DFIR Final Exam Prep

Question 1

What TCPdump tool makes it possible to capture traffic in an environment w/o IDS and replay it in an environment w/IDS?

Accepted Answer

Tcpreplay

Question 2

What is true about dynamic analysis tool Regshot? (3 answers)

Accepted Answer

is an open-source registry utility, takes snapshots of the registry at any given time, is useful in examining registry changes during a malware analysis

Question 3

Which log classification is actionable and requires someone’s attention?

Accepted Answer

Alert

Question 4

What is the most common file system in Linux distributions, due to its many features, such as journaling?

Accepted Answer

Ext4

Question 5

What is true about CPU architecture type: ARM? (2 answers)

Accepted Answer

mainly used in mobile and low power devices, includes approximately 5000 different commands

Question 6

What is not true about dynamic analysis tool Process Explorer?

Accepted Answer

the Threads tab shows all network connections associated with the process

Question 7

What is true about Tcpdump? (3 answers)

Accepted Answer

can use live, on-demand captures, supports several flags for a more focused collection of network data, shows TCP/IP & other packets that are received/transmitted over a network

Question 8

If you only could choose HxD or Autopsy for a data carving project, you would choose HxD.

Accepted Answer

False

Question 9

Malware can persist through a startup folder, whereby all what type of files in the folder will be run upon startup?

Accepted Answer

executable

Question 10

Volatility Framework has an option to read different types of memory dumps & filter them to different parameters.

Accepted Answer

True

Question 11

Malware packing is considered an obfuscation technique.

Accepted Answer

True

Question 12

What is not true about dynamic analysis tool Autoruns?

Accepted Answer

discovers how malware configures itself to survive a runtime error

Question 13

What is true about of Steganography?

Accepted Answer

Hackers can hide crucial information in existing files

Question 14

What can be manipulated to load malware upon restart?

Accepted Answer

MBR

Question 15

What is the Chief Information Security Officer (CISO) responsible for? (3 answers)

Accepted Answer

the overall security program, cyber risk management to vulnerability management, any other security-related function associated w/IR

Question 16

What is not an Anti-Forensics Technique (obfuscation)?

Accepted Answer

Blindsiding

Question 17

Intel's x86 processor is the most common architecture used by PCs.

Accepted Answer

True

Question 18

What is true about Cuckoo? (3 answers)

Accepted Answer

receives a sample as input & provides a report with all system changes, automatically runs and analyzes files while running in an isolated OS, an open-source automated malware sandbox platform

Question 19

What is not a DFIR tool and is primarily used for cloning a block device?

Accepted Answer

Clonezilla

Question 20

A SOC team represents what management strategy?

Accepted Answer

Bottom-up

Question 21

Which log classification is generated when mistake occurs in the OS or other system software?

Accepted Answer

Error

Question 22

What is true about Rekall? (3 answers)

Accepted Answer

developed by Google, aims to be the most stable and reliable m.a.f., leverages exact debugging info to locate significant kernel data structures

Question 23

What is true about the static analysis tool SigCheck? (3 answers)

Accepted Answer

provide hash and version information for files, displays file digital signature details, indicates whether or not a signature is valid

Question 24

What is an advantage of Clonezilla over other capture tools?

Accepted Answer

ability to maintain images apart from the local system

Question 25

What is true about Resource Hacker? (2 answers)

Accepted Answer

enables the viewing and editing of all resources in executables, provides an analysis of .rsrc and extracts the information

Question 26

What flag does Tcpdump not support?

Accepted Answer

-$ [snaplen]

Question 27

What is the Digital Forensics process?

Accepted Answer

Collection, Examination, Analysis, Reporting

Question 28

What file system was designed to span multi storage devices, it divides the file system into mapped blocks of data?

Accepted Answer

XFS

Question 29

What is true about dynamic analysis tool ProcMon? (3 answers)

Accepted Answer

a user can request a predefined set of filters (benign & native to the OS), records all events created by a process from the time the tool is opened, provides the option to stop and restart monitoring at any time

Question 30

What Linux file system is considered a space-efficient file system, as it supports compression and snapshots?

Accepted Answer

Btrfs

Question 31

PhotoRec ignores the file system and instead works with block device data.

Accepted Answer

True

Question 32

Common DLLs that run in every process cannot be infected.

Accepted Answer

False

Question 33

What are two tools capable of detecting steganography?

Accepted Answer

binwalk, zsteg

Question 34

If a hacker retains access to a system even after it restarts or entry credentials were changed, this would be what?

Accepted Answer

Persistence

Question 35

When no file system metadata is available, you have to resort to what?

Accepted Answer

Data carving

Question 36

What is true about Monitored Data? (3 answers)

Accepted Answer

Malware usually makes changes in the OS file system, Monitoring registry changes may reveal malware performing config changes, Analyze the system’s network activity for mware command/control & beaconing

Question 37

All persistence mechanisms require high-level privileges.

Accepted Answer

False

Question 38

The process of obtaining deleted files and metadata in data streams is referred to as what?

Accepted Answer

file carving

Question 39

Which part of the NIST Lifecycle, would identifies assets by sensitivity?

Accepted Answer

Preparation

Question 40

What is true about The dd Tool? (2 answers)

Accepted Answer

primary purpose is to copy and convert files, can be used to clone entire drives and partitions

Question 41

What is true about the static analysis tool Binwalk? (3 answers)

Accepted Answer

designed to analyze binary files for embedded files, looks for signatures in UNIX and Windows files, designed to analyze binary files for executable code

Question 42

What is true about PEid? (3 answers)

Accepted Answer

can determine whether a file is packed, provides the option to unpack some common packers, can currently detect more than 470 different signatures

Question 43

What types of computer files can bits of data be replaced, with bits of malicious coded information? (3 answers)

Accepted Answer

text files, image files, sound files

Question 44

What is true about Wireshark features? (3 answers)

Accepted Answer

detect abnormal network behavior, enables data stream inspection instead of packet-by-packet inspection, export some objects & display filter expressions

Question 45

What is true about the static analysis tool Strings? (3 answers)

Accepted Answer

remain in plain text, useful in detecting indicators of compromise, looks for ASCII or Unicode strings with a default length of >=3 characters

Question 46

What are two actions you would do during the NIST Containment Lifecycle?

Accepted Answer

shut down compromised servers, isolate network segments

Question 47

What capture tool secures sensitive data with AES 256-bit encryption?

Accepted Answer

Logicube Falcon

Question 48

What is true about UPX? (3 answers)

Accepted Answer

is automatic and pre-built in the Kali Linux distribution, possible to use the command line within the tool to unpack the malware code, can analyze the malware code with a reverse engineering tool

Question 49

Which log classification is generated by applications for troubleshooting purposes?

Accepted Answer

Debug

Question 50

What data carving tool, ignores the file system structure, to process different parts of a disk in parallel?

Accepted Answer

Bulk Extractor

Question 51

Volatility Framework is an open-source collection of Python-based tools that support only Windows.

Accepted Answer

False

Question 52

What is not a NIST Lifecycle?

Accepted Answer

Detection & Identification

Question 53

Which log classification is generated when something is missing or required by an application or system?

Accepted Answer

Warning

Question 54

What is not true about Magic Numbers?

Accepted Answer

for a .jpeg file, the hex code FF D8 represents the end footer

Question 55

A Sandbox receives a sample as input & provides a report w/all system changes introduced by the sample as output

Accepted Answer

True

Question 56

What is a tool used for network capture/investigation & is installed by default on most servers/network equipment?

Accepted Answer

Tcpdump

Question 57

What is true about when a file is deleted? (3 answers)

Accepted Answer

marked unallocated in the MFT table & available in the MFT record, $LogFile, $USNJrnl may still have metadata referenced to the deleted file, data clusters remain intact until the clusters are reused

Question 58

What is true about FTK Imager? (3 answers)

Accepted Answer

can be executed from live media and features a convenient GUI, focuses entirely on forensics, the imaging software is free

Question 59

Malware can register a what, with a binary path that points to a malicious executable program on the disk?

Accepted Answer

service

Question 60

What tools can help locate persistent malware? (2 answers)

Accepted Answer

Autoruns, Autorun.inf

Question 61

What is true about dynamic analysis tool OllyDbg? (3 answers)

Accepted Answer

commonly used by malware analysts and reverse engineers, comes in two flavors that support the x64 and x86 architectures, a debugger used to analyze malware while it is running

Question 62

Regedit is a utility that can be used to hide and launch programs activated automatically by RunOnce.

Accepted Answer

True

DFIR Final Exam Prep

Questions 62

DFIR Final Exam Prep

Questions 62