Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CHFI > CHFI > Flashcards

CHFI Flashcards

1
Q

What is computer forensics?

A

A set of methodological procedures and techniques to identify, gather, preserve, extract, interpret, document, and present evidence from computing equipment that is acceptable in a court of law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is cybercrime?

A

Any illegal act involving a computing device, network, its systems, or its applications. Categorized into:
internal - Attack performed by an entrusted person who has authorized access to the network
external - An attacker from outside the organization exploits security loopholes or uses social engineering to infiltrate the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the different approaches to investigating cybercrime?

A

Civil, criminal, and administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why are computer crimes challenging?

A

Due to their speed, anonymity, volatile nature of evidence, global origin and differences in laws, and limited legal understanding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is digital evidence?

A

Any information of a probative value that is either stored or transmitted in a digital form. Comes in two forms:
volatile - Lost as soon as the device is powered off, such as system time, logged-on users, open files, memory, clipboard contents, command history
non-volatile - Data stored on secondary storage, such as hard disks. Includes hidden files, slack space, unallocated clusters, hidden partitions, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is forensic readiness?

A

an organization’s ability to optimally use digital evidence in a limited period of time and with minimal investigation costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 5 rules of evidence?

A

1: Evidence must be clear and understandable to the judges
2: Evidence must be related to the fact being proved
3: Evidence must be real and appropriately related to the incident
4: There must be no doubt about the authenticity or veracity of the evidence
5: The evidence must prove the attacker’s actions or his/her innocence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Describe a civil investigation

A

Investigators show the opposite party some proof to support the claims and induce settlement.
Search is based on mutual understanding and provides wider window to hide evidence.
More informal.
Claimant responsible for collection and analysis of evidence.
Punishment is typically monetary.
Sometimes evidence can be in third-party control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe a criminal investigation

A

Set of standard forensic processes must be followed as accepted by law
Computing devices may be forcibly seized under warrant
Formal report required
Law enforcement agencies responsible for collecting and analyzing evidence
Punishment includes fines, jail, or both
High standard of proof
Difficult to capture certain evidence, such as GPS device evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe an administrative investigation

A

Generally involve an agency or government performing inquiries to identify facts
Non-criminal in nature
Related to misconduct or activities of an employee that include violation of orgs policies, rules, etc.; resource misuse or damage or theft, threatening or violent behaviour, improper promotion or pay raise
Any violation may result in disciplinary action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the best evidence rule?

A

the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy. However, a duplicate may be accepted if the reasons for duplication are genuine. Essentially, the original evidence is considered as the best evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is federal rule 1001 of evidence?

A

1001 includes definitions of writings and recordings, photographs, original evidence, and duplicate evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe federal rule 1002 of evidence

A

To prove the content of a writing, recording, or photograph, the original writing, recording, or photograph is required, except as otherwise provided in these rules or by an Act of Congress

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe federal rule 1003

A

A duplicate is admissible to the same extent as an original unless:
a genuine question is raised as to the authenticity of the original or:
In the circumstances it would be unfair to admit the duplicate in lieu of the original

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe federal rule 1004

A 
The original is not required and other evidence of the contents of writing, recording, or photograph is admissible if:
OGs are lost or destroyed;
OGs not obtainable
OG is in possession of the opponent
Collateral matters
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the steps to the forensic investigation process?

A
  1. Examination/Investigation goals
  2. Hypothesis Formulation / Criteria
  3. Experimental Design
  4. Tool Selection
  5. Results Review and Evaluation
  6. Conclusion and Opinion Formulation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some considerations that must be made when setting up a computer forensics lab?

A
  1. Planning and budgeting
  2. Physical and Structural design (size, HVAC, access, etc.)
  3. Work Area (ambience, lighting, internet, etc.)
  4. Physical security (intrusion alarm, fire suppression, etc.)
  5. Human resource (required personnel, training and certs)
  6. Forensics lab licensing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some considerations when building the investigation team?

A
  • Keep team small to protect confidentiality
  • ID team members and assign responsibilities
  • Ensure everyone has proper clearance and authorization
  • Assign one member as technical lead
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the steps to ensuring QA in Forensic Lab ops?

A
  1. Arrange formal, documented trainings
  2. Validate equipment and document it
  3. Conduct annual proficiency tests
  4. Follow standards and/or controls in casework
  5. Have policies and procedures in place
  6. Attain accreditation
  7. Perform quality audits and management system review
  8. Ensure physical security
  9. Assure health and safety
  10. Review, update, and document policy standards annually
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the first response role for non-forensics staff?

A

protect the crime scene and ensure it remains secure
Make notes and take photographs
Secure surrounding area linked to the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the first response role for system/network admins?

A
  • Report incident according to organizational incident reporting procedures
  • DO NOT perform actions unless directed to do so by forensics team
  • May record what is on screen if computer is on, transfer copies of logs to clean media, isolate the system, or document every detail relevant to the incident
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the first response role for Lab forensics staff?

A
  1. Document the electronic crime scene
  2. Collect incident information
  3. Plan search and seizure
  4. Identify and collect electronic evidence
  5. Package electronic evidence
  6. Transport Electronic evidence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are best practices when dealing with powered-on computers?

A
  1. Photograph the screen and document running programs, open files, or data
  2. Pull the power cord immediately IF: Indication of data being overwritten/deleted; destructive processes observed
  3. Do NOT disconnect power If: evidential data visible on display; there are active programs or files in use such as chatrooms, open text files, etc.
  4. Perform volatile data collection and preservation process
  5. after collecting volatile data, pull plug from back of computer
  6. For portable computers, remove battery and unplug. If battery removal not possible, press power switch for 30 seconds
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are best practices for dealing with powered-off computers

A
  1. Leave it OFF
  2. Disassemble and package it (remove power supply cord; disconnect all wires and cables; check for removable media and secure it; tag evidence; document chain of custody)
  3. If monitor is off, turn it on and move mouse slightly. Photograph screen
  4. do not press any keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the best practices for dealing with networked computers?

A
  1. Unplug network cable
  2. Photograph all devices connected to the victim computer, such as router, modem, printer, etc.
  3. If computer is off, leave it off
  4. If computer is on, photograph screen and follow powered-on procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are best practices when dealing with mobile devices?

A
  1. Photograph screen’s display
  2. Do no turn device on if it is off
  3. Leave device as is if it is on and keep it charged
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are Lost Clusters?

A

when an OS marks clusters of a disk as used but does not allocate them to a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is slack space?

A

the storage area of a disk between the end of a file and teh end of a cluster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is MBR?

A

Master Boot Record. The first sector (sector 0) of a disk. Contains information regarding files on the disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is disk partitioning?

A

creation of logical divisions on a storage device, allowing for OS-specific logical formatting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is BPB?

A

BIOS parameter block. Describes the physical layout of the data storage volume. May also define filesystem structure. Can help investigators locate the file table on the hard drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is GUID?

A

Globally unique identifier. A 128-bit unique reference number used in computer software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What happens during the boot process?

A

OS is loaded from the hard disk to the RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is RAID 0?

A

Striping only, no redundancy. Min 2 drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is RAID 1?

A

Mirroring only. Requires even number of drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is RAID 2?

A

Bit-level striping. Better data-integrity, but slower than RAID 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is RAID 3?

A

Byte-level striping and dedicated parity disk. Requires at least 3 drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is RAID 5?

A

Byte-level striping and distributed parity among drives. Data writing is slow. Min 3 drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is RAID 10?

A

Combo of 0 and 1. Min 4 drives. Includes fault tolerance of RAID 1 and includes redundancy through mirroring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is RAID 6?

A

Double parity RAID. Data striped across multiple drives and uses dual parity for better redundancy than RAID 5. Min 4 drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is disk spanning?

A

Combining multiple disks into one large logical drive (JBOD, used when disks don’t support RAID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is hexadecimal?

A

Base 16 numeral system. 0-9 represents 0-9, and A-F represents 10-15

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How do you convert hex to binary?

A

take each digit in the hex and make it into a 4-digit binary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How do you convert hex to decimal?

A

each digit from right to left is the represented number * 16^the digit’s position, starting w/ 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How do you convert binary to decimal?

A

each digit from right to left is the number * 2^ the digit’s position, starting w/ 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the 2 types of data acquisition?

A

Live: collect data from system powered ON
Dead: collect data from system powered OFF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is involved w/ live acquisition?

A

collection from volatile sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is a typical order of volatility, from most to least volatile?

A
  1. Registers and cache
  2. Routing table, process table, memory
  3. Temporary system files
  4. Disk
  5. Remote logging and monitoring data
  6. Physical configuration and network topology
  7. Archival media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the rules of thumb for data acquisition?

A
  1. Do not work on the original digital evidence
  2. Produce 2 or more copies of the original media
  3. Use clean media to store the copies
  4. Verify integrity of copies with the original
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is logical acquisition?

A

Capturing only selected files or file types of interest for the case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is sparse acquisition?

A

similar to logical acquisition, but additionally collects fragments of unallocated data, allowing the acquisition of deleted files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the data acquisition steps?

A
  1. Determine data acquisition method
  2. Select the acquisition tool
  3. Sanitize target media
  4. If computer is on, acquire volatile data and turn off computer
  5. Remove hard disk
  6. Write protect the device
  7. Acquire non-volatile data
  8. Plan for contingency
  9. Validate data acquisition
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are key requirements for a data acquisition tool?

A
  1. Should not change original content
  2. should log I/O errors
  3. Should pass scientific and peer review
  4. Should alert if source is larger than destination
  5. Should create a bit-stream copy of content
  6. Should create qualified bit-stream copy if I/O errors occur
  7. should document content of destination that is not part of the copy
  8. Should contain correct documentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are common standards for sanitizing media?

A 
GOST P50739-95 (russian)
VSITR (german)
NAVSO P-5239-26 (US)
DoD 5220.22-M (US)
NIST SP 800-88 (US)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

what is anti-forensics?

A

counter forensics. techniques aimed at complicating or preventing proper forensics investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are some common anti-forensics techniques?

A 
data/file deletion
password protection
steganography
data hiding in file systems
trail obfuscation
artifact wiping
overwriting data/metadata
encryption
program packers
minimizing footprint
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is ADS?

A

alternate data stream. allows data to be hidden in windows NTFS and cannot be revealed using command line or windows explorer.
Does not change file size, functionality, etc. except file date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the first step when investigating an incident?

A

Collect system time - exact date and time an incident happened in UTC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What utility is used to collect all open files on windows?

A

NetworkOpenedFiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What command line utility is used to collect network information?

A

nbtstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What command line utility is used to collect info about network connections?

A

netstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What command line utility is used to maps the port used by a process?

A

netstat -a -n -o

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What command is used to recall a history of commands entered in cmd?

A

doskey /history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What command allows for examination of time/date of OS installation, service packs, patches, and sub directories that auto-update?

A

dir /o:d

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What tool can be used to examine slack space?

A

DriveSpy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What tool is used to examine crash dump file?

A

DumpChk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What tool dumps the memory of running processes?

A

pd.exe, Userdump.exe, or adplus.vbs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is redline?

A

security tool to identify malicious activity through memory and helps establish the timeline and scope of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are the volatile portions of Windows Registry?

A

HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_CURRENT_CONFIG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What are the non-volatile portions of Windows Registry?

A

HKEY_LOCAL_MACHINE,

HKEY_USERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Where can you look to see additional shares created via net share?

A

HKEY_LOCAL_MACHINE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Where does Windows store a list of connected SSIDs?

A

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\GUID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What utility can be used to investigate programs configured to run during system bootup or login?

A

Autoruns utility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What tools can be used to examine metadata present in a JPEG?

A 
Exiv2, IrfanView, or Image::MetaData::JEPG Perl module
Metashield Analyzer (online)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What are shellbags?

A

set of registry keys which record viewing preferences of folders for a users. provides evidence related to folders accessed by a user. Includes directories which have been removed, such as previously mounted drives, deleted files, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is a LNK file?

A

a Windows shortcut file that points to an application or an executable file and has the .lnk extension.
stored in C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent
Can provide metadata on when files are accessed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What are the different types of logon events?

A

2: Interactive (user logged on)
3: Network (logged on from network)
4: Batch
5: Service (service started by service control manager)
7: Unlock
8: NetworkCleartext (logged on from network, PW passed unhashed)
9: NewCredentials (cloned current token and specified new credentials for outbound connections
10: RemoteInteractive (User logged on remotely)
11: CachedInteractive (user logged on with cached network credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What are some indicators of compromise for network security intrusions?

A

Unusual outbound network traffic
Uniform Resource Locators (URLs): Malicious URLs
User-agent strings
Log-in anomalies
Increased number of requests for same file
Network traffic traversing unusual ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What are the types of network-based evidence?

A

Full Content Data: actual packets collected. can be analyzed with tcpdump or Wireshark
Session Data: A summary of conversation between two network entities. Includes destination IP/port, source IP/port, convo times, and amount of info exchanged
Alert Data: Triggered by tools like Snort IDS and Suricata. Must be careful to avoid false positives
Statistical Data: Overall profile or summaries of network traffic. Includes timestamps, protocols and services being used, average packet size, and packet rate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What needs to be kept in mind while creating/storing logs for legal admissibility?

A
  1. Logs must be created consistently with event under investigation
  2. Logs must be stored in secure location
  3. Logs must be maintained as routine business practice
  4. Random compilations of data are not permissible
  5. Logs instituted after commencement of incident do not qualify under business records exception
  6. Maintain logs regularly to use them as evidence later
  7. Custodian must testify accuracy and integrity of logs
  8. Custodian must testify as to reliability and integrity of hardware and software platform used, including logging software
  9. A record of failure/security breach on machine making logs leads to log impeachment
  10. If investigator claims machine is penetrated, logs are inherently suspect
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What are some guidelines to ensure log file credibility and usability?

A
  1. Log everything
  2. Synchronze Time
  3. Use Multiple Sensors
  4. Missing Logs (continuously monitor for missing logs)
  5. Ensure System’s Integrity
  6. Control access to the log
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are some best practices for centralized logging?

A
  • Ensure logging is enabled on all devices
  • Admin able to xfer authorization to security personnel
  • Consult legal dept when developing policies
  • Ensure safe transmission/storage of logs
  • Collect appropriate logs
  • Data must be readily accessible when investigating
  • Authentication/security must not be compromised in making data available
  • Maintain consistent structure for logs
  • Set severity levels for alerts
  • Indexing and storing of incident logs must be considered mandatory
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What are the two types of event correlation?

A

Same-platform correlation: used when one common OS is used throughout the network
Cross-platform correlation: used when different OS and network hardware platforms are used in the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What are the 3 main prerequisites of event correlation?

A

Transmission of data: securely transmitting data to a consolidation point
Normalization: after gathering data, it must be formatting to a single consistent format for the database
Data Reduction: remove unnecessary data, such as repeated data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What is the graph-based correlation approach?

A

Construct a graph with the system components as nodes and dependencies between these components as edges

86
Q

What is the Neural Network-based correlation approach?

A

use neural network to detect anomalies in the event stream, root causes of fault events, etc.

87
Q

What is the Codebook-based correlation approach?

A

Use a codebook to store a set of events and correlate them

88
Q

What is the rule-based correlation approach?

A

Events correlated according to a set of rules

89
Q

What is the field-based correlation approach?

A

Basic approach where specific events are compared with single or multiple fields in normalized data

90
Q

What is the automated field correlation approach?

A

Checks and compares all fields systematically for positive and negative correlation

91
Q

What is the Packet parameter/payload correlation approach?

A

Used for correlating particular packets with other packets. Can produce a list of potential new attacks by comparing packets with attack signatures

92
Q

What is the profile/fingerprint-based correlation approach?

A

Series of data sets gathered from forensic event data is used to ID whether a system serves as a relay to a hacker or is a formerly compromised host, and to detect the same hacker from different locations

93
Q

What is the vulnerability-based correlation approach?

A

Used to map IDS events that target a particular vulnerable host. Also used to deduce an attack on a particular host in advance and prioritize attack data so you can respond to trouble spots quickly

94
Q

What is open-port-based correlation approach?

A

Determine the rate of successful attacks by comparing the list of open ports available on the host with those under attack

95
Q

What is the bayesian correlation approach?

A

advanced correlation approach that predicts what an attacker can do next after the attack by studying the stats and probability theory, using only 2 variables

96
Q

What is the time or role-based correlation approach?

A

Used to monitor the behaviour of computers and their users and trigger alerts wen anomalies are found

97
Q

What is the route correlation approach?

A

Used to extract information on the attack route and use it to single out other attack data

98
Q

What are some indicators of a web attack?

A
  1. Customers being unable to access services
  2. Suspicious activities in user accounts
  3. Leakage of sensitive data
  4. URLs redirecting to incorrect sites
  5. Web page defacements
  6. Unusually slow network performance
  7. Frequent rebooting of the server
  8. Anomalies in log files
  9. Error messages
99
Q

What is snort?

A

open-source network IDS capable of performing real-time traffic analysis and packet logging on IP networks
used to detect a variety of web app attacks and probes

100
Q

At what OSI level does a web application firewall function?

101
Q

What are some benefits of a WAF?

A

secures web apps
acts as reverse proxy between client and web server
real-time alerting and logging
provides cookie protection

102
Q

What are some limitations of WAF?

A

not a replacement for proper app security such as input validation and user auth
WAF inspects traffic based on a particular protocol only
cannot read database commands
does not ensure security from false positives

103
Q

what is ModSecurity?

A 
free, cross-platform WAF module supported by Nginx, Apache, and IIS
allows real-time HTTP traffic monitoring, logging, and analysis
104
Q

Where should you look for SQL injection attack incidents?

A

IDS log files
Web server log files
WAF log files
SIEM-triggered alerts

105
Q

What are some obfuscation methods used in SQL injection attacks?

A

In-line comments: attackers use in-line comments in the middle of attack strings “/* */” for comments
Char encoding/double encoding
Toggle case: alternating case such as “UnIoN/**/SeLecT”
Replaced Keywords: “UNunionION+SEselectLECT”
White space manipulation: using %0b to eliminate white space “uni%0bon+se%0blect”

106
Q

What encoding can be used to obfuscate directory traversal attacks?

A

%2e%2e%2f (URI encoded)
%252e%252e%252f (URI double encoded)
..%c0%af (unicode/UTF-8 encoded)

107
Q

What operators can be used in an input string to ask the command line to execute the command provided?

108
Q

What are some examples of volatile database data?

A

user login sessions, user transactions

109
Q

Which MySQL utility program is used to dump single or multiple databases for backup purposes?

110
Q

Which MySQL utility program is used to check the access privileges defined for a hostname or username?

A

Mysqlaccess

111
Q

Which MySQL utility program is used to process the MyISAM log file and perform recovery operation, display version information, etc?

112
Q

Which MySQL utility program is used to obtain the status of the MyISAM table, identify the corrupted tables, repair the corrupted tables, etc.?

113
Q

Which MySQL utility program is used to display the content of bin logs (mysql-bin.nnnnnn) in text format?

A

Mysqlbinlog

114
Q

Which MySQL utility program is used to export metadata, data, or both from one or more databases?

A

mysqldbexport

115
Q

What are the 3 types of data files MSSQL server stores data and logs in?

A

Primary data files (MDF)
secondary data files (NDF)
transaction log data files (LDF)

116
Q

What are the 3 types of cloud crimes?

A

Cloud as a subject: crime committed within the cloud environment
Cloud as an object: cloud provider is target of the crime
Cloud as tool: cloud is used to plan and commit the crime

117
Q

What are some architecture challenges with cloud forensics?

A

Deletion in the cloud: limited number of backups, and retrieval may not be implemented for IaaS or PaaS models
Recovering overwritten data: When data is deleted, other shared users may overwrite the data
Interoperability issues: lack of interoperability between CSPs and lack of control from consumer
Single point of failure: cloud ecosystem has single points of failure, impacting evidence acquisition

118
Q

What are some collection challenges with cloud forensics?

A

Decreased access and data control: investigator has limited access and control of forensic data
Chain of dependencies: CSPs often rely on other CSPs, so cloud investigation may depend on examining each link in the chain
Locating evidence: locating/collecting is difficult as data may be quickly altered or lost with limited knowledge regarding where or how it is stored
Data location: data may be stored in different data centers or geographic regions
Imaging and isolating data: difficult due to cloud elasticity, automatic provisioning, redundancy, and multi-tenancy

119
Q

What are some log challenges with cloud forensics?

A

Decentralization of logs: logs not stored in any single log server
Evaporation of logs: some cloud logs are volatile, as in with VMs
Multiple layers/tiers: logs generated for each tier in cloud architecture, making collection difficult
Less evidentiary value: not all logs provide crucial information

120
Q

What are some legal challenges with cloud forensics?

A

Missing terms in contract or SLA: can prevent generation and collection of existing data
Limited investigative power: investigators often provided with limited power in civil cases
Reliance on cloud providers: cooperation from CSPs may be limited by the number of employees and other resources
Physical data location: hard to specify physical location of data on a subpoena
Port protection: scanning ports is difficult because CSPs do not provide access to physical infrastructure
Transfer protocol: dumping TCP/IP network traffic is challenging–CSPs do not provide access to physical infrastructure
E-discover: response time is challenging due to ambiguity of data location and uncertainty of relevant data

121
Q

What are some analysis challenges with cloud forensics?

A

Evidence correlation: correlation across multiple CSPs is challenging
Reconstructing virtual storage
Timestamp synchronization: timestamps may be inconsistent between different sources
Log format unification: unification/conversion is difficult due to different formats/amount of resources, may also result in loss of critical data. may also have to deal with proprietary formats
Use of metadata: using metadata as authentication may cause common fields (creation date, modified date, etc.) to change when data is xfered from cloud or during collection
Log capture: log data collection methods differ for each CSP

122
Q

What are the forensic acquisition and analysis steps for an EC2 instances in AWS?

A
  1. Isolate the compromised EC2 instance
  2. Take a snapshot of the instance
  3. Provision and launch a forensic workstation
  4. Create evidence volume from the snapshot
  5. Attach the evidence volume to the forensic workstation
  6. Mount the evidence volume onto the workstation
123
Q

What are the 4 types of data replication services in Azure?

A

Locally redundant storage (LRS): copies storage data 3 times in a single physical location in the primary region
Zone-redundant storage (ZRS): copies data in 3 availability zones within a primary region
Geo-redundant storage (GRS): replicates data 3 times synchronously within a single physical location, then copies it asynchronously to a single location in a secondary region
Geo-zone-redundant storage (GZRS) copies data in 3 availability zones in primary region synchronously, then copies asynchronously to single location in secondary region

124
Q

What are the steps for forensic acquistiion of VMs in Azure?

A
  1. Create a snapshot of the SO disk of suspect VM via Azure portal
  2. Copy the snapshot to a storage account under different resource group
  3. Delete snapshot from source resource group and create backup copy
    4 .Mount snapshot on forensic workstation
125
Q

What is a container?

A

piece of software bundled with app code and all dependencies that helps the app run on any computing environment/infrastructure
Can run as isolated, independent processes by sharing the OS kernel

126
Q

What are microservices?

A

architectural framework in app development in which all core functions in an app are built and deployed independently as a service

127
Q

What are some challenges of forensics on containers?

A

Highly dynamic
Microservices: security team must look into multiple containers with multiple microservices, making process complex
Ephemeral in nature: lightweight and short lifecycle. data written to filesystem of containers gets deleted as soon as it’s stopped
No snapshot feature: cannot snapshot containers

128
Q

What are the steps to investigate email crimes?

A
  1. Seize the computer and email accounts
  2. Acquire email data.
  3. Examine email messages.
  4. Retrieve email headers.
  5. Analyze email headers.
  6. Recover deleted email messages.
129
Q

What is involved with step 1 of email crime investigation?

A

obtain search warrant including permission for on-site examination of suspect’s computer and email server used
seize all computers and email accounts suspected
can seize email account by changing existing password

130
Q

What tools can be used to check the validity of an email address?

A

Email Dossier
Email Address Verifier
Email Checker
G-Lock Software Email Verifier

131
Q

What are the different things to check when investigating a suspicious email?

A
  1. Email message: inspect body thoroughly looking for suspicious links or attachments. Also may have false sense of urgency.
  2. Links: Run links through forensic machines (or mouse over to see link BUT DON’T CLICK) to find suspect links
  3. Received header entries: find email ID and IP address of attacker
  4. Originating IP address: find general geographic area
  5. Received-SPF field: validation failure can indicate spoofing (sender does not permit the server to send mail on its behalf)
  6. Sender’s email validity
  7. Message ID (FQDN should typically be something like gmail or outlook.com, not localhost or other…)
  8. Return path: should match sender’s email
132
Q

What tool can be used to recover deleted email messages?

A

Paraben’s Electronic Evidence Examiner

133
Q

Which US Law sets rules for sending emails for commercial purposes, establishes min reqs for commercial messaging, gives recipients of emails the right to ask sender to stop emailing them, and spells out penalties for violation?

A

CAN-SPAM Act

Penalties up to $16,000

134
Q

With regards to malware, what is a crypter?

A

Software that disguises malware as legitimate product through encryption or obfuscation

135
Q

With regards to malware, what is a downloader?

A

type of trojan that downloads other malware

136
Q

With regards to malware, what is a dropper?

A

Type of trojan that installs other malware files either from a malware package or the internet

137
Q

With regards to malware, what is an exploit?

A

malicious code that breaches the system security via software vulnerabilities

138
Q

With regards to malware, what is an injector?

A

program that injects its code into other vulnerable running processes and changes the way of execution to hide

139
Q

With regards to malware, what is an obfuscator?

A

program that conceals its code and intended purpose

140
Q

With regards to malware, what is a packer?

A

program that allows to bundle all files together into a single executable file to bypass security detection

141
Q

With regards to malware, what is a payload?

A

piece of software that allows control of computer system after exploit

142
Q

With regards to malware, what is malicious code

A

command that defines malware’s basic functionalities such as stealing data or creating back door

143
Q

With regards to malware, what is fileless malware?

A

group of malware that do not write any file to the disk and use only approved Windows tools for installation and execution, thus circumventing security and whitelisting processes

144
Q

What are some challenges with malware analysis?

A

accuracy of analysis process
Detection of malware pieces and traits
amount of data to analyze
changing technologies and dynamics of malware
anti-analysis procedures such as encryption, obfuscation, deletion, etc

145
Q

What tools can be used to extract patterns from malicious files?

A

balbuzard and cryptam malware document detection suite

146
Q

What should be done to prepare a testbed for malware analysis?

A

isolate system from network by setting NIC card to “host only” mode
disable “shared folders” and “guest isolation”
generate hash value of each OS and tool

147
Q

What are some OS backup and imaging tools?

A

Genie backup manager pro
macrium reflect server
R-Drive Image
O&O DiskImage 16

148
Q

What are some network and internet simulation tools?

A

NetSim
ns-3
Riverbed Modeler
QualNet

149
Q

What are some Hypervisors?

A 
Virtual Box (Windows, Linux, Mac, Solaris)
Parallels Desktop (Mac)
WMware vSphere (Bare metal)
150
Q

What are some online malware analysis services?

A 
Any.Run
Hybrid Analysis
Kaspersky Threat Intelligence Portal
Valkyrie
Virus Total
151
Q

What is Windows Event ID 4688?

A

A new process has been created

152
Q

What is Windows Event ID 5156?

A

Windows Filtering Platform has allowed connection (outbound network connection)

153
Q

What is Windows Event ID 7045?

A

Service was installed in the system

154
Q

What is Windows Event ID 4657?

A

Registry value was modified

155
Q

What is Windows Event ID 4660?

A

Object was deleted (such as account name, domain, process ID, etc.)

156
Q

What is Windows Event ID 4663?

A

An attempt was made to access an object

157
Q

What is Windows Event ID 7036?

A

Windows Protection Service has entered the stopped state

158
Q

What is Windows Event ID 7040?

A

The start of Windows Protection Service was changed from autostart to demand start/auto start disabled

159
Q

What tool can be used to intercept API calls made by the malware to Windows API during runtime?

A

API Monitor

160
Q

What tool can be used to check integrity of files?

A

FastSum - computes checksums according to MD5 checksum algorithm

161
Q

What windows utility tool can be used to compute MD5 hashes of files?

A

WinMD5 - fingerprints can be used to ensure file is uncorrupted

162
Q

What tools can be used to monitor ports?

A

TCPView (all TCP/UDP endpoints and state of TCP connections)

Currports (all currently open TCP/IP and UDP ports)

163
Q

What are the 3 boot modes for iOS?

A

Normal
Direct Firmware Upgrade (DFU): allows investigators to obtain device info w/o entering passcode or bypassing USB restriction mode
Recovery mode: used to upgrade the device to a signed firmware version using iTunes by invoking the iBoot process

164
Q

How is an iPhone booed into DFU mode?

A
  1. Connect iPhone to computer with USB cable
  2. Press and hold Home and Lock buttons (A9), press and hold Side and Volume Down buttons (A10), or quick press and release volume up then quick press volume down (A11+)
  3. Continue to hold for 8 seconds then release Lock or Side button (A9/10), OR press and hold side button until screen goes black (A11+)
    4 (only A11+) continue holding side button and press volume down for 5s then release side button
    5 (only A11+). release volume down after 10 seconds
  4. screen remains black in DFU mode
165
Q

what type of data does a SIM contain?

A

volatile AND nonvolatile

166
Q

What are the 4 types of iOS jailbreaks?

A

tethered: cannot be rebooted w/o a computer. must re-jailbreak every time
untethered: can reboot w/o computer, jailbreak is automatic
semi-tethered: can reboot device, but jailbreak features are not loaded
semi-untethered: boots into non-jailbroken state but can be re-jailbroken using an app vs computer

167
Q

What are some commercial tools that can be used for physical acquisition (bit-by-bit copies) of physical storage on mobile?

A

Cellebrite, MOBILedit, Elcomsoft

168
Q

In mobile forensics, what are TAPs

A

Test Access Ports. Testing ports on devices that allow manufacturers to test devices. Can be used to instruct the processor to transfer all data stored in the memory chips

169
Q

What is chip-off forensics?

A

physically removing the flash memory of a device for analysis. useful for locked devices or damaged/dismantled devices

170
Q

What are some challenges in mobile forensics?

A

OS: Mobile devices use various OSes that are all handled differently
Security: security features protect the data and privacy making acquisition difficult
Cloud Data: acquiring cloud data often has legal constraints and is difficult
Data Preservation: device needs to be isolated from all communications to prevent remote wiping
Anti-forensics: data hiding, forgery, and secure wiping complicate the investigation process

171
Q

What are some common security problems with IoT devices?

A

Application: validation of input strings, AuthN, AuthZ, no auto-security updates, default passwords
Network: firewall, improper comm encryption, services, lack of auto update
Mobile: insecure API, lack of comm encryption, authentication, lack of storage security
Cloud: improper authentication, no storage/comm encryption, insecure web interface

172
Q

What are the OWASP top 10 IoT vulnerabilities?

A
  1. Weak or guessable passwords
  2. Insecure network services
  3. Insecure ecosystem interfaces
  4. lack of secure update mechanism
  5. Use of insecure or outdated components
  6. Insufficient privacy protection
  7. Insecure data xfer or storage
  8. Lack of device management
  9. Insecure default settings
  10. Lack of physical hardening
173
Q

What are some common IoT device attacks?

A

sybil attack: multiple forged identities used to create strong illusion of traffic congestion (used in vehicular ad hoc networks)
forged malicious device: replace authentic IoT device with malicious device
side channel attack: extract information about encryption keys by observing emission signals

174
Q

what are common IoT forensics challenges?

A

ID, collection, and preservation of evidence: most devices work autonomously, so identification can be difficiult.
Analysis of evidence: most data is cloud based
autonomous nature: due to this function, it may be difficult to identify whether human intervention or design flaw caused the malfunction

175
Q

Where is stego data hidden in a text file?

A

character positions.

detected by looking for text patterns or disturbances, blank spaces, etc.

176
Q

Where is stego data hidden in an image file?

A

changes in size, file format, metadata, and color palette

detected through statistical analysis

177
Q

Where is stego data hidden in an audio file?

A

inaudible frequencies or odd distortions and patterns in audio graph

178
Q

Where is stego data hidden in a video file?

A

combo of image and audio

179
Q

What is file carving?

A

technique to recover files and fragments of files from a hard disk in the absence of file system metadata

180
Q

What tools can be used to look at file headers to verify the file format?

A 
010 Editor
CI Hex Viewer
Hexinator
Hex Editor Neo
Qiew
WinHex
181
Q

What are the different types of search warrants?

A

Search warrant: written order authorizing search for particular evidence in particular location. include particulars of the object and devices being searched as well as the strategy used to investigate
Electronic storage search warrant: allows team to search and seize components including hardware, software, storage devices, documents
Service provider search warrant: allows investigators to consult w/ service provider to get: service records, billing records, subscriber info

182
Q

When is seizure without a warrant allowed?

A

when destruction of evidence is imminent

183
Q

where are IIS Logs located?

A

%SystemDrive%\inetpub\logs\LogFiles

184
Q

What are the 2 outlook file formats?

A

.ost - used by non-POP accounts - cached storage

.pst - used by POP accounts - actual storage

185
Q

What TSK command is used to odisplay general details of a file system?

186
Q

What TSK command is used to display the details of a metadata structure?

187
Q

What TSK command is used to display the file and directory names in a disk?

188
Q

What TSK command is used to display the details of an image file?

189
Q

What are the two components of an Apache Web Server?

A

Apache Core: basic functionalities such as allocation of requests and connection maintenance
Apache Modules: Add-ons used for extending core functionality

190
Q

What are the elements of the Apache core component?

A

http_protocol: responsible for managing routines
http_main: handles server startup and timeouts as well as main server loop
http_request: controls stepwise procedure followed among modules to complete client request as well as error handling
http_core: Includes a header file thaht is not required by the app module
Alloc.c: handles allocation of resource pools
http_config: reads and handles configuration files and arranges the modules

191
Q

What are the two types of Apache Web Server logs?

A

Access log: records all requests processed by server

error log: diagnostic information and errors the server faced during requests

192
Q

Where are Apache Web Server logs located in each OS?

A

RHEL/Red Hat/CentOS/Fedora Linux: /usr/local/etc/apache22/httpd.conf
Debian/Ubuntu Linux: /etc/apache2/apache2.conf
FreeBSD: /etc/httpd/conf/httpd.conf

193
Q

What is the hex signature for DOC files?

A

EC AF C1 00

194
Q

What is the hex signature for XLS files?

A 
FD FF FF FF nn 00 
or
FD FF FF FF nn 02
or
09 08 10 00 00 06 05 00
195
Q

What is the hex signature for PPT files?

A 
A0 46 1D F0 
or
00 6E 1E F0
or
0F oo E8 03
or
FD FF FF FF nn nn 00 00
196
Q

What is the hex signature for DOCX, PPTX, and XLSX files?

A

50 4B 03 04 14 00 06 00

197
Q

What is the hex signature for JPG?

198
Q

What is the hex signature for PNG?

A

89 50 4E 47 0D 0A 1A 0A

199
Q

What is the hex signature for PDF?

A

25 50 44 46

200
Q

What is the hex signature for ZIP files?

A

50 4B 03 04

201
Q

What is the hex signature for PST files?

A

21 42 44 4E

202
Q

What Linux command provides a hex dump of a given input file?

203
Q

What is a stego-only attack?

A

only the stego object is available for analysis

204
Q

What is a known-stego attack?

A

have access to the stego algorithm and both cover medium and stego-object

205
Q

What is a known-message steganography attack?

A

have access to hidden message and stego object

206
Q

What is a known-cover attack?

A

compare stego-object and cover medium to ID hidden message

207
Q

What is a chosen-message attack?

A

generate stego objects from known message using specific tools to ID the stego algorithm

208
Q

What is a chosen-stego attack?

A

have access to the stego-object and stego-algorithm

209
Q

What is a chi-square attack?

A

perform probability analysis to test whether the object and original are the same or not

210
Q

What is a distinguished statistical attack?

A

analyze the embedded algorithm used to detect distinguishing statistical changes along the length of the embedded data

211
Q

What is a blind classifier attack?

A

blind detector is fed original or unmodified data to learn resemblance of original data from multiple perspectives

212
Q

When is search without a warrant allowed?

A

when a person with authority has provided consent

CHFI (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions