Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > DFIR Test Review > Flashcards

DFIR Test Review Flashcards

1
Q

Define the CSIRT acronym

A

Computer Security Incident Response Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Let’s build an IR team, whom do we need?
A. Analyst – Does ALL the work! Like a paralegal to an attorney
B. IR Manager – Manages up, helps herd the cats, removes blockers
C. Researcher – Malware analysis, digs into vulnerabilities, etc.

  • Do we need a technician?
  • Technicians work on infrastructure gear
  • We can request techs do something (spanning or mirroring)
  • We would not want one on our team as they must have adequate access and
    tribal knowledge of the infrastructure. Our team member would have none
    of that.
A

Need A,B, and C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What types of things do we do in Digital
Forensics
A. Collecting information – Collecting artifacts to analyze
B. Examining artifacts - Looking for malware and signs of compromise
C. Reporting – We write comprehensive technical reports

  • During an DF or IR, do we ‘hack’?
A

We do A, B, and C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is a digital forensics
method?
A. Deleting files
B. Steganography
C. Live Analysis
D. All of the above

A

C, live analys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the order of the IR lifecycle?

A

Preparation, Detection and Analysis, Containment, Eradication and
Recovery, and Post Incident Activity

  • Note: No ‘identification’, ‘termination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following tools can interface
with Windows OS and a RAM dump?
A. CAINE
B. Volatility
C. Wireshark
D. SIFT

A

RAM = Volatility , answer is B

A. CAINE Computer Aided Investigative Environment (KALI of forensics)

C. Wireshark - Protocol Analyzer
D. SIFT - SANS Incident (SANS Incident Forensics Toolkit) (KALI of forensics)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can malware be detected?
A. By scanning the system folder
B. It cannot be detected
C. By searching for abnormal activities
D. By changing folder permissions

A

C By searching for abnormal activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a sandbox used for?
A. Isolating an operating system to check files
B. Testing malware w/out affecting the host system
C. Running new apps
D. Clearing infected files from the host system

A

Testing malware w/out affecting the host system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between wireshark
and t-shark?

A
  • T-shark does not have a GUI
  • T-shark is more efficient than wireshark
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a disadvantage of a planned attack?
A. When an attack is planned, the AV cannot scan it
B. When an attack focuses on a company, it is harder to track it
C. When an attack is planned, the firewall does not monitor it
D. It is easier to bypass security measures when an attack is planned

A

When an attack focuses on a company, it is harder to track it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is TCPFLOW?

  • https://www.tecmint.com/tcpflow-analyze-debug-network-traffic-in-linux/
A
  • Free, open source, powerful command line based tool for analyzing network traffic on unix-like systems such as Linux. Captures data received or xferred over TCP connections and stores it in a file for later analysis.
  • It breaks the data up by IP
  • Does not capture all the header info (only the data)
  • Does not capture the entire packet like TCPDUMP does
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is TCPReplay?

A

TCPReplay allows a user to open a .pcap file and then replay it back onto the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is TCPDUMP?

A
  • Packet capture tool that captures all the data in the packet
  • Also called a packet sniffing tool
  • Also called a Network Sniffing Tool
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the different between soft and hard filters in wireshark?

A
  • Hard filters are set a ‘capture time’
  • Remember that wireshark is a protocol analyzer and not a packet capture or sniffer tool.
  • Hard filters set the packet sniffer wireshark is coupled with to ONLY capture what the filter tells it to.
  • Soft filters are set in wireshark (protocol analyzer) not the packet capture tool
  • Hard filters limit captures, not soft filters.
  • Soft filters can be modified, hard filters are preset at the beginning of a capture
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the difference between captured
HTTP requests and HTTPS requests?

A
  • All data transferred over an HTTPS connection is encrypted
  • HTTPS requests are encrypted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In what way is a file hidden when using
steganography?

A
  • A file can be hidden inside of another file
  • A command is typically hidden in images being posted to control
    posts (Indonesian malware posting to infected word press servers)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is FTK Imager?

A

FTK Imager is a tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool such as FTK is warranted.
* Forensic Tool Kit = FTK
* What is a forensic image?
* A forensic image is one in which during the copy no ability to write to the original disk/evidence was possible
* What is a byte by byte copy? (perfect copy)
* A byte by byte copy is one in which a byte is read, written, read again and verified
it was written as is the original byte. Each byte is checked. Versus a ‘group of
bytes’ copy (normal copy) where large sections are read, written, hash generated
of section – and hash pulled of section written. If the hash matches it is assumed
to be 100% accurate copy – not every byte is checked.
* Hashing algorithms do not check every single byte – just a LOT of them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is HxD

A

Hexadecimal Editor
* a tool NOT USED IN NETWORK FORENSICS MONITORING!!!!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is wireshark?

A
  • A protocol analyzer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is ntopng?

A
  • High speed web based traffic analysis and flow collection
  • ntopng is a high performance, low resource replacement for ‘ntop’.
  • The name is derived by: ntop next generation.
  • Provides persistent traffic statistics in RRD format.
  • RRD=round robin database, or fixed in size. As one entry enters,
    another leaves.
  • Layer 7 analysis by leveraging on nDPI (OS DPI framework)
  • DPI=Deep Packet Inspection
  • Can be used in forensics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Explico?

A

Open source network forensic analysis tool (NFAT)
* https://www.xplico.org/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which statement is true?
* When data is erased from the operating system, it cannot be restored
* When data is erased from the OS, it remains on the HDD until it is
overwritten
* Data is kept only in RAM, and cannot be restored from the HDD
* Data is erased when the operating system reboots

A

When data is erased from the OS, it remains on the HDD until it is
overwritten

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where is the file signature mentioned?
1. Only at the end of a file
2. It is not mentioned at all
3. After the first line of the file’s information section
4. At the beginning and end of a file
5. IRL it is at the first few bytes of the file

A
  1. At the beginning and end of a file
24
Q

What is the event viewer?
A. A Windows interface that only displays login attempts
B. A Windows interface that saves computer logs
C. A Windows interface that collects logs from the network
D. A Windows interface that collects logs from remote computers

A

B. A Windows interface that saves computer logs

25
Q

what is mimikatz?

ttps://www.varonis.com/blog/what-is-mimikatz/

A

Mimikatz as a proof of concept to show Microsoft that their
authentication protocols were vulnerable to attack. Instead, he
inadvertently created one of the most widely used and downloaded
hacker tools of the past 20 years
* Credential theft tool for Windows networks, w00t!

26
Q

What is John the ripper

A
  • Free password cracking tool
27
Q

what is LaZagne?

A
  • A tool for recovering passwords from a system
  • The LaZagne project is an open source application used to retrieve
    lots of passwords stored on a local computer. Each software stores its
    passwords using different techniques (plaintext, APIs, custom
    algorithms, databases, etc.).
  • https://github.com/AlessandroZ/LaZagne#:~:text=The%20LaZagne%2
    0project%20is%20an,%2C%20databases%2C%20etc.).
28
Q

Which is a tool that can recover passwords
saved in a system?

A

laZagne

29
Q

What is binwalk?

A

A tool for hunting binary data for magic numbers
* It can walk through a file and find files within files by locating magic
#’s
* Just because it finds a magic # for a file, does it mean we will have
another file there?
* https://en.wikipedia.org/wiki/List_of_file_signatures

30
Q

What is Persistence?

A

When a threat actor discreetly maintains long-term access to systems despite disruptions such as restarts or changed credentials.

31
Q

List two techniques that are commonly used for Malware Persistence?

Registry Keys (windows)
Services (windows / *nix)
Scheduled Tasks
Anti-debugging

A
  • Registry Keys (windows)
  • Services (windows / *nix)

–Scheduled Tasks? This is likely true on Windows and *nix systems, but NOT for the test unless it is multiple checkbox question!

–Anti-debugging? This is not related to persistence but for staying hidden a little longer.

32
Q

Which of the following is not an IR Role?

  • Recovery
  • Containment
  • Stress Check
  • Response
A

Stress Check
Is not related – this is for testing auto scaling or ECC (Elastic Cloud
Computing)

33
Q

Which tool can be used for dynamically
investigating malware?
* Debugger
* Packer
* UPX
* Disassembler

A

Debugger – Used by software engineers to slow code down and troubleshoot it. Also used by reverse engineers analyzing malware.

  • Packer – Tool used to obfuscate code (makes it difficult to RE)
  • UPX – Name of the most popular packer (Ultimate Packer for
    Executables)
  • Disassembler – Static Analysis tool for taking apart a malware binary
34
Q

Which is not included in Digital Forensics
Process?
* Collection
* Examination
* Reporting
* Penetration Testing

A

Penetration Testing

35
Q

Which of the following is not a body section
of a PE (Portable Executable) File?
* .rdata
* .data
* .header
* .text

A

header

36
Q

Which of the following is not a file systems
used by Windows OS?
* Ext4
* NTFS
* FAT32
* exFAT

A

Ext4

37
Q

Which of the following are anti-forensics techniques?
Steganography
Debugging
APT
Tunneling

A

Steganography
Tunneling

38
Q

Which of the following is not a feature of
wireshark?
* Stream Inspection
* Object Export
* Display Filters
* Replacing à Network Traffic

A

Replacing à Network Traffic

39
Q

Which of the following tools can be used to
obfuscate malware code?
* NASM
* PEiD
* NMAP
* UPX

A

UPX

  • NASM is an assembler (Netwide Assembler)
  • PEiD is Portable Executable Identifier (profiles PE files and identifies them)
  • NMAP is a Network Mapping tool
40
Q

Which of the following can be used to identify a file as malicious?
* XFS Analyzer
* Autoruns
* Encryption
* Hash

A

Hash – Can be used to check VT for prior malicious
behaviour w/out exposing the file to thousands of people.
(answer)

  • XFS Analyzer - profiles extended file system
  • Autoruns – Locations in windows where files can be put to automatically run when the computer is rebooted. The programs ‘automatically run or autorun’.
  • Encryption – Prevents the data from being read or modified.
41
Q

Which of the following is used to hide
persistent malware?
* Autoruns
* Wireshark
* Volatility
* HxD

A
  • Autoruns – Used to make malware persistent by having it ‘auto run’
    anytime the computer reboots. (answer)
  • Wireshark – Protocol analyzer
  • Volatility - Memory Analyzer and has tools that can run natively in
    Windows OS. (used to research RAM dumps)
  • HxD – Hexadecimal editor
42
Q

Which of the following can be used to
research RAM dumps?
* PhotoREC
* Exif Tool
* Dd
* Volatility

A

Volatility – Used to research RAM dumps, also has an installer
to interact w/the Windows OS.

  • PhotoREC – Hunts for magic numbers related to images in
    binary data, extracts any image files it finds.
  • Exif Tool – Extract exif data (meta data) from image files.
  • dd – Used to perform byte by byte copies of files, partitions,
    and disk images.
43
Q

Which of the following tools can be used to
look for embedded executable code?
* Binwalk
* FTK Imager
* Sigcheck
* Certutil

A
  • Binwalk – Used to hunt for files embedded in other files by looking for magic numbers.
  • FTK Imager – Creates forensic images of files.
  • Sigcheck – Compares 2 files signatures to verify that they are
    the same.
  • Certutil – Tool used for managing and working with certificate
    files.
44
Q

Which of the following is not a tool used for
data carving?
* DumpIt
* Bulk Extractor
* HxD
* PhotoRec

A
  • DumpIt – Used to create RAM (Random Access Memory) dumps for later analysis.
  • Bulk Extractor – Used to extract files via magic numbers from binary data.
  • HxD – Hexadecimal Editor (hex editor)
  • PhotoRec – Used to extract all types of images from binary data.
45
Q

Which of the following will not create a log by default?
* None of these Choices
* Web Servers
* Proxy Servers
* Linux authentication Process

A

None of these Choices

Note: All programs, process, daemons, everything creates logs!

46
Q

Which of the following is not CPU architecture?
* NASM
* ARM
* Pi
* MIPS

A
  • Pi – Is an embedded System Architecture (not a CPU), it is the entire ‘system’, board and all vs just a CPU architecture like x86,
    x64 and MIPS.
  • NASM – Netwide Assembler for generating CPU code
  • ARM – Acorn RISC Machine (CPU Architecture)
  • MIPS – MIPS is also the name of the company that designed it.
    It is a CPU architecture. Name = Million Instructions Per Second
47
Q

Which of the following can be used to research RAM dumps?
* Volatility
* dd
* Exif tool
* PhotoREC

A

Volatility

48
Q

Linux systems?
* XFS
* Ext4
* FAT32
* NTFS

A

Ext4

49
Q

Which of the following should be monitored during dynamic malware analysis?
File System Changes
Executable file strings
Registry Changes
Network Activity

A

File System Changes
Registry Changes
Network Activity

50
Q

What is the responsibility of a CISO?
To make sure the physical security of an organization is adequate
To manage IT employees and search for quality recruits
To create a strategy for data and IT asset protection and maintain it
To manage the business model of an organization

A

To create a strategy for data and IT asset protection and maintain it

51
Q

Persistent malware = autoruns!!!!!

A

Anytime you see the words ‘persistent malware’, ‘autoruns’ is going to
be the answer.

52
Q

Which of the following is a windows event
viewer classification?
Alert
Error
Debug
IOC

A

Alert
Error
Debug

53
Q

Which of the following tools can be used for drive cloning?
* dd
* None of these choices
* Volatility
* FTK Imager

A

FTK Imager
dd

54
Q

What is the difference between wireshark
and tcpdump?
* Tcpdump is a dumping tool; wireshark monitors system files
* Tcpdump can only capture packets that use tcp
* Tcpdump is command-based; wireshark has a GUI interface
* Wireshark is a network monitoring tool; tcpdump is used as an IDS

A

Tcpdump is command-based; wireshark has a GUI interface

55
Q

Which of the following is not a containment
strategy?
* Host isolation
* Updating IDS rules
* Segmentation of networks
* Blocklist filtering

A

Updating IDS rules

Cybersecurity (33 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions