stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CYSA- CS0-002 Quiz Review Flashcards | StudBud
Explore
/
CYSA- CS0-002 Quiz Review
CYSA- CS0-002 Quiz Review
29 terms
·
StudBud Administration
·
269 plays
Imported from external platform
Flashcards
29 cards
F
Practice quiz
P
Host live
L
Questions
29
Answers
1
During an investigation Ben asks Chris to sit with him and to sign off on the actions he has taken. What is he doing?
Over-the-shoulder validation
Separation of duties
Pair forensics
Maintaining chain of custody
2
See Below
%SystemRoot%\MEMORY.DMP
%SystemRoot%/WinDBG
The Registry
A system restore point file
3
Which one of the following is not a purging activity?
Block erase
Resetting to factory state
Cryptographic erase
Overwriting
4
I leave a shiny new USB Flash drive in the hallway.
Baiting
Impersonation
Spoofing
Phishing
5
See Below
File system access
Logical access
Manual access
Physical acquisition
6
Which one of the following is not a common use of formal incident reports?
Sharing with other organizations
Developing new security controls
Training new team members
Assisting with legal action
7
Which one of the following activities is not normally conducted during the recovery validation phase?
Verify the permissions assigned to each account
Verify logging is functioning properly
Implement new firewall rules
Conduct vulnerability scans
8
A tool for scanning.
Cain & Abel
ping
Maltego
dig
9
Which of the following is not a potential issue with live imaging of a system?
Malware may detect the imaging tool and work to avoid it
Memory or drive contents may change during the imaging process
Remnant data from the imaging tool
Unallocated space will be captured
10
Also called Typo squatting.
URL hijacking
Shoulder surfing
Spam
Spim
11
See Below
Bad checksums
Anti-forensic activities
Hash mismatch
Inability to certify chain of custody
12
A tool for OSINT
Netcat
nbtscan
Nmap
Whois
13
A password cracker
Jack the Ripper
Cain & Mabel
Snort
Cain & Abel
14
See Below
Post-Incident Activities
Containment
Eradication
Recovery
15
Which one of the following is not typically found in a cybersecurity incident report?
Chronology of events
Identity of the attacker
Documentation of lessons learned
Estimates of impact
16
Susan has been asked to identify the applications that start when a Windows system does. Where should she look first?
The Registry
INDX files
The MFT
Volume shadow copies
17
See Below
Removal
Isolation
Segmentation
Detection
18
Which tool is not commonly used to generate the hash of a forensic copy?
SHA1
MD5
AES
FTK
19
A tool for scanning and enumerating
Whois
dig
Nmap
Ldap
20
What forensic issue might the presence of a program like CCleaner indicate?
Malware packing
Full disk encryption
Anti-forensic activities
MAC time modifications
21
A tool for testing applications
Peach Fuzzer
Wireshark
nbststat
nslookup
22
See Below
Cause a system crash and analyze the memory dump
Brute-force encryption cracking
Live imaging
Offline imaging
23
I pretend to be your boss and ask for credentials.
Spoofing
baiting
Impersonation
Shoulder surfing
24
See Below
Purge
Erase
Clear
Destroy
25
See Below
Segmentation
Removal
Isolation
None of the Above
26
Which of the following Linux command-line tools will show you how much disk space is in use?
isof
top
df
ps
27
Which one of the following data elements would not normally be included in an evidence log?
Serial number
Malware signatures
Record of handling
Storage location
28
A popular Footprinting tool
Snort
Nessus
Snmpwalk
nslookup
29
A tool for packet trace analysis
Nmap
netstat
John The Ripper
Wireshark
