IS4670 Chapter 12 Searching Memory in Real Time with Live System Forensics

Question 1

1. ________ is analysis of machines that remain in operation as you examine them.

Answer 1

Live system forensics

Question 2

2. ________ is analysis of machines that have been shut down.

Answer 2

Dead system analysis

Question 3

3. It is not as important to avoid contaminating evidence in live system forensics as it is in dead system forensics.
   A. True
   B. False

Answer 3

FALSE

Question 4

4. Which of the following are drawbacks of dead system forensics? (Select three.)
   A. It leads to corruption of evidence.
   B. It leads to corruption of the original data.
   C. It leads to system downtime.
   D. It leads criminals to use cryptography.
   E. It leads to data consistency problems.

Answer 4

It leads to corruption of evidence.

It leads to system downtime.

It leads criminals to use cryptography.

Question 5

5. You can use live system forensics to acquire one type of data that dead system forensics can’t acquire. What type of data is this?
A. Binary 
B. Virtual 
C. Volatile 
D. Nonvolatile

Answer 5

Volatile

Question 6

6. Which of the following is a software implemen- tation of a computer that executes programs as if it were a physical computer?
A. VMware 
B. Write blocker 
C. Hardware fingerprint 
D. Virtual machine

Answer 6

Virtual machine

Question 7

7. Which of the following are drawbacks of live system forensics? (Select three.)
   A. It leads to system downtime.
   B. Slurred images can result.
   C. Data can be modified
   D. It leads to data consistency problems.
   E. It leads criminals to use cryptography.

Answer 7

Slurred images can result.

Data can be modified

It leads to data consistency problems.

Question 8

8. As a result of not acquiring data at a unified moment, live system forensics presents a problem with ________.

Answer 8

Consistency

Question 9

9. What are two possible techniques for approaching a compromised system using live system forensics? (Select two.)
A. Live response 
B. Hot swapping 
C. Volatile memory analysis 
D. Hardware fingerprinting

Answer 9

Live response

Volatile memory analysis

Question 10

10. The following are some of the benefits of ________: It limits the impact on the compromised system, analysis is repeatable, and you can ask new questions after the analysis.

Answer 10

Volatile memory analysis