stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CySA+ CH 7 & 8a Flashcards | StudBud
Explore
/
CySA+ CH 7 & 8a
CySA+ CH 7 & 8a
20 terms
·
StudBud Administration
·
26 plays
Imported from external platform
Flashcards
20 cards
F
Practice quiz
P
Host live
L
Questions
20
Answers
1
Which criteria is
not
normally used when evaluating the appropriateness of a cybersecurity incident containment strategy
Log records generated by the strategy
Evidence preservation requirements
Effectiveness of the strategy
Cost of the strategy
2
Which one of the following activities does CompTIA classify as part of the recovery validation effort?
Scanning
Sanitization
Secure disposal
Rebuilding systems
3
See Below
C:\Windows\System 32\Installers
C:\Windows\Jim\Install.log
C:\Windows\Install.log
C:\Windows\Jim\AppData\Local\Temp
4
Which one of the following pieces of information is most critical to conducting a solid incident recovery effort?
Root cause of the attack
Attacks on other organizations
Identity of the attacker
Time of the attack
5
Which of the following is best suited to to perform memory analysis and forensics for Windows, macOS, and Linux systems?
Dumpit
The Volatility Framework
LiME
fmem
6
What two files may contain encryption keys normally stored only in memory on a Window system?
Core dumps and encryption logs
The Registry and hibernation files
Core dumps and hibernation files
The MFT and the hash file
7
See Below
Segmentation
Eradication
Removal
Isolation
8
Frederick wants to determine if a thumb drive was ever plugged into a Windows system. How can he test for this?
Review the MFT
Use USB Historian
Check the system’s live memory
Create a forensic image of the drive
9
See Below
Eradication
Removal
Segmentation
Isolation
10
See Below
Identifying the source of the attack
Containment
Recovery
Eradication
11
See Below
Erase
Clear
Purge
Destroy
12
See Below
IDS
Playpen
Sandbox
DLP
13
You received the following MD5 sums from her original drive and the cloned image after using dd. What is likely wrong?
The clone was modified.
An unknown change or problem occurred.
The original was modified.
dd failed.
14
See Below
A log viewer
Timestamp validator
A timeline
Registry analysis
15
See Below
A hash validator
A read blocker
A drive cloner
A write blocker
16
Which format does dd produce files in?
ddf
EN01
RAW
OVF
17
See Below
Removal
Isolation
Segmentation
Eradication
18
Files remnants found in clusters that have been only partially rewritten by new files found are in what type of space?
Non-Euclidean
Outer
Slack
Unallocated space
19
Which of the following is least likely to contain useful information about files that were changed on a Windows System?
The MFT
Event Logs
Volume shadow copies
INDX files
20
Which phases of incident response involves active undertakings designed to limit damage that an attacker might cause?
Post-Incident Activity
Preparation
Detection and Analysis
Containment, Eradication, and Recovery
