What is a ‘magic number’?

File signatures used to identify file formats in data streams

Which of the following is NOT a containment strategy during incident Response

Update/Patch the affected hosts

To analyze an incident properly, incidents can be prioritized according to the following method? (choose all correct)

Information Sensitivity, Function, Recovery Difficulty

What is PowerForensics?

PowerShell Module designed for forensic operations

Additionally Volatility plugins to gather supportive system information during an investigation (choose all correct)

envars, DumpRegistry, Consoles, Cmdscan

The most important responsibility in incident response is?

Create an Incident Response Policy

What are some characteristics between Windows and Linux systems wrt Forensic Analysis? (Choose all correct)

Linux stores most system functions as files, Most Windows Data is binary, Most Linux Data is plain text

Which of the following can be dumped from a memory image w/a Volatility plugin? (Choose all correct)

Process Dump, DLL Dump, File Dump

What are some Memory Analysis Use Cases/Attack Detections? (Choose all correct)

Fileless Malware, Encrypted Systems

In Windows what is prefetcher?

Performance Optimization mechanism to speed up application loading time

What is ‘Live’ USB Analysis?

USB used to boot computer independent of computer operating system

Which of the following are places where Windows could store memory files? (Choose all correct)

MEMORY.DMP, Pagefile, Hyberfil.sys

studbud

DFIR-07 Final Exam 1/2

100 termsStudBud Administration37 plays

Imported from external platform

Flashcards100 cardsFPractice quizPHost liveL

Questions 100

Answers

1
Which of the following is NOT a drive capture/clone tool?
Clonezilla
FTK Imager
SIFT
dd
2
What is a ‘magic number’?
File signatures used to identify file formats in data streams
File sizes used to aid in identifying the end of a file for data carving
File version data to aid in identifying compatible applications
A File’s Metadata stored in the MFT
3
When a browser is in PRIVATE MODE only the cache is saved?
False
True
4
Which of the following is NOT a containment strategy during incident Response
Segmentation
Update/Patch the affected hosts
Black Hole Shunt
Host Isolation
5
Where are Windows prefetch files located?
c:\prefetch
c:\system\prefetch
c:\windows\prefetch
c:\windows\system32\prefetch
6
The desired result of an eradication plan is the complete removal of the threat from the initial compromised host(s)
True
False
7
Which command can be used to view file system types and information on a Linux system?
fs -T
df -T
vdt -t
vwfs -T
8
Which of the following is conducted continuously?
Incident response
Digital forensics
Threat hunting
Pentesting
9
What Volatility plugin can list all DLLs loaded for a process in the system?
procdll
dlllist
dlldump
piddll
10
To analyze an incident properly, incidents can be prioritized according to the following method? (choose all correct)
Scope of Effect
Information Sensitivity
Function
Recovery Difficulty
11
Where can you see a file’s Alternate Data Streams? (choose all correct)
dir /r
File Explorer
MFT
My Computer
12
What deals with making sure that someone cannot deny the validity of something?
Integrity
Availability
Non-repudiation
Confidentiality
13
Which Volatility plugin can be used to find memory sections marked as executable but not backed up with a file on disk?
Malfind
Malinject
NonExec
OrphanExec
14
What part of the CIA Triad deals with making sure data is not properly changed?
Availability
Confidentiality
Integrity
Non-repudiation
15
What is PowerForensics?
Linux installable environment for forensics operations
Virtual Machine package for forensics operations
Python based forensics operations framework
PowerShell Module designed for forensic operations
16
VMWare Virtual Machines store the VM Memory for snapshots and hibernation as files on the host disk
True
False
17
What is an example of intangible asset?
Patent
Cash
Furniture
Building
18
Which of the following is NOT part of the CIA triad?
Confidentiality
Integrity
Accountability
Availability
19
If a physical machine is rebooted, memory information is stored in a .vmem file that can be recovered
True
False
20
Image captures are always stored as a single file to make copying easier?
False
True
21
Which of the following is NOT a type of DR backup site?
Glacier site
Warm site
Cold site
Hot site
22
Chain of Custody concerns in DFIR only apply to government agency incidents?
False
True
23
What commands/tools can be used to access Linux Memory for forensics (choose all correct)
Swap Digger
Fmem
LIME
FTK
24
Which of the following are forensic image formats? (Choose all correct)
VDI
AFF
VMDK
EWF
25
Which tool can be AUTOMATICALLY parse an MFT?
Autopsy
PowerForensics
SIFT
dir /r
26
Which of the following are Linux File systems (choose all correct)
NTFS
EXT4
BTRFS
XFS
27
Additionally Volatility plugins to gather supportive system information during an investigation (choose all correct)
envars
DumpRegistry
Consoles
Cmdscan
28
When an Incident occurs it is critical not to respond until all pertinent information is collected
True
False
29
The most important responsibility in incident response is?
Containment
Detection and Analysis
Create an Incident Response Policy
Recovery
30
What are some characteristics between Windows and Linux systems wrt Forensic Analysis? (Choose all correct)
Linux stores most system functions as files
Most Windows Data is binary
Both Windows and Linux file names are case sensitive
Most Linux Data is plain text
31
A tool that can be used to identify possible startup locations?
Rekall
Dumpit
Autoruns
HxD
32
Which of the following can be dumped from a memory image w/a Volatility plugin? (Choose all correct)
Process Dump
DLL Dump
PrivateKey Dump
File Dump
33
Which of the following is NOT a tool to collect artifacts from primary and secondary storage?
Dd
FTK imager
Volatility
Dumpit
34
Which of the following are memory analysis frameworks? (Choose all correct)
CAINE
SIFT
Volatility
Rekall
35
Which of the following are Memory Acquisition Tools? (Choose all correct)
Clonezilla
FTK-Imager
Dumpit
dd
36
What are some Memory Analysis Use Cases/Attack Detections? (Choose all correct)
Fileless Malware
Encrypted Systems
On Path
DDoS
37
A highly experienced staff member with enough IT/cybersecurity experience and knowledge to conduct DFIR activities
SOC analyst
CISO
Tier 2 analyst
Tier 3 analyst
38
In Windows what is prefetcher?
Performance Optimization tool that loads network protocols
Performance Optimization tool that loads previously used office documents
Performance Optimization tool that loads security protocols
Performance Optimization mechanism to speed up application loading time
39
Which command lists only the inodes of removed files?
fsstat
ils
40
Which of the following are IRRECOVERABLE artifacts not written to disk/reviewable after shutdown? (Choose all correct)
Logs
DNS Cache
Browser history
PowerShell history
41
Inodes in Linux are similar to what in Windows File System?
Blocks
MFT
MBR
GPT
42
What does ‘Capture from Live Media’ mean?
Computer is on and logged in
Capture a disk thru the computers installed OS
Capture information from a compromised external device
Boot from external device
43
Which Partition Table format supports up to 128 partitions
BIOS
MBR
GPT
UEFI
44
Static binaries are executables that run using the operating system libraries
True
False
45
Which of the following are Memory Acquisition Tools (choose all correct)
FTK
FastDump
Clonezilla
dd
46
Which command shows the contents of a Windows computer’s DNS Cache?
ipconfig /displaydns
ipconfig /displaycache
ipconfig /showdns
ipconfig /showcache
47
When a USB drive is connected, all files copied to/from the USB Drive are recorded in the logs
False
True
48
What is ‘Live’ USB Analysis?
USB used to copy OpSys of host before it is shutdown
USB used to boot computer independent of computer operating system
USB used to copy files before shutting down host
USB used to copy memory before shutting down host
49
A File System records all metadata changes made on the volume to protect the system in the event of a crash is called?
Crashdump
VolumeProtect
FileTracking
Journaling
50
PowerForensics can analyze all of the following EXCEPT
Registry
Boot Sectors & Partitions
File Systems
Live Memory Contents
51
Which of the following are places where Windows could store memory files? (Choose all correct)
MEMORY.DMP
Registry
Pagefile
Hyberfil.sys
52
Which command must be run to enable an image to be mounted on a Linux system?
imgload
osfmount
losetup
imgmount
53
Besides MRU, what are TWO other methods to determine recently run programs?
ProgramHistory
AppCompatCache
Jump Lists
Tab Complete
54
Which of the following are examples of DFIR Environments? (Choose all correct)
Kali desktop
CAINE Live
Flare VM
SIFT Workstation
55
What is ‘methodology’ with respect to a SOC/IR?
Detailed step by step instructions on how to handle cyber incidents
Provides step by step instructions on how to handle to cyber incidents
A framework providing guidance for cyber incident handling
Provides the recommended solutions for specific cyber incidents
56
When investigating processes, which plugin is useful when searching for hidden processes?
Psscan
Psxview
Pstree
Pslist
57
What tools can be used to identify hidden exe files in other files? (Choose all correct)
Binwalk
Look for MZ (4D 5A) Header
dir /r
HxD
58
Which command can be used to perform image/file acquisition over the network combined with Netcat?
dd
mv
cp
img
59
Includes files, images, scripts, other media-related data referred to for faster searches and page loading in a browser
History
Temp Files
Cache
Prefetch
60
What is the most important asset of a business?
Employees
Intellectual property
Finances
Products
61
The MFT contains the following information (choose all correct)
File Size
File Attributes
File Permissions
File Timetamps
62
Which Partition Table format is limited to max 2 TB partitions?
UEFI
GPT
BIOS
MBR
63
Threat Intelligence Gathering includes? (Choose all correct)
Tool configurations
Indicators
TTP
Host update reports
64
What is the name of the activity that Security Teams perform to search for malicious items that pass security solutions?
Threat hunting
Digital forensics
Incident response
Security auditing
65
DLLs that are loaded from c:\windows directory could be a strong indication of malicious DLLs
False
True
66
Which command is best to acquire Linux process information because it is based on the files used by processes?
ps
Isof
67
What are the 2 main ways to investigate a captured image?
Onsite Analysis
Office Analysis
Live examination thru a virtual machine
Static Analysis thru software
68
Which of the following are NTFS File System Characteristics?
Journaling
Indexing
File/Folder permissions
Alternate Data Stream
69
What application can be used to extract URLs from memory?
Strings
URLHistory
URLExtract
BrowserHistory
70
When artifacts are captured from a digital system that is powered on, it’s called what type of analysis?
Online analysis
Active analysis
Immediate analysis
Live analysis
71
What network utility can be used to establish network connections thru TCP/UDP to write and read from?
Netcat
Netstat
Netcon
Nbstat
72
Which of the following are Acquisition best practices? (Choose all correct)
Memory captures better if the user is logged on
Capture to an external source
Use sterilized media for acquisition
Document the capture properly
73
FTK-Imager is primarily a cloning tool, while Clonezilla focuses entirely on forensics
True
False
74
PowerForensics supports both live and dead system forensics
True
False
75
Which of the following is closed/proprietary format for memory acquisition?
EWF
AFF4
RAW
E01
76
Other departments that can be involved in cybersecurity activity in a company include? (chose all correct)
Public affairs
BCP/DR
IT support
HR
77
Which tool can be used for capturing memory dumps?
Bulk extractor
FTK Imager
Exif tool
Photorec
78
Which of the following artifacts can NOT be collected during dead analysis of a physical computer?
System settings
Media files
Log files
Memory
79
Which of the following are common elements of the Digital Forensics Process? (Choose all correct)
Analysis
Examination
Pentesting
Collection
80
Which of the following are Volatility plugins used to scan the network? (Choose all correct)
ConnScan
NetScan
Sockets
NetInfo
81
What is the proper format to reference a file’s ADS?
<filename>:<streamname>
<filename> -S <streamanme>
<filename>-<streamname>
<filename> -s <streamname>
82
Which of the following are part of Incident Response? (Choose all correct)
OS Updates
Containment
Detection
Preparation
83
Which of the following is used to provide prioritization and initial response to security alerts?
SIEM
SOAR
IDS
IPS
84
What do we use to ensure artifacts have not been modified?
File size
File properties
Hashing
Drive metadata
85
Which plugin does Volatility use to determine a memory image’s profile?
imageinfo
memprofile
profile
meminfo
86
Which of the following is NOT a Virtual Drive format?
VHD
VMDK
VHDX
VBS
87
The main goal of the SOC is to…
Resolve user problems in an organized/accurate way ensure user satisfaction
Take actions against threat and prevent progress and damage
Monitor one or more networks for conditions that degrade network services
Monitor network & identify suspicious behavior based on collected data
88
What is the equivalent in Linux of the Windows pagefile?
vmem File
Swap Partition
Memory.swap
Page Partition
89
Which of the following system processes should only occur once (choose all correct)
Explorer.exe
Lsass.exe
Wininit.exe
Services.exe
90
Which of the following is NOT a data carving tool?
Rekall
HxD
Bulk extractor
Photorec
91
OSFMount is used to?
Mount external device for booting
Mount external devices to setup for external booting
Analysis of Memory Dumps
Mount images in read-only mode
92
Autopsy is based on creating separate “cases” that can include multiple image captures and examination artifacts
False
True
93
According to ‘Order of Volatility’, which of the following artifacts should be LAST to collect in the choices
Remote Logs/Monitoring Data
Disks
Temp Files
RAM
94
What does RACI stand for?
Responsible, Accountable, Consulted, Informed
Ready, Astute, Clever, Interested
Responsible, Actionable, Coordinated, Integrated
Results, Accounts, Communication, Interested
95
A government agency that provides an incident response methodology to government and business?
CIA
NIST
NSA
SANS
96
Where is the Most Recently Used (MRU) information stored in Windows?
Registry
c:\windows\logs
Memory
c:\windows\MRU
97
What is critical to do/have to enable Threat Hunting
Application Catalog
Baseline
Network Diagram
Firmware version report
98
Which tool can be used for memory dumps?
Volatility
Photorec
Bulk extractor
Exif tool
99
Which FILE SYSTEM allows permissions to be set on individual files?
exFAT
FAT32
FAT
NTFS
100
What utility displays routing tables, open/established sockets, incoming/outgoing TCP connections, and interfaces?
Netstat
Netcon
Netcat
Nbstat

DFIR-07 Final Exam 1/2 Flashcards | StudBud