What are some Memory Analysis Use Cases/Attack Detections? (Choose all correct)

Encrypted Systems, Fileless Malware

Which of the following can be dumped from a memory image w/a Volatility plugin? (Choose all correct)

Process Dump, DLL Dump, File Dump

Which of the following are common elements of the Digital Forensics Process? (Choose all correct)

Examination, Analysis, Collection

What are the 2 main ways to investigate a captured image?

Live examination thru a virtual machine, Static Analysis thru software

The most important responsibility in incident response is?

Create an Incident Response Policy

What are some characteristics between Windows and Linux systems wrt Forensic Analysis? (Choose all correct)

Linux stores most system functions as files, Most Windows Data is binary, Most Linux Data is plain text

To analyze an incident properly, incidents can be prioritized according to the following method? (choose all correct)

Recovery Difficulty, Information Sensitivity, Function

Which of the following are examples of DFIR Environments? (Choose all correct)

Flare VM, CAINE Live, SIFT Workstation

The main goal of the SOC is to…

Monitor network & identify suspicious behavior based on collected data

Which of the following are Acquisition best practices? (Choose all correct)

Memory captures better if the user is logged on, Document the capture properly, Use sterilized media for acquisition, Capture to an external source

Which of the following system processes should only occur once (choose all correct)

Lsass.exe, Services.exe, Wininit.exe

Which of the following are places where Windows could store memory files? (Choose all correct)

Pagefile, MEMORY.DMP, Hyberfil.sys

What is a ‘magic number’?

File signatures used to identify file formats in data streams

studbud

DFIR-07 Final Exam 1/2

100 termsStudBud Administration37 plays

Imported from external platform

Flashcards100 cardsFPractice quizPHost liveL

Questions 100

Answers

1
Which of the following are Linux File systems (choose all correct)
XFS
BTRFS
NTFS
EXT4
2
What are some Memory Analysis Use Cases/Attack Detections? (Choose all correct)
DDoS
Encrypted Systems
On Path
Fileless Malware
3
Which of the following can be dumped from a memory image w/a Volatility plugin? (Choose all correct)
Process Dump
DLL Dump
File Dump
PrivateKey Dump
4
When investigating processes, which plugin is useful when searching for hidden processes?
Psscan
Psxview
Pstree
Pslist
5
Which of the following are common elements of the Digital Forensics Process? (Choose all correct)
Examination
Analysis
Pentesting
Collection
6
What Volatility plugin can list all DLLs loaded for a process in the system?
dlldump
procdll
piddll
dlllist
7
When a USB drive is connected, all files copied to/from the USB Drive are recorded in the logs
False
True
8
What are the 2 main ways to investigate a captured image?
Office Analysis
Onsite Analysis
Live examination thru a virtual machine
Static Analysis thru software
9
Besides MRU, what are TWO other methods to determine recently run programs?
ProgramHistory
Jump Lists
Tab Complete
AppCompatCache
10
Which of the following is NOT part of the CIA triad?
Availability
Integrity
Confidentiality
Accountability
11
Which command must be run to enable an image to be mounted on a Linux system?
osfmount
losetup
imgload
imgmount
12
Which command can be used to perform image/file acquisition over the network combined with Netcat?
img
cp
dd
mv
13
The most important responsibility in incident response is?
Containment
Create an Incident Response Policy
Detection and Analysis
Recovery
14
Where is the Most Recently Used (MRU) information stored in Windows?
Memory
c:\windows\logs
c:\windows\MRU
Registry
15
DLLs that are loaded from c:\windows directory could be a strong indication of malicious DLLs
True
False
16
Which FILE SYSTEM allows permissions to be set on individual files?
FAT32
NTFS
exFAT
FAT
17
Which tool can be used for memory dumps?
Bulk extractor
Photorec
Volatility
Exif tool
18
Which of the following is used to provide prioritization and initial response to security alerts?
SIEM
SOAR
IPS
IDS
19
When artifacts are captured from a digital system that is powered on, it’s called what type of analysis?
Active analysis
Online analysis
Live analysis
Immediate analysis
20
OSFMount is used to?
Mount external devices to setup for external booting
Mount external device for booting
Mount images in read-only mode
Analysis of Memory Dumps
21
What are some characteristics between Windows and Linux systems wrt Forensic Analysis? (Choose all correct)
Linux stores most system functions as files
Both Windows and Linux file names are case sensitive
Most Windows Data is binary
Most Linux Data is plain text
22
When a browser is in PRIVATE MODE only the cache is saved?
True
False
23
What deals with making sure that someone cannot deny the validity of something?
Confidentiality
Availability
Non-repudiation
Integrity
24
To analyze an incident properly, incidents can be prioritized according to the following method? (choose all correct)
Recovery Difficulty
Scope of Effect
Information Sensitivity
Function
25
Which of the following are examples of DFIR Environments? (Choose all correct)
Flare VM
CAINE Live
SIFT Workstation
Kali desktop
26
What is the equivalent in Linux of the Windows pagefile?
Page Partition
vmem File
Swap Partition
Memory.swap
27
Which plugin does Volatility use to determine a memory image’s profile?
imageinfo
memprofile
meminfo
profile
28
Which of the following is NOT a data carving tool?
Photorec
Rekall
HxD
Bulk extractor
29
Which of the following is NOT a Virtual Drive format?
VHD
VBS
VHDX
VMDK
30
Which tool can be used for capturing memory dumps?
FTK Imager
Photorec
Bulk extractor
Exif tool
31
The main goal of the SOC is to…
Take actions against threat and prevent progress and damage
Resolve user problems in an organized/accurate way ensure user satisfaction
Monitor one or more networks for conditions that degrade network services
Monitor network & identify suspicious behavior based on collected data
32
PowerForensics can analyze all of the following EXCEPT
File Systems
Boot Sectors & Partitions
Live Memory Contents
Registry
33
Autopsy is based on creating separate “cases” that can include multiple image captures and examination artifacts
True
False
34
What network utility can be used to establish network connections thru TCP/UDP to write and read from?
Netstat
Netcat
Nbstat
Netcon
35
Which of the following are Acquisition best practices? (Choose all correct)
Memory captures better if the user is logged on
Document the capture properly
Use sterilized media for acquisition
Capture to an external source
36
Which of the following are Memory Acquisition Tools (choose all correct)
dd
FTK
FastDump
Clonezilla
37
Which of the following system processes should only occur once (choose all correct)
Lsass.exe
Explorer.exe
Services.exe
Wininit.exe
38
Which tool can be AUTOMATICALLY parse an MFT?
PowerForensics
Autopsy
dir /r
SIFT
39
What part of the CIA Triad deals with making sure data is not properly changed?
Integrity
Confidentiality
Non-repudiation
Availability
40
Includes files, images, scripts, other media-related data referred to for faster searches and page loading in a browser
History
Cache
Temp Files
Prefetch
41
The desired result of an eradication plan is the complete removal of the threat from the initial compromised host(s)
True
False
42
Chain of Custody concerns in DFIR only apply to government agency incidents?
False
True
43
Which command can be used to view file system types and information on a Linux system?
vdt -t
df -T
fs -T
vwfs -T
44
Which of the following are Memory Acquisition Tools? (Choose all correct)
Clonezilla
FTK-Imager
Dumpit
dd
45
Which of the following are places where Windows could store memory files? (Choose all correct)
Pagefile
Registry
MEMORY.DMP
Hyberfil.sys
46
Which of the following is NOT a tool to collect artifacts from primary and secondary storage?
FTK imager
Dumpit
Volatility
Dd
47
Which Partition Table format supports up to 128 partitions
UEFI
BIOS
MBR
GPT
48
What is a ‘magic number’?
File version data to aid in identifying compatible applications
A File’s Metadata stored in the MFT
File sizes used to aid in identifying the end of a file for data carving
File signatures used to identify file formats in data streams
49
Which command is best to acquire Linux process information because it is based on the files used by processes?
ps
Isof
50
Which of the following is conducted continuously?
Incident response
Digital forensics
Threat hunting
Pentesting
51
Inodes in Linux are similar to what in Windows File System?
MBR
MFT
GPT
Blocks
52
What does ‘Capture from Live Media’ mean?
Computer is on and logged in
Capture a disk thru the computers installed OS
Capture information from a compromised external device
Boot from external device
53
What is the proper format to reference a file’s ADS?
<filename>-<streamname>
<filename> -s <streamname>
<filename> -S <streamanme>
<filename>:<streamname>
54
Which of the following is NOT a containment strategy during incident Response
Segmentation
Black Hole Shunt
Host Isolation
Update/Patch the affected hosts
55
Which of the following are memory analysis frameworks? (Choose all correct)
SIFT
Rekall
Volatility
CAINE
56
Which of the following are NTFS File System Characteristics?
Alternate Data Stream
File/Folder permissions
Journaling
Indexing
57
Static binaries are executables that run using the operating system libraries
True
False
58
What utility displays routing tables, open/established sockets, incoming/outgoing TCP connections, and interfaces?
Netstat
Nbstat
Netcon
Netcat
59
What is critical to do/have to enable Threat Hunting
Baseline
Firmware version report
Application Catalog
Network Diagram
60
What is the most important asset of a business?
Products
Intellectual property
Employees
Finances
61
What is ‘methodology’ with respect to a SOC/IR?
Provides the recommended solutions for specific cyber incidents
Detailed step by step instructions on how to handle cyber incidents
A framework providing guidance for cyber incident handling
Provides step by step instructions on how to handle to cyber incidents
62
When an Incident occurs it is critical not to respond until all pertinent information is collected
True
False
63
What do we use to ensure artifacts have not been modified?
File properties
File size
Drive metadata
Hashing
64
What does RACI stand for?
Results, Accounts, Communication, Interested
Responsible, Accountable, Consulted, Informed
Responsible, Actionable, Coordinated, Integrated
Ready, Astute, Clever, Interested
65
A File System records all metadata changes made on the volume to protect the system in the event of a crash is called?
FileTracking
Crashdump
VolumeProtect
Journaling
66
What is ‘Live’ USB Analysis?
USB used to boot computer independent of computer operating system
USB used to copy memory before shutting down host
USB used to copy OpSys of host before it is shutdown
USB used to copy files before shutting down host
67
PowerForensics supports both live and dead system forensics
True
False
68
A highly experienced staff member with enough IT/cybersecurity experience and knowledge to conduct DFIR activities
SOC analyst
Tier 3 analyst
Tier 2 analyst
CISO
69
According to ‘Order of Volatility’, which of the following artifacts should be LAST to collect in the choices
RAM
Disks
Temp Files
Remote Logs/Monitoring Data
70
Which of the following are forensic image formats? (Choose all correct)
AFF
VDI
VMDK
EWF
71
A government agency that provides an incident response methodology to government and business?
CIA
NSA
NIST
SANS
72
If a physical machine is rebooted, memory information is stored in a .vmem file that can be recovered
True
False
73
Which command shows the contents of a Windows computer’s DNS Cache?
ipconfig /displaydns
ipconfig /showdns
ipconfig /showcache
ipconfig /displaycache
74
Which of the following artifacts can NOT be collected during dead analysis of a physical computer?
System settings
Memory
Media files
Log files
75
Which of the following are IRRECOVERABLE artifacts not written to disk/reviewable after shutdown? (Choose all correct)
PowerShell history
DNS Cache
Browser history
Logs
76
Which Volatility plugin can be used to find memory sections marked as executable but not backed up with a file on disk?
OrphanExec
Malfind
Malinject
NonExec
77
Image captures are always stored as a single file to make copying easier?
False
True
78
In Windows what is prefetcher?
Performance Optimization tool that loads security protocols
Performance Optimization tool that loads previously used office documents
Performance Optimization mechanism to speed up application loading time
Performance Optimization tool that loads network protocols
79
FTK-Imager is primarily a cloning tool, while Clonezilla focuses entirely on forensics
True
False
80
VMWare Virtual Machines store the VM Memory for snapshots and hibernation as files on the host disk
False
True
81
What is an example of intangible asset?
Cash
Furniture
Building
Patent
82
Which of the following is NOT a type of DR backup site?
Hot site
Glacier site
Warm site
Cold site
83
Where are Windows prefetch files located?
c:\windows\prefetch
c:\windows\system32\prefetch
c:\prefetch
c:\system\prefetch
84
A tool that can be used to identify possible startup locations?
HxD
Rekall
Autoruns
Dumpit
85
Which of the following is NOT a drive capture/clone tool?
Clonezilla
FTK Imager
SIFT
dd
86
What application can be used to extract URLs from memory?
URLHistory
Strings
URLExtract
BrowserHistory
87
What is PowerForensics?
Linux installable environment for forensics operations
Virtual Machine package for forensics operations
PowerShell Module designed for forensic operations
Python based forensics operations framework
88
What tools can be used to identify hidden exe files in other files? (Choose all correct)
Binwalk
dir /r
HxD
Look for MZ (4D 5A) Header
89
Which Partition Table format is limited to max 2 TB partitions?
MBR
GPT
UEFI
BIOS
90
Which command lists only the inodes of removed files?
fsstat
ils
91
What is the name of the activity that Security Teams perform to search for malicious items that pass security solutions?
Threat hunting
Digital forensics
Incident response
Security auditing
92
Where can you see a file’s Alternate Data Streams? (choose all correct)
dir /r
My Computer
MFT
File Explorer
93
Which of the following is closed/proprietary format for memory acquisition?
RAW
E01
AFF4
EWF
94
What commands/tools can be used to access Linux Memory for forensics (choose all correct)
Fmem
FTK
Swap Digger
LIME
95
The MFT contains the following information (choose all correct)
File Size
File Attributes
File Timetamps
File Permissions
96
Other departments that can be involved in cybersecurity activity in a company include? (chose all correct)
Public affairs
BCP/DR
IT support
HR
97
Which of the following are Volatility plugins used to scan the network? (Choose all correct)
NetInfo
Sockets
NetScan
ConnScan
98
Threat Intelligence Gathering includes? (Choose all correct)
TTP
Indicators
Host update reports
Tool configurations
99
Additionally Volatility plugins to gather supportive system information during an investigation (choose all correct)
Consoles
envars
DumpRegistry
Cmdscan
100
Which of the following are part of Incident Response? (Choose all correct)
Preparation
OS Updates
Containment
Detection

DFIR-07 Final Exam 1/2 Flashcards | StudBud