DFIR-16 Exam Review

How is a file hidden using steganography?

Tcpdump is a CLI/terminal network sniffing tool.

Which of the following is not monitored when doing Dynamic Malware Analysis?

5 Stages of Incident Response in order?

Tool used for Drive Cloning

Why is it important to use an IR plan?

Which of the following systems contains metadata for each stored file?

Which of the following ARE common elements of the Digital Forensics Process (choose all correct)?

For a cybersecurity incident, the containment process includes updating Firewall rules?

Which of the following are memory analysis frameworks (choose all correct)

UPX is a tool used that can be used to obfuscate malware code?

Which of the following is used for minimal footprint in a system?

What is the process used by APT groups?

Notifications from a program called code.exe and wants to examine its process. Which of following help examine process?

Which of the following services provides proof of the origin and integrity of data?

Which of the following is a common identification method that can verify the identity of SPECIFIC files?

On NTFS file systems, are deleted files recoverable?

Which of the following is NOT a data carving tool?

David wants to test company software and analyze its behavior in real time. Which of following methods should he use?

Which of the following is a valid CPU Architecture?

Check sites that were accessed by employees to ensure they are not entering prohibited sites. Which of following check?

In an IT Security Dept, which role typically conducts Threat Hunting

What is WireShark used for?

Which of the following IS NOT a Windows Event viewer log classification?

Pop-up appears saying computer files were infected and offering to fix the problem. Which of following attacks is this?

Why is it important to use logs?

Linux uses which file system by default?

Which of the following tools can check network connections?

autoruns