Duplicate of DFIR Final Exam Prep

Question 1

Regedit is a utility that can be used to hide and launch programs activated automatically by RunOnce.

Accepted Answer

True

Question 2

Malware can persist through a startup folder, whereby all what type of files in the folder will be run upon startup?

Accepted Answer

executable

Question 3

Malware can register a what, with a binary path that points to a malicious executable program on the disk?

Accepted Answer

service

Question 4

What is true about dynamic analysis tool ProcMon? (3 answers)

Accepted Answer

records all events created by a process from the time the tool is opened, provides the option to stop and restart monitoring at any time, a user can request a predefined set of filters (benign & native to the OS)

Question 5

What types of computer files can bits of data be replaced, with bits of malicious coded information? (3 answers)

Accepted Answer

image files, text files, sound files

Question 6

What is true about CPU architecture type: ARM? (2 answers)

Accepted Answer

includes approximately 5000 different commands, mainly used in mobile and low power devices

Question 7

What is true about PEid? (3 answers)

Accepted Answer

can determine whether a file is packed, provides the option to unpack some common packers, can currently detect more than 470 different signatures

Question 8

What is true about dynamic analysis tool OllyDbg? (3 answers)

Accepted Answer

comes in two flavors that support the x64 and x86 architectures, a debugger used to analyze malware while it is running, commonly used by malware analysts and reverse engineers

Question 9

What is true about Tcpdump? (3 answers)

Accepted Answer

can use live, on-demand captures, supports several flags for a more focused collection of network data, shows TCP/IP & other packets that are received/transmitted over a network

Question 10

What is true about of Steganography?

Accepted Answer

Hackers can hide crucial information in existing files

Question 11

When no file system metadata is available, you have to resort to what?

Accepted Answer

Data carving

Question 12

A SOC team represents what management strategy?

Accepted Answer

Bottom-up

Question 13

What is true about when a file is deleted? (3 answers)

Accepted Answer

$LogFile, $USNJrnl may still have metadata referenced to the deleted file, data clusters remain intact until the clusters are reused, marked unallocated in the MFT table & available in the MFT record

Question 14

What is true about Rekall? (3 answers)

Accepted Answer

leverages exact debugging info to locate significant kernel data structures, developed by Google, aims to be the most stable and reliable m.a.f.

Question 15

All persistence mechanisms require high-level privileges.

Accepted Answer

False

Question 16

What capture tool secures sensitive data with AES 256-bit encryption?

Accepted Answer

Logicube Falcon

Question 17

Which part of the NIST Lifecycle, would identifies assets by sensitivity?

Accepted Answer

Preparation

Question 18

What can be manipulated to load malware upon restart?

Accepted Answer

MBR

Question 19

What is true about dynamic analysis tool Regshot? (3 answers)

Accepted Answer

takes snapshots of the registry at any given time, is useful in examining registry changes during a malware analysis, is an open-source registry utility

Question 20

Malware packing is considered an obfuscation technique.

Accepted Answer

True

Question 21

What is true about the static analysis tool SigCheck? (3 answers)

Accepted Answer

provide hash and version information for files, indicates whether or not a signature is valid, displays file digital signature details

Question 22

What is true about FTK Imager? (3 answers)

Accepted Answer

the imaging software is free, can be executed from live media and features a convenient GUI, focuses entirely on forensics

Question 23

Volatility Framework has an option to read different types of memory dumps & filter them to different parameters.

Accepted Answer

True

Question 24

What is not true about Magic Numbers?

Accepted Answer

for a .jpeg file, the hex code FF D8 represents the end footer

Question 25

What is the most common file system in Linux distributions, due to its many features, such as journaling?

Accepted Answer

Ext4

Question 26

What is true about the static analysis tool Strings? (3 answers)

Accepted Answer

looks for ASCII or Unicode strings with a default length of >=3 characters, useful in detecting indicators of compromise, remain in plain text

Question 27

Which log classification is generated when something is missing or required by an application or system?

Accepted Answer

Warning

Question 28

Intel's x86 processor is the most common architecture used by PCs.

Accepted Answer

True

Question 29

Which log classification is generated by applications for troubleshooting purposes?

Accepted Answer

Debug

Question 30

What are two actions you would do during the NIST Containment Lifecycle?

Accepted Answer

isolate network segments, shut down compromised servers

Question 31

What is true about the static analysis tool Binwalk? (3 answers)

Accepted Answer

designed to analyze binary files for embedded files, looks for signatures in UNIX and Windows files, designed to analyze binary files for executable code

Question 32

Which log classification is generated when mistake occurs in the OS or other system software?

Accepted Answer

Error

Question 33

What is not a DFIR tool and is primarily used for cloning a block device?

Accepted Answer

Clonezilla

Question 34

PhotoRec ignores the file system and instead works with block device data.

Accepted Answer

True

Question 35

What is not true about dynamic analysis tool Process Explorer?

Accepted Answer

the Threads tab shows all network connections associated with the process

Question 36

What is true about The dd Tool? (2 answers)

Accepted Answer

can be used to clone entire drives and partitions, primary purpose is to copy and convert files

Question 37

What is a tool used for network capture/investigation & is installed by default on most servers/network equipment?

Accepted Answer

Tcpdump

Question 38

What is not true about dynamic analysis tool Autoruns?

Accepted Answer

discovers how malware configures itself to survive a runtime error

Question 39

What are two tools capable of detecting steganography?

Accepted Answer

binwalk, zsteg

Question 40

What file system was designed to span multi storage devices, it divides the file system into mapped blocks of data?

Accepted Answer

XFS

Question 41

A Sandbox receives a sample as input & provides a report w/all system changes introduced by the sample as output

Accepted Answer

True

Question 42

Which log classification is actionable and requires someone’s attention?

Accepted Answer

Alert

Question 43

What is true about Monitored Data? (3 answers)

Accepted Answer

Analyze the system’s network activity for mware command/control & beaconing, Malware usually makes changes in the OS file system, Monitoring registry changes may reveal malware performing config changes

Question 44

What is true about Wireshark features? (3 answers)

Accepted Answer

export some objects & display filter expressions, enables data stream inspection instead of packet-by-packet inspection, detect abnormal network behavior

Question 45

Common DLLs that run in every process cannot be infected.

Accepted Answer

False

Question 46

What is an advantage of Clonezilla over other capture tools?

Accepted Answer

ability to maintain images apart from the local system

Question 47

If a hacker retains access to a system even after it restarts or entry credentials were changed, this would be what?

Accepted Answer

Persistence

Question 48

What is true about UPX? (3 answers)

Accepted Answer

can analyze the malware code with a reverse engineering tool, is automatic and pre-built in the Kali Linux distribution, possible to use the command line within the tool to unpack the malware code

Question 49

What is not a NIST Lifecycle?

Accepted Answer

Detection & Identification

Question 50

What is true about Cuckoo? (3 answers)

Accepted Answer

automatically runs and analyzes files while running in an isolated OS, an open-source automated malware sandbox platform, receives a sample as input & provides a report with all system changes

Question 51

What data carving tool, ignores the file system structure, to process different parts of a disk in parallel?

Accepted Answer

Bulk Extractor

Question 52

What is the Digital Forensics process?

Accepted Answer

Collection, Examination, Analysis, Reporting

Question 53

If you only could choose HxD or Autopsy for a data carving project, you would choose HxD.

Accepted Answer

False

Question 54

What is not an Anti-Forensics Technique (obfuscation)?

Accepted Answer

Blindsiding

Question 55

What is the Chief Information Security Officer (CISO) responsible for? (3 answers)

Accepted Answer

any other security-related function associated w/IR, the overall security program, cyber risk management to vulnerability management

Question 56

What tools can help locate persistent malware? (2 answers)

Accepted Answer

Autorun.inf, Autoruns

Question 57

The process of obtaining deleted files and metadata in data streams is referred to as what?

Accepted Answer

file carving

Question 58

Volatility Framework is an open-source collection of Python-based tools that support only Windows.

Accepted Answer

False

Question 59

What flag does Tcpdump not support?

Accepted Answer

-$ [snaplen]

Question 60

What TCPdump tool makes it possible to capture traffic in an environment w/o IDS and replay it in an environment w/IDS?

Accepted Answer

Tcpreplay

Question 61

What is true about Resource Hacker? (2 answers)

Accepted Answer

provides an analysis of .rsrc and extracts the information, enables the viewing and editing of all resources in executables

Question 62

What Linux file system is considered a space-efficient file system, as it supports compression and snapshots?

Accepted Answer

Btrfs

Duplicate of DFIR Final Exam Prep

Questions 62

Duplicate of DFIR Final Exam Prep

Questions 62