DFIR Exam

Which of the following should be monitored during dynamic malware analysis? (Choose all correct answers.)

File system changes,Network activity,Registry changes

Which of the following is not a tool that is used for data carving?

DumpIt

Which of the following is the most common file system used in Linux distributions?

Ext4

Which of the following is not CPU architecture?

Pi

Which of the following is not a feature of Wireshark?

Replace network traffic

Which of the following is not included in the digital forensics process?

Penetration Testing

What is the correct incident response lifecycle per the NIST incident response methodology?

Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity

Which of the following are commonly used for malware persistence?(Choose all correct answers.)

Scheduled tasks Correct! Registry keys Correct! Services

What is the responsibility of a CISO?

To create a strategy for data and IT asset protection and maintain it

What is a sandbox used for?

To test malware in an isolated environment

What is the difference between Wireshark and tcpdump?

tcpdump is command-based; Wireshark has a GUI interface.

Which of the following tools can be used to find persistent malware?

Autoruns

Which of the following tools can be used to research RAM dumps?

Volatility

Which of the following statements is true?

When data is erased from the operating system, it remains on the HDD until it is overwritten.

How is a file hidden using steganography?

By hiding a file within another file

Which of the following tools can be used for drive cloning? (Choose all correct answers.)

dd Correct! FTK Imager

Which of the following tools can be used to obfuscate malware code?

UPX Tools that can be used to obfuscate malware code are PEID and UPX. Both tools are used to pack executable files, making them harder to detect by antivirus software. PEID, also known as PEiD, is a program that can analyze portable executable (PE) files and detect if they are packed with a particular type of packer.

Which of the following is not a containment strategy for a cybersecurity incident?

Updating IDS rules Updating IDS rules is not a containment strategy for a cybersecurity incident. Read:Containment strategies for a cybersecurity incident

Which of the following is a Windows Event Viewer classification?(Choose all correct answers.)

Debug Correct! Alert Correct! Error

Which tool should an investigator use to dynamically investigate malware?

Debugger