DFIR Final Exam Review

Hiding a file within a file is called?

You can replace network traffic with Wireshark.

The tool Volatility does what?

Blocklist filtering, Host isolation, and Segmentation of networks is a containment strategy for ___?

Files system changes, Network activity, and Registry changes should be monitored during dynamic malware analysis?

Registry keys, Services, and Scheduled tasks are commonly used for?

The tools dd and FTK Imager do what?

When data is erased from the operating system, it remains on the HDD until it is overwritten.

ARM, MIPS, and NASM are classified as?

The file system Ext4 is used with what OS?

What does the tool UPX do?

The tool Debugger does which of the following?

What should you use to test malware in an isolated environment?

Wireshark is to ____ as tcpdump is to _____

Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity are the steps in?

Which of the following are tools used for data carving?

The responsibility of whom is to create a strategy for data and IT asset protection and maintain it?

Penetration testing is included in the digital forensics process?

Windows Event Viewer classification includes Alert, Error, Debug.

Autoruns is a tool to ____.