DFIR WorkShop

What does a spike in Windows Event ID 4625 indicate?

Which tool is used for forensic log analysis and threat hunting?

Which attack method allows adversaries to execute code without writing to disk?

What does the MITRE ATT&CK framework help security teams analyze?

What is the primary goal of the containment phase in Incident Response?

What is the purpose of anti-forensic techniques?

What is the primary use of deception technologies in cybersecurity?

What is the primary function of Wazuh in DFIR investigations?

Which tool is best for acquiring a forensic disk image?

Which strategy is most effective for securing Active Directory environments?

What is the main purpose of YARA rules in DFIR?

Which technique involves attackers abusing legitimate administrative

Which of the following is a sign of an Advanced Persistent Threat (APT)?

Which Windows feature provides a snapshot of system state for forensic analysis?

What is the key advantage of continuous monitoring in cybersecurity?

Which firewall strategy is best for minimizing attack surface?

What does an attacker achieve using steganography?

Which type of malware operates entirely in memory?

Which attack technique exploits legitimate Windows services for execution?

What is the most reliable way to verify if a file has been tampered with?

What is the best practice for securing remote desktop access?

Which cybersecurity concept refers to reducing the impact of a breach?

Which security principle involves segregating critical infrastructure?

Which Event ID should be monitored for suspicious PowerShell activity?

What is the best source of volatile evidence in a compromised system?

Which forensic principle ensures evidence integrity?

Which defensive measure can prevent credential stuffing attacks?

Which security model enforces the least privilege principle?

Which command identifies active network connections in Windows?

What is the first step in the NIST Incident Response Lifecycle?

What does Windows Event ID 4688 track?

What is the role of active threat intelligence in DFIR?

Which Windows log file is most useful for detecting privilege escalation?

What is the purpose of privileged access management (PAM) in cybersecurity?

Which hashing algorithm is commonly used for forensic integrity verification?

What is the primary purpose of a SIEM system?

Which registry key can help track USB device history?

Which log type is most useful for detecting lateral movement?

Which tool is best suited for memory forensics in an investigation?

Which technique involves modifying timestamps to mislead investigators?

Which security control is most effective in preventing ransomware attacks?

Which memory forensic tool helps detect malicious processes?

Which security mechanism ensures data integrity during transmission?

What is a honeypot used for in cybersecurity?

Which tool can be used to analyze network traffic during an investigation?

What is the primary benefit of an Endpoint Detection and Response (EDR) solution?

Which security technique helps detect insider threats in real-time?

What does the term "Zero Trust Architecture" mean in cybersecurity?