23 Flashcards
Which of the following answers refers to an anti-malware tool that enables automated analysis of suspicious files in a sandbox environment?
** Cuckoo **
Cuckoo Sandbox is the leading open source automated malware analysis system
A Linux command that allows to display the beginning of a file (by default its first 10 lines) is known as:
** head **
the head command will output the first part of the file
Which of the following commands in Linux displays the last part (by default its 10 last lines) of a file?
** Tail **
the tail command will print the last part of the file
A Linux command that allows to create, view, and concatenate files is called:
cat
A Linux command-line command that enables searching files for lines containing a match to a given text pattern is called
grep
What is the function of the Linux chmod command?
Changes file/directory access permissions
Which of the following commands enables adding messages to the /var/log/syslog file in Linux?
Logger
A type of extended command-line shell and a scripting language designed to simplify administrative tasks in Microsoft Windows is known as
Windows PowerShell
Which of the following answers refers to a cross-platform, general-purpose programming language?
Python
Which of the following answers refers to a software library used to implement encrypted connections?
OpenSSL
Which of the following answers refers to a Command-Line Interface (CLI) packet-crafting tool?
Tcpreplay
Which of the following tools enables sending custom packets that can be used to evaluate the security of a network device?
Tcpreplay
Which of the following is a Command-Line Interface (CLI) packet-capturing tool used in Unix-like operating systems?
tcpdump
Which of the following answers refers to an advanced cross-platform packet-capturing tool equipped with a Graphical User Interface (GUI)?
WireShark
A Linux command-line utility that can be used in the forensic process for creating and copying image files is called:
** dd **
dd (Data Dump)
Which of the following forensic utilities enables the extraction of RAM contents?
Memdump
Which of the following answers refers to a multi-function disk and binary data editor used for low-level data processing, data recovery, and digital forensics?
** WinHex **
WinHex is a commercial disk editor and universal hexadecimal editor used for data recovery and digital forensics
Which of the following answers refers to a tool for creating forensic images of computer data?
FTK imager
FTK® Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as Forensic Toolkit (FTK®) is warranted.
Which of the following answers refers to an open-source forensics platform that allows to examine the contents of a hard drive or mobile device and recover evidence from it?
** Autopsy **
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools
What is Metasploit?
Exploitation framework
Examples of password-cracking utilities include: (Select 2 answers)
- John the Ripper
- Cain & Abel
One of the ways to prevent data recovery from a hard drive is to overwrite its contents. The data overwriting technique is used by drive wipe utilities which might employ different methods (including multiple overwriting rounds) to decrease the likelihood of data retrieval. As an example, a disk sanitization utility might overwrite the data on the drive with the value of one in the first pass, change that value to zero in the second pass, and finally perform five more passes, overwriting the contents with random characters (the Schneier method).
True
A globally accessible knowledge base of Adversary Tactics, Techniques, and Procedures (TTPs) based on observations from real-world attacks is known as:
** MITRE ATT&CK **
The Adversarial Tactics, Techniques, and Common Knowledge or MITRE ATT&CK is a guideline for classifying and describing cyberattacks and intrusions.
Which of the following answers refers to a methodology framework for intrusion analysis developed by U.S. government intelligence community?
** The Diamond Model of Intrusion Analysis **
The purpose of the Diamond Model is to assist analysts in identifying a group of events that occurred on their systems. These occurrences can then be grouped together in time to form “activity threads,” which can be compared to detect attacker campaigns.
Which of the following answers refers to a 7-step military model adopted by Lockheed Martin to identify the phases of a cyberattack?
** Cyber Kill Chain **
The Cyber Kill Chain is divided into seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives
