threat information Which of these should Frank seek out to help him best protect the midsize organization he works for against unknown threats? A. 1, 2, and 5 B. 1, 3, and 5 C. 2, 4, and 5 D. 1, 2, and 4

B. 1, 3, and 5

Greg suspects that an attacker is running an SSH server on his network over a nonstandard port. What port is normally used for SSH communications? A. 21 B. 22 C. 443 D. 444

B. 22

Barb wants to detect unexpected output from the application she is responsible for managing and monitoring. What type of tool can she use to detect unexpected output effectively? A. A log analysis tool B. A behavior-based analysis tool C. A signature-based detection tool D. Manual analysis

B. A behavior-based analysis tool

What incident response tool should Kai build prior to an incident to ensure that staff can reach critical responders when needed? A. A triage triangle B. A call list C. A call rotation D. A responsibility matrix

B. A call list

During the preparation phase of his organization's incident response process, Oscar gathers a laptop with useful software including a sniffer and forensics tools, thumb drives and external hard drives, networking equipment, and a variety of cables. What is this type of preprepared equipment commonly called? A. A grab bag B. A jump kit C. A crash cart D. A first responder kit

B. A jump kit

Manish finds the following entries on a Linux system in /var/log/auth.log. If he is the only user with root privileges, requires two-factor authentication to log in as root, and did not take the actions shown, what should he check for? A. A hacked root account B. A privilege escalation attack from a lower privileged account or service C. A malware infection D. A RAT

B. A privilege escalation attack from a lower privileged account or service

Charles needs to review the permissions set on a directory structure on a Window system he is investigating. Which Sysinternals tool will provide him with this functionality? A. DiskView B. AccessEnum C. du D. AccessChk

B. AccessEnum

Mika finds that the version of Java installed on her organization's web server has been replaced. What type of issue is this best categorized as? A. Unauthorized software B. An unauthorized change C. Unexpected input D. A memory overflow

B. An unauthorized change

Profiling networks and systems can help to identify unexpected activity. What type of detection can be used once a profile has been created? A. Dynamic analysis B. Anomaly analysis C. Static analysis D. Behavioral analysis

B. Anomaly analysis

During a forensic analysis of an employee's computer as part of a human resources investigation into misuse of company resources, Tim discovers a program called Eraser installed on the PC. What should Tim expect to find as part of his investigation? A. A wiped C: drive B. Antiforensic activities C. All slack space cleared D. Temporary files and Internet history wiped

B. Antiforensic activities

After submitting a suspected malware package to VirusTotal, Damian receives the following results. What does this tell Damian? A. The submitted file contains more than one malware package. B. Antivirus vendors use different names for the same malware. C. VirusTotal was unable to specifically identify the malware. D. The malware package is polymorphic, and matches will be incorrect.

B. Antivirus vendors use different names for the same malware.

As an employee of the U.S. government, Megan is required to use NIST's information impact categories to classify security incidents. During a recent incident, proprietary information was changed. How should she classify this incident? A. As a privacy breach B. As an integrity loss C. As a proprietary breach D. As an availability breach

B. As an integrity loss

A disgruntled former employee uses the systems she was responsible for to slow down the network that Chris is responsible for protecting during a critical business event. What NIST threat classification best fits this type of attack? A. Impersonation B. Attrition C. Improper usage D. Web

B. Attrition

Cynthia wants to build scripts to detect malware beaconing behavior. Which of the following is not a typical means of identifying malware beaconing behavior on a network? A. Persistence of the beaconing B. Beacon protocol C. Beaconing interval D. Removal of known traffic

B. Beacon protocol

Latisha wants to avoid running a program installed by a user that she believes is set with a RunOnce key in the Windows registry but needs to boot the system. What can she do to prevent RunOnce from executing the programs listed in the registry key? A. Disable the registry at boot. B. Boot into Safe Mode. C. Boot with the -RunOnce flag. D. RunOnce cannot be disabled; she will need to boot from external media to disable it first.

B. Boot into Safe Mode.

Joe wants to recover the passwords for local Windows users on a Windows workstation. Where are the password hashes stored? A. C:\Windows\System32\passwords B. C:\Windows\System32\config C. C:\Windows\Secure\config D. C:\Windows\Secure\accounts

B. C:\Windows\System32\config

Suki has been asked to capture forensic data from a Windows PC and needs to ensure that she captures the data in their order of volatility. Which order is correct from most volatile to least volatile? A. Network traffic, CPU cache, disk drives, optical media B. CPU cache, network traffic, disk drives, optical media C. Optical media, disk drives, network traffic, CPU cache D. Network traffic, CPU cache, optical media, disk drives

B. CPU cache, network traffic, disk drives, optical media

Vlad believes that an attacker may have added accounts and attempted to obtain extra rights on a Linux workstation. Which of the following is not a common way to check for unexpected accounts like this? A. Review /etc/passwd and /etc/shadow for unexpected accounts. B. Check /home/ for new user directories. C. Review /etc/sudoers for unexpected accounts. D. Check /etc/groups for group membership issues.

B. Check /home/ for new user directories.

After completing an incident response process and providing a final report to management, what step should Casey use to identify improvement to her incident response plan? A. Update system documentation. B. Conduct a lessons learned session. C. Review patching status and vulnerability scans. D. Engage third-party consultants.

B. Conduct a lessons learned session.

During a forensic investigation, Lukas discovers that he needs to capture a virtual machine that is part of the critical operations of his company's website. If he cannot suspend or shut down the machine for business reasons, what imaging process should he follow? A. Perform a snapshot of the system, boot it, suspend the copied version, and copy the directory it resides in. B. Copy the virtual disk files and then use a memory capture tool. C. Escalate to management to get permission to suspend the system to allow a true forensic copy. D. Use a tool like the Volatility Framework to capture the live machine completely.

B. Copy the virtual disk files and then use a memory capture tool.

Rick is conducting a forensic investigation of a compromised system. He knows from user reports that issues started at approximately 3:30 p.m. on June 12. Using the SANS SIFT open source forensic tool, what process should he use to determine what occurred? A. Search the drive for all files that were changed between 3 and 4 p.m. B. Create a Super Timeline. C. Run antimalware and search for newly installed malware tools during that time frame. D. Search system logs for events between 3 and 4 p.m.

B. Create a Super Timeline.

During a major incident response effort, Kobe discovers evidence that a critical application server may have been the data repository and egress point in the compromise he is investigating. If he is unable to take the system offline, which of the following options will provide him with the best forensic data? A. Reboot the server and mount the system drive using a USB-bootable forensic suite. B. Create an image using a tool like FTK Imager Lite. C. Capture the system memory using a tool like Volatility. D. Install and run an imaging tool on the live server.

B. Create an image using a tool like FTK Imager Lite.

Which of the following items is not typically found in corporate forensic kits? A. Write blockers B. Crime scene tape C. Label makers D. Decryption tools

B. Crime scene tape

Jessica wants to recover deleted files from slack space and needs to identify where the files begin and end. What is this process called? A. Slacking B. Data carving C. Disk recovery D. Header manipulation

B. Data carving

As part of his forensic investigation, Scott intends to make a forensic image of a network share that is mounted by the PC that is the focus of his investigation. What information will he be unable to capture? A. File creation dates B. Deleted files C. File permission data D. File metadata

B. Deleted files

Which of the following is not an important part of the incident response communication process? A. Limiting communication to trusted parties B. Disclosure based on public feedback C. Using a secure method of communication D. Preventing accidental release of incident-related information

B. Disclosure based on public feedback

Ben is investigating a potential malware infection of a laptop belonging to a senior manager in the company he works for. When the manager opens a document, website, or other application that takes user input, words start to appear as though they are being typed. What is the first step that Ben should take in his investigation?A. Run an antivirus scan.B. Disconnect the system from the network.C. Wipe the system and reinstall.D. Observe and record what is being typed.

B. Disconnect the system from the network.

Tom is building his incident response team and is concerned about how the organization will address insider threats. Which business function would be most capable of assisting with the development of disciplinary policies? A. Information security B. Human resources C. Legal counsel D. Senior management

B. Human resources

Mel is creating the evidence log for a computer that was part of an attack on an external third-party system. What network-related information should he include in that log if he wants to follow NIST's recommendations? A. Subnet mask, DHCP server, hostname, MAC address B. IP addresses, MAC addresses, hostname C. Domain, hostname, MAC addresses, IP addresses D. NIC manufacturer, MAC addresses, IP addresses, DHCP configuration

B. IP addresses, MAC addresses, hostname

Which of the following cloud service environments is likely to provide the best available information for forensic analysis? A. SaaS B. IaaS C. PaaS D. IDaaS

B. IaaS

Refer to the image shown here to answer the question. During an e-discovery process, Carol reviews the request from opposing counsel and builds a list of all of the individuals identified. She then contacts the IT staff who support each person to request a list of their IT assets. What phase of the EDRM flow is she in? A. Information governance B. Identification C. Preservation D. Collection

B. Identification

Which of the following activities is not part of the containment and restoration process? A. Minimizing loss B. Identifying the attacker C. Limiting service disruption D. Rebuilding compromised systems

B. Identifying the attacker

Maria wants to understand what a malware package does and executes it in a virtual machine that is instrumented using tools that will track what the program does, what changes it makes, and what network traffic it sends while allowing her to make changes on the system or to click files as needed. What type of analysis has Maria performed? A. Manual code reversing B. Interactive behavior analysis C. Static property analysis D. Dynamic code analysis

B. Interactive behavior analysis

Cynthia is reviewing her organization's incident response recovery process, which is outlined here. Which of the following recommendations should she make to ensure that further issues do not occur during the restoration process? A. Change passwords before restoring from backup B. Isolate the system before restoring from backups C. Securely wipe the drive before restoration D. Vulnerability scan before patching

B. Isolate the system before restoring from backups

Jose is aware that an attacker has compromised a system on his network but wants to continue to observe the attacker's efforts as they continue their attack. If Jose wants to prevent additional impact on his network while watching what the attacker does, what containment method should he use? A. Removal B. Isolation C. Segmentation D. Detection

B. Isolation

Jack is preparing to take a currently running PC back to his forensic lab for analysis. As Jack considers his forensic process, one of his peers recommends that he simply pull the power cable rather than doing a software-based shutdown. Why might Jack choose to follow this advice? A. It will create a crash log, providing useful memory forensic information. B. It will prevent shutdown scripts from running. C. It will create a memory dump, providing useful forensic information. D. It will cause memory-resident malware to be captured, allowing analysis.

B. It will prevent shutdown scripts from running.

What common incident response follow-up activity includes asking questions like "What additional tools or resources are needed to detect or analyze future events?" A. Preparation B. Lessons learned review C. Evidence gathering D. Procedural analysis

B. Lessons learned review

What level of forensic data extraction will most likely be possible and reasonable for a corporate forensic examiner who deals with modern phones that provide filesystem encryption? A. Level 1: Manual extraction B. Level 2: Logical extraction C. Level 3: JTAG or HEX dumping D. Level 4: Chip extraction

B. Level 2: Logical extraction

If Lucca wants to validate the application files he has downloaded from the vendor of his application, what information should he request from them? A. File size and file creation date B. MD5 hash C. Private key and cryptographic hash D. Public key and cryptographic hash

B. MD5 hash

Singh is attempting to diagnose high memory utilization issues on a macOS system and notices a chart showing memory pressure. What does memory pressure indicate for macOS when the graph is yellow and looks like the following image? A. Memory resources are available. B. Memory resources are available but being tasked by memory management processes. C. Memory resources are in danger, and applications will be terminated to free up memory. D. Memory resources are depleted, and the disk has begun to swap.

B. Memory resources are available but being tasked by memory management processes.

NIST describes four major phases in the incident response cycle. Which of the following is not one of the four? A. Containment, eradication, and recovery B. Notification and communication C. Detection and analysis D. Preparation

B. Notification and communication

The company that Brian works for processes credit cards and is required to be compliant with PCI DSS. If Brian's company experiences a breach of card data, what type of disclosure will they be required to provide? A. Notification to local law enforcement B. Notification to their acquiring bank C. Notification to federal law enforcement D. Notification to Visa and MasterCard

B. Notification to their acquiring bank

While working to restore systems to their original configuration after a long-term APT compromise, Manish has three options: He can restore from a backup and then update patches on the system. He can rebuild and patch the system using original installation media and application software using his organization's build documentation. He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems. Which option should Manish choose in this scenario? A. Option A B. Option B C. Option C D. None of the above. Manish should hire a third party to assess the systems before proceeding.

B. Option B

As part of his incident response program, Allan is designing a playbook for zero-day threats. Which of the following should not be in his plan to handle them? A. Segmentation B. Patching C. Using threat intelligence D. Whitelisting

B. Patching

James wants to determine whether other Windows systems on his network are infected with the same malware package that he has discovered on the workstation he is analyzing. He has removed the system from his network by unplugging its network cable, as required by corporate policy. He knows that the system has previously exhibited beaconing behavior and wants to use that behavior to identify other infected systems. How can he safely create a fingerprint for this beaconing without modifying the infected system? A. Plug the system in to the network and capture the traffic quickly at the firewall using Wireshark or tcpdump. B. Plug the system into an isolated switch and use a span port or tap and Wireshark/tcpdump to capture traffic. C. Review the ARP cache for outbound traffic. D. Review the Windows Firewall log for traffic logs.

B. Plug the system into an isolated switch and use a span port or tap and Wireshark/tcpdump to capture traffic.

The senior management at the company that Kathleen works for is concerned about rogue devices on the network. If Kathleen wants to identify rogue devices on her wired network, which of the following solutions will quickly provide the most accurate information? A. A discovery scan using a port scanner B. Router and switch-based MAC address reporting C. A physical survey D. Reviewing a central endpoint administration tool

B. Router and switch-based MAC address reporting

Marsha needs to ensure that the workstations she is responsible for have received a critical Windows patch. Which of the following methods should she avoid using to validate patch status for Windows 10 systems? A. Check the Update History manually. B. Run the Microsoft Baseline Security Analyzer. C. Create and run a PowerShell script to search for the specific patch she needs to check. D. Use an endpoint configuration manager to validate patch status for each machine on her domain.

B. Run the Microsoft Baseline Security Analyzer.

Which one of the following data elements would constitute sensitive personal information (SPI) under the European Union's General Data Protection Regulation? A. Driver's license number B. Sexual orientation C. Bank account number D. Address

B. Sexual orientation

Mei's team has completed the initial phases of their incident response process and is assessing the time required to recover from the incident. Using the NIST recoverability effort categories, the team has determined that they can predict the time to recover but will require additional resources. How should she categorize this using the NIST model? A. Regular B. Supplemented C. Extended D. Not recoverable

B. Supplemented

Latisha wants to create a documented chain of custody for the systems that she is handling as part of a forensic investigation. Which of the following will provide her with evidence that systems were not tampered with while she is not working with them? A. A chain-of-custody log B. Tamper-proof seals C. System logs D. None of the above

B. Tamper-proof seals

Pranab wants to determine when a USB device was first plugged into a Windows workstation. What file should he check for this information? A. The registry B. The setupapi log file C. The system log D. The data is not kept on a Windows system.

B. The setupapi log file

Samantha is preparing a report describing the common attack models used by advanced persistent threat actors. Which of the following is a typical characteristic of APT attacks? A. They involve sophisticated DDoS attacks. B. They quietly gather information from compromised systems. C. They rely on worms to spread. D. They use encryption to hold data hostage.

B. They quietly gather information from compromised systems.

Mika, a computer forensic examiner, receives a PC and its peripherals that were seized as forensic evidence during an investigation. After she signs off on the chain of custody log and starts to prepare for her investigation, one of the first things she notes is that each cable and port was labeled with a color-coded sticker by the on-site team. Why are the items labeled like this? A. To ensure chain of custody B. To ensure correct reassembly C. To allow for easier documentation of acquisition D. To tamper-proof the system

B. To ensure correct reassembly

What is the key goal of the containment stage of an incident response process? A. To limit leaks to the press or customers B. To limit further damage from occurring C. To prevent data exfiltration D. To restore systems to normal operation

B. To limit further damage from occurring

Mika wants to analyze the contents of a drive without causing any changes to the drive. What method is best suited to ensuring this? A. Set the "read-only" jumper on the drive. B. Use a write blocker. C. Use a read blocker. D. Use a forensic software package.

B. Use a write blocker.

Rick wants to monitor permissions and ownership changes of critical files on the Red Hat Linux system he is responsible for. What Linux tool can he use to do this? A. watchdog B. auditctl C. dirwatch D. monitord

B. auditctl

Saanvi needs to validate the MD5 checksum of a file on a Windows system but is not allowed to install any programs and cannot run files from external media or drives. What Windows utility can he use to get the MD5 hash of the file? A. md5sum B. certutil C. sha1sum D. hashcheck

B. certutil

Lauren wants to create a backup of Linux permissions before making changes to the Linux workstation she is attempting to remediate. What Linux tool can she use to back up the permissions of an entire directory on the system? A. chbkup B. getfacl C. aclman D. There is not a common Linux permission backup tool.

B. getfacl

Ty needs to determine the proper retention policy for his organization's incident data. If he wants to follow common industry practices and does not have specific legal or contractual obligations that he needs to meet, what timeframe should he select? A. 30 days B. 90 days C. 1 to 2 years D. 7 years

C. 1 to 2 years

What is the minimum retention period for incident data for U.S. federal government agencies? A. 90 days B. 1 year C. 3 years D. 7 years

C. 3 years

Greg finds a series of log entries in his Apache logs showing long strings "AAAAAAAAAAAAAAAAAAAAAAA", followed by strings of characters. What type of attack has he most likely discovered? A. A SQL injection attack B. A denial-of-service attack C. A buffer overflow attack D. A PHP string-ring attack

C. A buffer overflow attack

The incident response kit that Cassandra is building is based around a powerful laptop so that she can perform on-site drive acquisitions and analysis. If she expects to need to acquire data from SATA, IDE, SSD, and flash drives, what item should she include in her kit? A. A write blocker B. A USB hard drive C. A multi-interface drive adapter D. A USB-C cable

C. A multi-interface drive adapter

Susan discovers the following log entries that occurred within seconds of each other in her Squert (a Sguil web interface) console. What have her network sensors most likely detected? A. A failed database connection from a server B. A denial-of-service attack C. A port scan D. A misconfigured log source

C. A port scan

The organization that Jamal works for classifies security related events using NIST's standard definitions. Which classification should he use when he discovers key logging software on one of his frequent business travelers' laptop? A. An event B. An adverse event C. A security incident D. A policy violation

C. A security incident

Selah is preparing to collect a forensic image for a Macintosh computer running the Mojave operating system. What hard drive format is she most likely to encounter? A. FAT32 B. MacFAT C. APFS D. HFS+

C. APFS

The system that Alice has identified as the source of beaconing traffic is one of her organization's critical e-commerce servers. To maintain her organization's operations, she needs to quickly restore the server to its original, uncompromised state. What criterion is most likely to be impacted the most by this action? A. Damage to the system or service B. Service availability C. Ability to preserve evidence D. Time and resources needed to implement the strategy

C. Ability to preserve evidence

Laura needs to check on memory, CPU, disk, network, and power usage on a Mac. What GUI tool can she use to check these? A. Resource Monitor B. System Monitor C. Activity Monitor D. Sysradar

C. Activity Monitor

As Mika studies her company's computer forensics playbook, she notices that forensic investigators are required to use a chain of custody form. What information would she record on that form if she was conducting a forensic investigation? A. The list of individuals who made contact with files leading to the investigation B. The list of former owners or operators of the PC involved in the investigation C. All individuals who work with evidence in the investigation D. The police officers who take possession of the evidence

C. All individuals who work with evidence in the investigation

While conducting a wireless site survey, Susan discovers two wireless access points that are both using the same MAC address. When she attempts to connect to each, she is sent to a login page for her organization. What should she be worried about? A. A misconfigured access point B. A vendor error C. An evil twin attack D. A malicious MAC attack

C. An evil twin attack

A major new botnet infection that uses a peer-to-peer command-and-control process has been released. Latisha wants to detect infected systems but knows that peer-to-peer communication is irregular and encrypted. If she wants to monitor her entire network for this type of traffic, what method should she use to catch infected systems? A. Build an IPS rule to detect all peer-to-peer communications that match the botnet's installer signature. B. Use beaconing detection scripts focused on the command-and-control systems. C. Capture network flows for all hosts and use filters to remove normal traffic types. D. Immediately build a network traffic baseline and analyze it for anomalies.

C. Capture network flows for all hosts and use filters to remove normal traffic types.

Angela is attempting to determine when a user account was created on a Windows 10 workstation. What method is her best option if she believes the account was created recently? A. Check the System log. B. Check the user profile creation date. C. Check the Security log. D. Query the registry for the user ID creation date.

C. Check the Security log.

Bohai wants to ensure that media has been properly sanitized. Which of the following options properly lists sanitization descriptions from least to most effective? A. Purge, clear, destroy B. Eliminate, eradicate, destroy C. Clear, purge, destroy D. Eradicate, eliminate, destroy

C. Clear, purge, destroy

After arriving at an investigation site, Brian determines that three powered-on computers need to be taken for forensic examination. What steps should he take before removing the PCs? A. Power them down, take pictures of how each is connected, and log each system in as evidence. B. Take photos of each system, power them down, and attach a tamper-evident seal to each PC. C. Collect live forensic information, take photos of each system, and power them down. D. Collect a static drive image, validate the hash of the image, and securely transport each system.

C. Collect live forensic information, take photos of each system, and power them down.

During an incident response process, Susan plugs a system back into the network, allowing it normal network access. What phase of the incident response process is Susan performing? A. Preparation B. Detection and analysis C. Containment, eradication, and recovery D. Postincident activity

C. Containment, eradication, and recovery

During what stage of an event is preservation of evidence typically handled? A. Preparation B. Detection and analysis C. Containment, eradication, and recovery D. Postincident activity

C. Containment, eradication, and recovery

Kai has completed the validation process of her media sanitization efforts and has checked a sample of the drives she had purged using a built-in cryptographic wipe utility. What is her next step? A. Resample to validate her testing. B. Destroy the drives. C. Create documentation. D. She is done and can send the drives on for disposition.

C. Create documentation.

Which of the following properly lists the order of volatility from least volatile to most volatile? A. Printouts, swap files, CPU cache, RAM B. Hard drives, USB media, DVDs, CD-RWs C. DVDs, hard drives, virtual memory, caches D. RAM, swap files, SSDs, printouts

C. DVDs, hard drives, virtual memory, caches

Matt's incident response team has collected log information and is working on identifying attackers using that information. What two stages of the NIST incident response process is his time working in? A. Preparation and containment, eradication, and recovery B. Preparation and postincident activity C. Detection and analysis, and containment, eradication, and recovery D. Containment, eradication, and recovery and postincident activity

C. Detection and analysis, and containment, eradication, and recovery

During a security incident, Joanna makes a series of changes to production systems to contain the damage. What type of change should she file in her organization's change control process when the response effort is concluding? A. Routine change B. Priority change C. Emergency change D. Pre-approved change

C. Emergency change

As part of his organization's cooperation in a large criminal case, Adam's forensic team has been asked to send a forensic image of a highly sensitive compromised system in RAW format to an external forensic examiner. What steps should Adam's team take prior to sending a drive containing the forensic image? A. Encode in EO1 format and provide a hash of the original file on the drive. B. Encode in FTK format and provide a hash of the new file on the drive. C. Encrypt the RAW file and transfer a hash and key under separate cover. D. Decrypt the RAW file and transfer a hash under separate cover.

C. Encrypt the RAW file and transfer a hash and key under separate cover.

Lauren recovers a number of 16GB and 32GB microSD cards during a forensic investigation. Without checking them manually, what filesystem type is she most likely to find them formatted in as if they were used with a digital camera? A. RAW B. FAT16 C. FAT32 D. APFS

C. FAT32

Manish wants to monitor file permission changes on a Windows system he is responsible for. What audit category should he enable to allow this? A. File Permissions B. User Rights C. File System D. Audit Objects

C. File System

Rick wants to validate his recovery efforts and intends to scan a web server he is responsible for with a scanning tool. What tool should he use to get the most useful information about system vulnerabilities? A. Wapiti B. nmap C. OpenVAS D. ZAP

C. OpenVAS

Adam wants to quickly crack passwords from a Windows system. Which of the following tools will provide the fastest results in most circumstances? A. John the Ripper B. Cain and Abel C. Ophcrack D. Hashcat

C. Ophcrack

Luke needs to verify settings on a macOS computer to ensure that the configuration items he expects are set properly. What type of file is commonly used to store configuration settings for macOS systems? A. The registry B. .profile files C. Plists D. .config files

C. Plists

Which of the following is not a valid use case for live forensic imaging? A. Malware analysis B. Encrypted drives C. Postmortem forensics D. Nonsupported filesystems

C. Postmortem forensics

Dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them. What phase of the incident response process is Dan in? A. Postincident activity B. Detection and analysis C. Preparation D. Containment, eradication, and recovery

C. Preparation

Jessica wants to track the changes made to the registry and filesystem while running a suspect executable on a Windows system. Which Sysinternals tool will allow her to do this? A. App Monitor B. Resource Tracker C. Process Monitor D. There is no Sysinternals tool with this capability.

C. Process Monitor

What is the primary role of management in the incident response process? A. Leading the CSIRT B. Acting as the primary interface with law enforcement C. Providing authority and resources D. Assessing impact on stakeholders

C. Providing authority and resources

Lakshman needs to sanitize hard drives that will be leaving his organization after a lease is over. The drives contained information that his organization classifies as sensitive data that competitors would find valuable if they could obtain it. Which choice is the most appropriate to ensure that data exposure does not occur during this process? A. Clear, validate, and document. B. Purge the drives. C. Purge, validate, and document. D. The drives must be destroyed to ensure no data loss.

C. Purge, validate, and document.

Piper wants to create a forensic image that third-party investigators can use but does not know what tool the third-party investigation team that her company intends to engage will use. Which of the following forensic formats should she choose if she wants almost any forensic tool to be able to access the image? A. E01 B. AFF C. RAW D. AD1

C. RAW

The Stuxnet attack relied on engineers who transported malware with them, crossing the air gap between networks. What type of threat is most likely to cross an air-gapped network? A. Email B. Web C. Removable media D. Attrition

C. Removable media

Nara is reviewing event logs to determine who has accessed a workstation after business hours. When she runs secpol.msc on the Windows system she is reviewing, she sees the following settings. What important information will be missing from her logs? A. Login failures B. User IDs from logins C. Successful logins D. Times from logins

C. Successful logins

Where is slack space found in the following Windows partition map? A. The System Reserved partition B. The System Reserved and Unallocated partitions C. The System Reserved and C: partitions D. The C: and unallocated partitions

C. The System Reserved and C: partitions

While performing forensic analysis of an iPhone backup, Cynthia discovers that she has only some of the information that she expects the phone to contain. What is the most likely scenario that would result in the backup she is using having partial information? A. The backup was interrupted. B. The backup is encrypted. C. The backup is a differential backup. D. The backup is stored in iCloud.

C. The backup is a differential backup.

As part of a test of her network's monitoring infrastructure, Kelly uses snmpwalk to validate her router SNMP settings. She executes snmpwalk as shown here: snmpwalk -c public 10.1.10.1 -v1 iso.3.6.1.2.1.1.0 = STRING: "RouterOS 3.6" iso.3.6.1.2.1.2.0 = OID: iso.3.6.1.4.1.30800 iso.3.6.1.2.1.1.3.0 = Timeticks: (1927523) 08:09:11 iso.3.6.1.2.1.1.4.0 = STRING: "root" iso.3.6.1.2.1.1.5.0 = STRING: "RouterOS" ... Which of the following pieces of information is not something she can discover from this query? A. SNMP v1 is enabled. B. The community string is public. C. The community string is root. D. The contact name is root.

C. The community string is root.

Raj discovers that the forensic image he has attempted to create has failed. What is the most likely reason for this failure? A. Data was modified. B. The source disk is encrypted. C. The destination disk has bad sectors. D. The data cannot be copied in RAW format.

C. The destination disk has bad sectors.

Near the end of a typical business day, Suki is notified that her organization's email servers have been blacklisted because of email that appears to originate from her domain. What information does she need to start investigating the source of the spam emails? A. Firewall logs showing SMTP connections B. The SMTP audit log from her email server C. The full headers of one of the spam messages D. Network flows for her network

C. The full headers of one of the spam messages

As part of his forensic analysis of a series of photos, John runs exiftool for each photo. He receives the following listing from one photo. What useful forensic information can he gather from this photo? A. The original creation date, the device type, the GPS location, and the creator's name B. The endian order of the file, the file type, the GPS location, and the scene type C. The original creation date, the device type, the GPS location, and the manufacturer of the device D. The MIME type, the GPS time, the GPS location, and the creator's name

C. The original creation date, the device type, the GPS location, and the manufacturer of the device

While investigating a spam email, Adam is able to capture headers from one of the email messages that was received. He notes that the sender was Carmen Victoria Garci. What facts can he gather from the headers shown here? A. Victoria Garci's email address is [email protected]. B. The sender sent via Yahoo. C. The sender sent via a system in Japan. D. The sender sent via Gmail.

C. The sender sent via a system in Japan.

Fred is attempting to determine whether a user account is accessing other systems on his network and uses lsof to determine what files the user account has open. What information should he identify when faced with the following lsof output? A. The user account demo is connected from remote.host.com to a local system. B. The user demo has replaced the /bash executable with one they control. C. The user demo has an outbound connection to remote.host.com. D. The user demo has an inbound SSH connection and has replaced the Bash binary.

C. The user demo has an outbound connection to remote.host.com.

While investigating a system error, Lauren runs the df command on a Linux box that she is the administrator for. What problem and likely cause should she identify based on this listing? # df -h /var/ Filesystem Size Used Avail Use% Mounted on /dev/sda1 40G 11.2G 28.8 28% / /dev/sda2 3.9G 3.9G 0 100% /var A. The var partition is full and needs to be wiped. B. Slack space has filled up and needs to be purged. C. The var partition is full, and logs should be checked. D. The system is operating normally and will fix the problem after a reboot.

C. The var partition is full, and logs should be checked.

While reviewing his network for rogue devices, Dan notes that a system with MAC address D4:BE:D9:E5:F9:18 has been connected to a switch in one of the offices in his building for three days. What information can this provide Dan that may be helpful if he conducts a physical survey of the office? A. The operating system of the device B. The user of the system C. The vendor who built the system D. The type of device that is connected

C. The vendor who built the system

While performing post-rebuild validation efforts, Scott scans a server from a remote network and sees no vulnerabilities. Joanna, the administrator of the machine, runs a scan and discovers two critical vulnerabilities and five moderate issues. What is most likely causing the difference in their reports? A. Different patch levels were used during the scans. B. They are scanning through a load balancer. C. There is a firewall between the remote network and the server. D. Scott or Joanna ran the vulnerability scan with different settings.

C. There is a firewall between the remote network and the server.

Azra needs to access a macOS system but does not have the user's password. If the system is not FileVaulted, which of the following options is not a valid recovery method? A. Use Single User mode to reset the password. B. Use Recovery mode to recover the password. C. Use Target Disk mode to delete the Keychain. D. Reset the password from another privileged user account.

C. Use Target Disk mode to delete the Keychain.

While reviewing the actions taken during an incident response process, Mei is informed by the local desktop support staff person that the infected machine was returned to service by using a Windows system restore point. Which of the following items will a Windows system restore return to a previous state? A. Personal files B. Malware C. Windows system files D. All installed apps

C. Windows system files

Which one of the following file manipulation commands is not used to display the contents of a file? A. head B. tail C. chmod D. cat

C. chmod

While checking for bandwidth consumption issues, Bohai uses the ifconfig command on the Linux box that he is reviewing. He sees that the device has sent less than 4 GB of data, but his network flow logs show that the system has sent over 20GB. What problem has Bohai encountered? A. A rootkit is concealing traffic from the Linux kernel. B. Flow logs show traffic that does not reach the system. C. ifconfig resets traffic counters at 4 GB. D. ifconfig only samples outbound traffic and will not provide accurate information.

C. ifconfig resets traffic counters at 4 GB.

In order, which set of Linux permissions are least permissive to most permissive? A. 777, 444, 111 B. 544, 444, 545 C. 711, 717, 117 D. 111, 734, 747

D. 111, 734, 747

Laura needs to create a secure messaging capability for her incident response team. Which of the following methods will provide her with a secure messaging tool? A. Text messaging B. A Jabber server with TLS enabled C. Email with TLS enabled D. A messaging application that uses the Signal protocol

D. A messaging application that uses the Signal protocol

During an incident response effort, Alex discovers a running Unix process that shows that it was run using the command nc -k -l 6667. He does not recognize the service, believes it may be a malicious process, and needs assistance in determining what it is. Which of the following would best describe what he has encountered? A. An IRC server B. A network catalog server C. A user running a shell command D. A netcat server

D. A netcat server

Samantha has recently taken a new position as the first security analyst that her employer has ever had on staff. During her first week, she discovers that there is no information security policy and that the IT staff do not know what to do during a security incident. Samantha plans to stand up a CSIRT to handle incident response. What type of documentation should she provide to describe specific procedures that the CSIRT will use during events like malware infections and server compromise? A. An incident response policy B. An operations manual C. An incident response program D. A playbook

D. A playbook

When Abdul arrived at work this morning, he found an email in his inbox that read, "Your systems are weak; we will own your network by the end of the week." How would he categorize this sign of a potential incident if he was using the NIST SP 800-61 descriptions of incident signs? A. An indicator B. A threat C. A risk D. A precursor

D. A precursor

After zero-wiping a system's hard drive and rebuilding it with all security patches and trusted accounts, Azra is notified that the system is once again showing signs of compromise. Which of the following types of malware package cannot survive this type of eradication effort? A. An MBR-resident malware tool B. A UEFI-resident malware C. A BIOS-resident malware D. A slack space-resident malware package

D. A slack space-resident malware package

Carol has discovered an attack that appears to be following the process flow shown here. What type of attack should she identify this as? A. Phishing B. Zero-day exploit C. Whaling D. Advanced persistent threat

D. Advanced persistent threat

Lauren wants to detect administrative account abuse on a Windows server that she is responsible for. What type of auditing permissions should she enable to determine whether users with administrative rights are making changes? A. Success B. Fail C. Full control D. All

D. All

John believes that the image files he has encountered during a forensic investigation were downloaded from a site on the Internet. What tool can John use to help identify where the files were downloaded from? A. Google reverse image search B. Tineye C. Bing Image Match D. All of the above

D. All of the above

Scott needs to verify that the forensic image he has created is an exact duplicate of the original drive. Which of the following methods is considered forensically sound? A. Create a MD5 hash B. Create a SHA-1 hash C. Create a SHA-2 hash D. All of the above

D. All of the above

Angela is conducting an incident response exercise and needs to assess the economic impact to her organization of a $500,000 expense related to an information security incident. How should she categorize this? A. Low impact B. Medium impact C. High impact D. Angela cannot assess the impact with the data given.

D. Angela cannot assess the impact with the data given.

During a forensic investigation, Kwame records information about each drive, including where it was acquired, who made the forensic copy, the MD5 hash of the drive, and other details. What term describes the process Kwame is using as he labels evidence with details of who acquired and validated it? A. Direct evidence B. Circumstantial evidence C. Incident logging D. Chain of custody

D. Chain of custody

After Janet's attempts to conceal her downloads of important corporate information were discovered, forensic investigators learned that she frequently copied work files to a USB drive. Which of the following is not a possible way to manually check her Windows workstation for a list of previously connected USB drives? A. Check the security audit logs. B. Check the setupapi log file. C. Search the registry. D. Check the user's profile.

D. Check the user's profile.

Alexandra is attempting to determine why a Windows system keeps filling its disk. If she wants to see a graphical view of the contents of the disk that allows her to drill down on each cluster, what Sysinternals tool should she use? A. du B. df C. GraphDisk D. DiskView

D. DiskView

Janet is attempting to conceal her actions on a company-owned computer. As part of her cleanup attempts, she deletes all the files she downloaded from a corporate file server using a browser in incognito mode. How can a forensic investigator determine what files she downloaded? A. Network flows B. SMB logs C. Browser cache D. Drive analysis

D. Drive analysis

Ryan believes that systems on his network have been compromised by an advanced persistent threat actor. He has observed a number of large file transfers outbound to remote sites via TLS-protected HTTP sessions from systems that do not typically send data to those locations. Which of the following techniques is most likely to detect the APT infections? A. Network traffic analysis B. Network forensics C. Endpoint behavior analysis D. Endpoint forensics

D. Endpoint forensics

Frank wants to log the creation of user accounts on a Windows workstation. What tool should he use to enable this logging? A. secpol.msc B. auditpol.msc C. regedit D. Frank does not need to make a change; this is a default setting.

D. Frank does not need to make a change; this is a default setting.

Saanvi needs to verify that his Linux system is sending system logs to his SIEM. What method can he use to verify that the events he is generating are being sent and received properly? A. Monitor traffic by running Wireshark or tcpdump on the system. B. Configure a unique event ID and send it. C. Monitor traffic by running Wireshark or tcpdump on the SIEM device. D. Generate a known event ID and monitor for it.

D. Generate a known event ID and monitor for it.

What strategy does NIST suggest for identifying attackers during an incident response process? A. Use geographic IP tracking to identify the attacker's location. B. Contact upstream ISPs for assistance in tracking down the attacker. C. Contact local law enforcement so that they can use law enforcement-specific tools. D. Identifying attackers is not an important part of the incident response process.

D. Identifying attackers is not an important part of the incident response process.

The hospital that Tony works at is required to be HIPAA compliant and needs to protect HIPAA data. Which of the following is not an example of PHI? A. Names of individuals B. Records of health care provided C. Records of payment for healthcare D. Individual educational records

D. Individual educational records

Patents, copyrights, trademarks, and trade secrets are all related to what type of high value asset? A. PII B. PHI C. Corporate confidential D. Intellectual property

D. Intellectual property

After law enforcement was called because of potential criminal activity discovered as part of a forensic investigation, the officers on the scene seized three servers. When can Joe expect his servers to be returned? A. After 30 days, which provides enough time for a reasonable imaging process B. After 6 months, as required by law C. After 1 year, as most cases resolve in that amount of time D. Joe should not plan on a timeframe for return.

D. Joe should not plan on a timeframe for return.

NIST SP 800-61 identifies six outside parties that an incident response team will typically communicate with. Which of the following is not one of those parties? A. Customers, constituents, and media B. Internet service providers C. Law enforcement agencies D. Legal counsel

D. Legal counsel

Fred wants to identify digital evidence that can place an individual in a specific place at a specific time. Which of the following types of digital forensic data is not commonly used to attempt to document physical location at specific times? A. Cell phone GPS logs B. Photograph metadata C. Cell phone tower logs D. Microsoft Office document metadata

D. Microsoft Office document metadata

Which of the following commands is the standard way to determine how old a user account is on a Linux system if [username] is replaced by the user ID that you are checking? A. userstat [username] B. ls -ld /home/[username] C. aureport -auth | grep [username] D. None of the above

D. None of the above

As John proceeds with a forensic investigation involving numerous images, he finds a directory labeled Downloaded from Facebook. The images appear relevant to his investigation, so he processes them for metadata using exiftool. The following image shows the data provided. What forensically useful information can John gather from this output? A. The original file creation date and time B. The device used to capture the image C. The original digest (hash) of the file, allowing comparison to the original D. None; Facebook strips almost all useful metadata from images.

D. None; Facebook strips almost all useful metadata from images.

Charles wants to perform memory forensics on a Windows system and wants to access pagefile.sys. When he attempts to copy it, he receives the following error. What access method is required to access the page file? A. Run Windows Explorer as an administrator and repeat the copy. B. Open the file using fmem. C. Run cmd.exe as an administrator and repeat the copy. D. Shut the system down, remove the drive, and copy it from another system.

D. Shut the system down, remove the drive, and copy it from another system.

Which one of the following incident response test types provides an interactive exercise for the entire team but does not run the risk of disrupting normal business activity? A. Full interruption test B. Checklist review C. Management review D. Tabletop exercise

D. Tabletop exercise

Lukas believes that one of his users has attempted to use built-in Windows commands to probe servers on the network he is responsible for. How can he recover the command history for that user if the system has been rebooted since the reconnaissance has occurred? A. Check the Bash history. B. Open a command prompt window and press F7. C. Manually open the command history from the user's profile directory. D. The Windows command prompt does not store command history.

D. The Windows command prompt does not store command history.

Wang is performing a forensic analysis of a Windows 10 system and wants to provide an overview of usage of the system using information contained in the Windows registry. Which of the following is not a data element she can pull from the SAM? A. Password expiration setting B. User account type C. Number of logins D. The first time the account logged in

D. The first time the account logged in

Deepa is diagnosing major network issues at a large organization and sees the following graph in her PRTG console on the "outside" interface of her border router. What can Deepa presume has occurred? A. The network link has failed. B. A DDoS is in progress. C. An internal system is transferring a large volume of data. D. The network link has been restored.

D. The network link has been restored.

Angela wants to access the decryption key for a BitLocker-encrypted system, but the system is currently turned off. Which of the following methods is a viable method if a Windows system is turned off? A. Hibernation file analysis B. Memory analysis C. Boot-sector analysis D. Brute-force cracking

A. Hibernation file analysis

While performing process analysis on a compromised Linux system, Kai discovers a process called "john" that is running. What should she identify as the most likely use of the program? A. Password cracking B. Privilege escalation C. A rootkit D. A user named John's personal application

A. Password cracking

Alex suspects that an attacker has modified a Linux executable using static libraries. Which of the following Linux commands is best suited to determining whether this has occurred? A. file B. stat C. strings D. grep

A. file

Degaussing is an example of what form of media sanitization? A. Clearing B. Purging C. Destruction D. It is not a form of media sanitization.

B. Purging

Saanvi wants to prevent buffer overflows from succeeding against his organization's web applications. What technique is best suited to preventing this type of attack from succeeding? A. User input canonicalization B. User input size checking C. Format string validation D. Buffer overwriting

B. User input size checking

What step follows sanitization of media according to NIST guidelines for secure media handling? A. Reuse B. Validation C. Destruction D. Documentation

B. Validation

Faruk wants to use netstat to get the process name, the PID, and the username associated with abnormally behaving processes that are running on a Linux system he is investigating. What netstat flags will provide him with this information? A. -na B. -pt C. -pe D. -sa

C. -pe

Joe is responding to a ransomware incident that has encrypted financial and business data throughout the organization, including current payroll and HR data. As events currently stand, payroll cannot be run for the current pay period. If Joe uses the NIST functional impact categories shown here, how should Joe rate this incident? A. Critical B. Medium C. High D. Extended recovery

C. High

Brian's network suddenly stops working at 8:40 a.m., interrupting videoconferences, streaming, and other services throughout his organization, and then resumes functioning. When Brian logs into his PRTG console and checks his router's traffic via the primary connection's redundant network link, he sees the following graph. What should Brian presume occurred based on this information? A. The network failed and is running in cached mode. B. There was a link card failure, and the card recovered. C. His primary link went down, and he should check his secondary link for traffic. D. PRTG stopped receiving flow information and needs to be restarted.

C. His primary link went down, and he should check his secondary link for traffic.

Angela wants to use her network security device to detect potential beaconing behavior. Which of the following options is best suited to detecting beaconing using her network security device? A. Antivirus definitions B. File reputation C. IP reputation D. Static file analysis

C. IP reputation

As Lauren prepares her organization's security practices and policies, she wants to address as many threat vectors as she can using an awareness program. Which of the following threats can be most effectively dealt with via awareness? A. Attrition B. Impersonation C. Improper usage D. Web

C. Improper usage

Scott wants to recover user passwords for systems as part of a forensic analysis effort. If he wants to test for the broadest range of passwords, which of the following modes should he run John the Ripper in? A. Single crack mode B. Wordlist mode C. Incremental mode D. External mode

C. Incremental mode

Max wants to improve the effectiveness of the incident analysis process he is responsible for as the leader of his organization's CSIRT. Which of the following is not a commonly recommended best practice based on NIST's guidelines? A. Profile networks and systems to measure the characteristics of expected activity. B. Perform event correlation to combine information from multiple sources. C. Maintain backups of every system and device. D. Capture network traffic as soon as an incident is suspected.

C. Maintain backups of every system and device.

Jeff discovers multiple JPEG photos during his forensic investigation of a computer involved in an incident. When he runs exiftool to gather file metadata, which information is not likely to be part of the images even if they have complete metadata intact? A. GPS location B. Camera type C. Number of copies made D. Correct date/timestamp

C. Number of copies made

Refer to the image shown here to answer the question. During the preservation phase of her work, Carol discovers that information requested as part of the discovery request has been deleted as part of a regularly scheduled data cleanup as required by her organization's policies. What should Carol do? A. Conduct a forensic recovery of the data. B. Create synthetic data to replace the missing data. C. Report the issue to counsel. D. Purge any other data related to the request based on the same policy.

C. Report the issue to counsel.

Carlos needs to create a forensic copy of a BitLocker-encrypted drive. Which of the following is not a method that he could use to acquire the BitLocker key? A. Analyzing the hibernation file B. Analyzing a memory dump file C. Retrieving the key from the MBR D. Performing a FireWire attack on mounted drives

C. Retrieving the key from the MBR

Kathleen's forensic analysis of a laptop that is believed to have been used to access sensitive corporate data shows that the suspect tried to overwrite the data they downloaded as part of antiforensic activities by deleting the original files and then copying other files to the drive. Where is Kathleen most likely to find evidence of the original files? A. The MBR B. Unallocated space C. Slack space D. The FAT

C. Slack space

What is space between the last sector containing logical data and the end of the cluster called? A. Unallocated space B. Ephemeral space C. Slack space D. Unformatted space

C. Slack space

The company that Charlene works for has been preparing for a merger, and during a quiet phase she discovers that the corporate secure file server that contained the details of the merger has been compromised. As she works on her incident summary report, how should she most accurately categorize the data that was breached? A. PII B. PHI C. PCI D. Corporate confidential data

D. Corporate confidential data

In his role as a small company's information security manager, Mike has a limited budget for hiring permanent staff. Although his team can handle simple virus infections, he does not currently have a way to handle significant information security incidents. Which of the following options should Mike investigate to ensure that his company is prepared for security incidents? A. Outsource to a third-party SOC B. Create an internal SOC C. Hire an internal incident response team D. Outsource to an incident response provider

D. Outsource to an incident response provider

Latisha is the IT manager for a small company and occasionally serves as the organization's information security officer. Which of the following roles should she include as the leader of her organization's CSIRT? A. Her lead IT support staff technician B. Her organization's legal counsel C. A third-party IR team lead D. She should select herself.

D. She should select herself.

Which of the following commands is not useful for determining the list of network interfaces on a Linux system? A. ifconfig B. netstat -i C. ip link show D. intf -q

D. intf -q