DFIR Overview

What is the method of loading more than one data sector into a single file called? A. Alternate Data Stream (ADS) B. Deleting a file C. Encrypting a file D. None of the Above

A. Alternate Data Stream (ADS)

David wants to test company software and analyze its behavior in real time. Which of the following methods should he use? A. Dynamic analysis B. Static analysis C. Sandbox analysis D. MTTR

A. Dynamic analysis

Which of the following is software that can both clone a disk and dump memory? A. FTK Imager B. NMAP C. EWF D. DD

A. FTK Imager

What is the Linux equivalent of the MFT? A. Inode B. MBR C. NTFS D. Ext4

A. Inode

Which is a stable tool used for doing a memory dump in Linux? A. LiME B. LeMONaide C. Redact D. Netstat

A. LiME

What do Pslist and Pstree help show in memory forensics? A. Lists out processes and their parent child relationships B. Lists out IPs and Domains C. List out DLLs and associated processes D. None of the Above

A. Lists out processes and their parent child relationships

Which of the following services provides proof of the origin and integrity of data? A. Non-repudiation B. Accountability C. SOC D. Logs and event anomalies

A. Non-repudiation

Which of the following is a debugger that can be used to analyze malware while it's running?A. OllyDbg B. NMAP C. HxD D. None of the above

A. OllyDbg

Bob, a security analyst, received notifications from a program called code.exe and wants to examine its process. Which of the following can help him examine the process? A. Process Dump B. DLL Dump C. Memory Dump D. All of the above

A. Process Dump

What is a useful piece of process information that is volatile? A. Remote Connections B. Registry Settings C. Security Event Logs D. All of the Above

A. Remote Connections

Which of the following is used for minimal footprint in a system? A. Static binaries B. Netcat C. Netstat D. Lsof

A. Static binaries

Why is it important to use logs? A. They store records of potentially important events. B. They record web-related attacks. C. They store records of well-known attacks. D. None of the above.

A. They store records of potentially important events.

Which of the following is a common use for proxies? A. Traffic Inspection B. VPN capabilities C. Application Scanning D. All of the above

A. Traffic Inspection

Which of the following programming languages issues machine code instructions and is difficult to learn? A. C B. Assembly C. Pascal D. Fortran

B. Assembly

What part of the CIA Triad deals with making sure users can access data and services? A. Confidentiality B. Availability C. Integrity D. Accountability

B. Availability

What is the main purpose of Live Forensics? A. Getting things done fast is the most important when dealing with forensics B. Capturing volatile data that will be lost once the system is powered down C. You can use the system in question to do your analysis D. Playing with fire is fun

B. Capturing volatile data that will be lost once the system is powered down

John was tasked to investigate a network attack in accordance with the network forensics investigation flow process. What should be John's first step? A. Filter by IOCs and gathered data B. Check for malware signatures C. Analyze the protocol data D. Identify traffic abnormalities

B. Check for malware signatures

Which of the following is a tool used for Drive Cloning? A. FastDump B. DD C. HxD D. Volatility

B. DD

Tom wants to check sites that were accessed by employees to make sure they are not entering prohibited sites. Which of the following should he check to do that? (This doesn't make sense) A. Site cache B. DNS cache C. Server cache D. None of the above.

B. DNS cache

What is an organization's most valuable asset? A. Money in the bank B. Employees C. Buildings D. Corporate Secrets

B. Employees

Why is it important to use an IR plan? A. It is necessary for when the SOC crashes due to a ransomware attack. B. Having an IR plan can help focus on performing the necessary tasks. C. An IR plan is used once, when the IR team still isn't ready to operate. D. None of the above.

B. Having an IR plan can help focus on performing the necessary tasks.

Volatile memory is saved to disk when you do this? A. Lock Screen B. Hibernation C. Alt+F4 D. Shutdown

B. Hibernation

What is the PowerShell command for installing PowerForensics? A. import-Module PowerForensics B. Install-Module -Name PowerForensics C. Install-Module PowerForensics D. Get-PowerForensics

B. Install-Module -Name PowerForensics

Which is a command that can be used to acquire process information on Linux? A. Ls B. Lsof C. Netstat D. Cat

B. Lsof

Which of the following was one of the institutions that created the modern-day approach to Incident Response A. CIA B. NIST C. CompTIA D. (ISC)2

B. NIST

Which of the following serves as a source for network traffic data sources? A. Threat Intel B. Network Logs C. ProcMon D. All of the above

B. Network Logs

What is the correct process used by APT groups? A. Priv Esc > External and Internal Takeover > Hiding and Info Theft B. OSINT > External Takeover > Priv Esc> Lateral Move and Int TO > Hiding/IT C. OSINT > Internal Takeover > Lateral Movement > Information Theft D. None of the above.

B. OSINT > External Takeover > Priv Esc> Lateral Move and Int TO > Hiding/IT

What is an example of an intangible asset? A. Vehicles B. Patents C. Software D. Hardware

B. Patents

Which of the following contains RAW data, has no format, only bytes, and requires tools for capture? A. Primary memory B. Physical memory C. Virtual memory D. Secondary memory

B. Physical memory

Which is a PowerShell forensics framework? A. DD B. PowerForensics C. FTK Imager D. Volatility

B. PowerForensics

Which of the following is part of the APT attack flow? A. Threat Intelligence B. Privilege Escalation C. Encrypt organizational data D. None of the above

B. Privilege Escalation

Which of the following tools allows for the repeating of previously captured traffic? A. UDPReplay B. TCPReplay C. TCPRepeater D. None of the above

B. TCPReplay

What is the difference between threat hunting (TH) and threat intelligence (TI) A. TH works with tools, TI does not work with tools. B. TI is a process within TH and involves learning from other sources. C. Threat Hunting is a red team job, Threat Intelligence is a blue team job. D. Threat Hunting and Threat Intelligence are the same.

B. TI is a process within TH and involves learning from other sources.

Which of the following is an anti-forensic technique? A. Strings B. Tunneling C. MIPS D. All of the above

B. Tunneling

Which of the following is a live Linux distribution dedicated to cloning drives? A. CAINE B. FTK Imager C. Clonezilla D. Autopsy

C. Clonezilla

What is the newest type of Boot Record called? A. MBR B. SDN C. GPT D. MFT

C. GPT

Which of the following is a common identification method that can verify the identity of specific files? A. Firewall B. Binary pattern C. Hashing D. Data sanitization

C. Hashing

What part of the CIA Triad deals with making sure data is not improperly changed? A. Confidentiality B. Availability C. Integrity D. Non-Repudiation

C. Integrity

Which IS NOT an investigation step for Memory Analysis? A. Investigating rogue processes B. Check DLLs used by various executables C. Make sure logs are sent to your SIEM D. Check network activity and artifacts

C. Make sure logs are sent to your SIEM

Which is a tool that can be used to do data acquisition over a network? A. Nmap B. DD C. Netcat D. FTK Imager

C. Netcat

Which of the following is a description of an IDS? A. Network device that proactively protects traffic B. Network decrypting device C. Network device that inspects traffic D. None of the above

C. Network device that inspects traffic

Which of the following is a Memory Dump format? A. ISO B. PDF C. RAW D. TXT

C. RAW

After you enter a website, a pop-up appears saying your computer files were infected and offering to fix the problem for a small fee. Which of the following attacks did you encounter? A. Worm B. Evil Twin C. Scareware D. MITM

C. Scareware

When looking at Inodes, what command shows only deleted nodes? A. ffstat B. losetup C. ils D. df -T

C. ils

What is something you want to search for in Memory Forensics? A. Parental Structures B. Hidden Processes C. Suspicious Details D. All of the Above

D. All of the Above

What will display recent user activity? A. Most Recently Used (MRU) B. Jump List C. RunMRU D. All of the Above

D. All of the Above

Which network artifact is available during memory analysis? A. Open Sockets B. IP Address C. Created Time D. All of the Above

D. All of the Above

Which of the following is a Recoverable Artifact? A. Registry Entries B. Browser History C. Master File Table D. All of the Above

D. All of the Above

Browser cache artifacts include: A. Cookies B. Browsed URLS C. User Accounts D. All of the above

D. All of the above

What are potential analysis targets for PowerForensics? A. Windows Artifacts B. Windows Registry C. Application Cache D. All of the above

D. All of the above

Which of the following Linux component(s) has/have file representation? A. Running processes B. Configurations C. Settings D. All of the above

D. All of the above

Which of the following is a network connection analysis plug-in for Volatility? A. Netscan B. Connscan C. Sockets D. All of the above

D. All of the above

Which of the following is a step in the Network Forensic investigation flow? A. Identify traffic abnormalities B. Analyze the protocol data C. Filter by IOCs and gathered data D. All of the above

D. All of the above

Which of the following is a type of hacker? A. Cybercriminals pursuing financial gains B. Hacktivists pursuing ideology C. State-sponsored attackers focused on collecting information D. All of the above

D. All of the above

Which of the following is a valid CPU Architecture? A. ARM B. AMD C. MIPS D. All of the above

D. All of the above

Which of the following is a valid capture format? A. RAW B. dd C. ISO D. All of the above

D. All of the above

Which of the following is an investigation step when performing Memory Analysis? A. Rootkits B. Network C. DLL & Handles D. All of the above

D. All of the above

Which of the following is a tool that can be used to detect persistent malware? A. IOC B. DD C. UPX D. Autoruns

D. Autoruns

Which of the following is a popular suite of Linux tool binaries? A. Nirsoft B. Sysinternals C. Swap Digger D. Busybox

D. Busybox

Which of the following is a memory dumping tool? A. VMDK B. DD C. GREP D. FTK Imager

D. FTK Imager

What is a forensic artifact? A. A SIEM solution B. Dinosaur bones and ancient relics C. RAM D. Files to which data is written to and can be later recovered

D. Files to which data is written to and can be later recovered

What is another name for file headers that help us identify a file type? A. File Carving B. LSASS C. ADS D. Magic Numbers

D. Magic Numbers

Which of the following systems contains metadata for each stored file? A. FAT32 B. FAT C. exFAT D. NTFS

D. NTFS

John opened an executable file and noticed unusual activity, such as files that opened on their own. For further investigation, he wanted to check if any new network connections were established. Which of the following tools can check network connections? A. Net framework B. Telnet C. FakeNet-ng D. Netstat

D. Netstat

What part of the CIA Triad deals with making sure that someone cannot deny the validity of something? A. Confidentiality B. Availability C. Integrity D. Non-Repudiation

D. Non-Repudiation

Which is not an Intel debugging term? A. INT3/0xCC B. Patching C. Breakpoint D. None of the above

D. None of the above

Browser Caches contain browsed URLs only True False

False

DNS Cache is erased when the browser history is erased. True False

False

It is NOT possible to find URLs during Memory Analysis. True False

False

It is not possible to do a drive capture over the network. True False

False

MBR is the Boot Record Type for Windows 10. True False

False

Memory.dmp files can be read natively by Volatility. True False

False

Most data in Linux is binary. True False

False

Pi is a CPU architecture. True False

False

PowerForensics only works on Live Systems. True False

False

Processes in Linux have a parent-child relationship. True False

False

The FAT32 file system allows for Alternative Data Streams (ADS). True False

False

There is no way to recover browser activity. True False

False

Volatility is a drive cloning software. True False

False

WinPrefetchView is a tool to read browser artifacts. True False

False

Zeek-Cut doesn't have the ability to parse through and filter a pcap file. True False

False

"vol.py -f Imageinfo" is the command for identifying profiles within a memory artifact when using Volatility. True False

True

Command line data can be found in memory analysis. True False

True

Debugging malware is a slow and tedious process. True False

True

Diaster Recovery Plan (DRP) is defined as outlining response strategies for unplanned events. True False

True

Errors can occur in PowerForensics when parsing drives larger than 2 TB. True False

True

Hashing can be used to verify the integrity of a drive copy. True False

True

It is possible to obtain a memory dump after a system has been shut down. True False

True

Linux does journaling on its file system. True False

True

NTFS can do file disk compression. True False

True

On NTFS file systems, deleted files are recoverable. True False

True

PowerShell history is a volatile memory artifact. True False

True

Prefetch was designed to speed-up the loading of commonly used applications. True False

True

RACI stands for Responsible, Accountable, Consulted & Informed. True false

True

Sometimes only partial image captures are possible. True False

True

Sterilized Media is recommended for data acquisition. True False

True

Swap Digger is a bash script for analyzing swap space. True False

True

There are ways to evade debugging tools. True False

True

UPX is a tool used that can be used to obfuscate malware code. True False

True

Volatility is the most popular Memory Forensics toolkit. True False

True