stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
DFIR EXAM Flashcards | StudBud
Explore
/
DFIR EXAM
DFIR EXAM
19 terms
·
StudBud Administration
·
31 plays
Imported from external platform
Flashcards
19 cards
F
Practice quiz
P
Host live
L
Questions
19
Answers
1
How is a file hidden using steganography?
By storing the file in the recycle bin
By moving the file to a temp folder
By saving the file in the Downloads folder
By hiding a file within another file
2
What is the responsibility of a CISO?
To manage the business model of an organization
To make sure the physical security of an organization is sufficient
To manage IT employees and search for quality recruits
To create a strategy for data and IT asset protection and maintain it
3
Which tool should an investigator use to dynamically investigate malware?
Packer
Debugger
UPX
Disassembler
4
Which of the following are commonly used for malware persistence?(Choose all correct answers.)
Registry keys
Scheduled tasks
Services
Anti-debugging
5
Which of the following is a Windows Event Viewer classification?(Choose all correct answers.)
IOC
Alert
Error
Debug
6
Which of the following is not included in the digital forensics process?
Collection
Examination
Penetration Testing
Reporting
7
What is a sandbox used for?
To perform static malware analysis
To test malware in an isolated environment
To run new apps
To clear infected files in the host system
8
Which of the following is not CPU architecture?
ARM
MIPS
Pi
NASM
9
Which of the following is not a feature of Wireshark?
Object export
Display filters
Replace network traffic
Stream inspection
10
Which of the following tools can be used to obfuscate malware code?
NASM
PEiD
UPX
Nmap
11
Which of the following should be monitored during dynamic malware analysis? (Choose all correct answers.)
File system changes
Executable file strings
Network activity
Registry changes
12
Which of the following tools can be used for drive cloning? (Choose all correct answers.)
Volatility
dd
None of these choices
FTK Imager
13
Which of the following tools can be used to find persistent malware?
HxD
Autoruns
Volatility
Wireshark
14
What is the difference between Wireshark and tcpdump?
tcpdump can only capture packets that use TCP.
tcpdump is a dumping tool; Wireshark monitors system files.
tcpdump is command-based; Wireshark has a GUI interface.
Wireshark is a network monitoring tool; tcpdump is used as an IDS.
15
Which of the following is not a containment strategy for a cybersecurity incident?
Updating IDS rules
Blocklist filtering
Host isolation
Segmentation of networks
16
Which of the following statements is true?
When data is erased from the operating system, it cannot be restored.
Data is kept only in RAM and cannot be restored from the HDD.
data is erased from the system it remains on the HDD until overwritten
Data is erased when the operating system reboots.
17
Which of the following tools can be used to research RAM dumps?
PhotoRec
Exif tool
Volatility
dd
18
Which of the following is the most common file system used in Linux distributions?
XFS
NTFS
Ext4
FAT32
19
Which of the following is not a tool that is used for data carving?
HxD
DumpIt
Bulk Extractor
PhotoRec
