DFIR-07 Final Exam 2/2

In a Portable Executable (PE) file which section is “Also known as code segment, this is where all the code resides”?

In static malware analysis, what are some tools that can be used to view raw binary data?

Which of the following is a type of hacker?

TCPdump is a CLI/terminal network sniffing tool

Which of the following is a tool used for simulating fake network traffic?

Which are useful IOCs to evaluate when doing Dynamic Analysis?

Malware un-maps legitimate code of a target process from memory, then overwrites the memory w/malicious code is called?

When reviewing Linux logs, what command can be used to search for strings in the log files?

Which of the following is a command base packet capture utility?

What is Wireshark used for?

Tool used for Drive Cloning

What investigation techniques “involves inspecting malware code as it was executed by the CPU.”

Which of the following is a tool that can be used to detect persistent malware?

Which malware analysis method is “full code analysis of the sample, sometimes referred to as reverse engineering”?

Persistence techniques can ensure that a hacker retains access to a system even after it restarts?

What are some common persistence techniques in Windows? (Choose all correct)

In Windows Event Viewer, which logon type ID indicates a standard/interactive login via keyboard/screen (pg194)

What CLI tools can generate file hashes of suspected malware for analysis?

Which of the following is NOT true about ProcMon?

What are CVEs?

“Gives attackers unauthorized access to a machine by bypassing normal authentication procedures.” Malware called?

What are some common log GENERATORS? (Choose all correct)

Which of the following programming languages issues machine code instructions and is difficult to learn?

Which of the following is a valid CPU Architecture?

Pi is a CPU architecture?

Which is a technique used to analyze malware whose code is encoded or encrypted?

Which of the following is not monitored when doing Dynamic Malware Analysis?

"Provides privileged and persistent access to the target machine" malware called?

There are ways to evade debugging tools

5 Stages of Incident Response in order?

UPX is a tool used that can be used to obfuscate malware code?

Which of the following serves as a source for network traffic data sources?

Debugging malware is a slow and tedious process.

Zeek Network Security Monitor performs which of the following? (Choose all correct)

Indicators of Compromise (IoC) can include? (Choose all correct)

Which of the following is a valid CPU Architecture

What are some common persistence techniques? (Choose all correct)

Which of the following system processes should only occur once? (Choose all correct)

Which of the following contains RAW data, has no format (only bytes), and requires tools for capture?

A debugger that an be used to analyze malware while it’s running?

A proxy acts as an intermediary between a client requesting a resource and the server providing that resource

Which of the following are 3rd party Threat Intelligence Platforms?

What query language does Microsoft Log Parser use?

What is a tool that can be used to proxy traffic through it?

Which of the following is part of the APT attack flow?

Wireshark replaces network traffic

In Windows Event Logs, what is the event code for ‘An account failed to log on’ (pg 193)

Through the use of debuggers, we’re able to gather details in Dynamic Malware Analysis

ProcMon is useful for Static Malware Analysis

David wants to test company software and analyze its behavior in real time. Which of following methods should he use?

What are some common SOURCES of logs? (Choose all correct)

Which command is useful for examining open network connections?

What are 2 ways to delete windows event logs?

Processes in Linux have file representations within what directory?

Pop-up appears saying computer files were infected and offering to fix the problem. Which of following attacks is this?

Which of the following is a common use for proxies?

Which of the following is an anti-forensic technique?

How is a file hidden using steganography?

Which PE tool can be used “can determine whether a file is packed and the compiler that created the file”?

What are some examples of “suspicious behavior” indicating the presence of malware? (Choose all correct)

Which of the following is an automated sandbox for analyzing malware

What are 2 statistical analysis methods used to detect malicious patterns?

Why is it important to use logs?

Which of the following are places where Windows could store memory files? (Choose all correct)

Which is a tool that can be used to parse and log pcap files?

Some malware checks for live internet connection before execution

In Windows Event Viewer what are some of the common event types? (Choose all correct)

Which of the following is not monitored when doing Dynamic Malware Analysis?

It is harder to delete logs in Linux without leaving a trace than in Windows?

Which of the following DLLs are IMPORTANT and should NOT be deleted? (Choose all correct)

Which of the following tools for the repeating of previously captured traffic?

Threat Hunting involves?

Linux uses which file system by default?

Which of the following is a description of an IDS?

On NTFS file systems are deleted files recoverable?

Zeek-Cut doesn’t have the ability to parse though and filter a pcap file.

Which tool “lists a portable executable file’s imported and exported functions and aids in monitoring imported DLLs”?

Netflow is the best traffic capture option

Which of the following is a step in the Network Forensic investigation flow?

What is the process used by APT groups?

Malware cannot evade a sandbox

The Threat Hunting Cycle is continuous and never stops

Indicators of Compromise (IoC) can include… (choose all correct)

Which is not an Intel debugging terminology?

What are the 2 ways PowerShell historical records can be viewed?

Which of the following is used for minimal footprint in a system?

Which of the following is NOT a Windows Event Viewer log classification?

which of the following is an important piece when setting up an environment for Dynamic Analysis?

Autoruns