DFIR-1

Question 1

What is the responsibility of a CISO?

Accepted Answer

To create a strategy for data and IT asset protection and maintain it

Question 2

Which of the following are commonly used for malware persistence? (Select All)

Accepted Answer

Scheduled tasks, Registry keys, Services

Question 3

Select the True statement

Accepted Answer

When file is erased, it remains on the HDD until it is overwritten.

Question 4

Which is NOT part of the Forensic Process?

Accepted Answer

Penetration Testing

Question 5

Which of the following is not a feature of Wireshark?

Accepted Answer

Replace Network Traffic

Question 6

Which of the following tools can be used to obfuscate malware code?

Accepted Answer

UPX

Question 7

Which of the following is not a containment strategy for a cybersecurity incident?

Accepted Answer

Updating IDS Rules

Question 8

How is a file hidden using Steganography?

Accepted Answer

Hiding it inside another file

Question 9

What is the difference between Wireshark and tcpdump?

Accepted Answer

tcpdump is command-based; Wireshark has a GUI interface.

Question 10

What is a Sandbox used for?

Accepted Answer

To test malware in an isolated environment

Question 11

Which of the following is a Windows Event Viewer classification? (Select All)

Accepted Answer

Error, Debug, Alert

Question 12

Which tool should an investigator use to dynamically investigate malware?

Accepted Answer

Debugger

Question 13

Which of the following should be monitored during dynamic malware analysis?

Accepted Answer

File system changes, Registry changes, Network activity

Question 14

Which of the following is not CPU architecture? (select all)

Accepted Answer

Pi

Question 15

Which of the following tools can be used to research RAM dumps?

Accepted Answer

Volatility

Question 16

Which is NOT a tool for Data Carving?

Accepted Answer

DumpIt

Question 17

Which tools can you use to clone a drive? (Select All)

Accepted Answer

FTK Imager, dd

Question 18

What is the most common file system in Linux?

Accepted Answer

Ext4

Question 19

Which of the following tools can be used to find persistent malware?

Accepted Answer

Autoruns

Question 20

What is the correct incident response lifecycle per the NIST incident response methodology?

Accepted Answer

Prepare, Detect & Analyze, Contain, Erase & Recover, Post Incident

Questions 20