IST 454 - Chapter 10 | UPDATED Questions with 100%
Verified Answers
Q1: Live acquisitions are especially useful when you're dealing
with _________________ network intrusions or attacks
A: active
Q2: Live acquisitions done before taking a system offline are also
becoming a necessity, because attacks might leave ___________
only in running processes or RAM.
A: footprints
Q3: ________ acquisitions don't follow typical forensics procedures
A: Live
Q4: OOV
A: Order of Volatility
Q5: What is Order of Volatility?
A: how long a piece of information lasts on a system.
Q6: Steps of Live Acquisitions
A: 1. Create or download a bootable forensic CD.
2. Make sure you keep a log of all your actions.
3. A network drive is ideal as a place to send the information you collect.
4. Copy the physical memory (RAM)
5. The next step varies, depending on the incident you're investigating.
6. Be sure to get a forensic hash value of all files you recover during the live acquisition.
Q7: Several bootable forensic CDs are available, such as
A: Helix and DEFT
Q8: Helix operates in two modes
A: Windows live and bootable Linux.
Q9: The Windows Live GUI version includes a runtime prompt for
accessing this
A: command line
Q10: GUI tools are easy to use, but
, A: resource intensive
Q11: Network Forensics
A: Systematic tracking of incoming and outgoing traffic to ascertain how an attack was
carried out or how an event occurred on a network.
Q12: Intruders leave _____________ behind.
A: trail
Q13: Determine the _____________ of the abnormal traffic.
A: cause
Q14: Possible causes of abnormal traffic
A: Internal bug, attackers, mistakes
Q15: Layered network defense strategy
A: sets up layers of protection to hide the most valuable data at the innermost part of the
network.
Q16: DiD
A: Defense in Depth
Modes of Protection: People, Technology, and Operations
Q17: Testing __________ is as important as testing servers.
A: networks
Q18: You need to be up to date on the latest methods intruders use
to infiltrate networks as well as
A: methods internal employees use to sabotage networks.
Q19: Modes of Protection - People
A: Policies and Procedures
Training and Awareness
Systems Security Administration
Physical Security
Personnel Security
Facilities Countermeasures
* Hire Good People - Train and Reward them Well. Penalize Unauthorized Behavior.
Q20: People is composed of
Verified Answers
Q1: Live acquisitions are especially useful when you're dealing
with _________________ network intrusions or attacks
A: active
Q2: Live acquisitions done before taking a system offline are also
becoming a necessity, because attacks might leave ___________
only in running processes or RAM.
A: footprints
Q3: ________ acquisitions don't follow typical forensics procedures
A: Live
Q4: OOV
A: Order of Volatility
Q5: What is Order of Volatility?
A: how long a piece of information lasts on a system.
Q6: Steps of Live Acquisitions
A: 1. Create or download a bootable forensic CD.
2. Make sure you keep a log of all your actions.
3. A network drive is ideal as a place to send the information you collect.
4. Copy the physical memory (RAM)
5. The next step varies, depending on the incident you're investigating.
6. Be sure to get a forensic hash value of all files you recover during the live acquisition.
Q7: Several bootable forensic CDs are available, such as
A: Helix and DEFT
Q8: Helix operates in two modes
A: Windows live and bootable Linux.
Q9: The Windows Live GUI version includes a runtime prompt for
accessing this
A: command line
Q10: GUI tools are easy to use, but
, A: resource intensive
Q11: Network Forensics
A: Systematic tracking of incoming and outgoing traffic to ascertain how an attack was
carried out or how an event occurred on a network.
Q12: Intruders leave _____________ behind.
A: trail
Q13: Determine the _____________ of the abnormal traffic.
A: cause
Q14: Possible causes of abnormal traffic
A: Internal bug, attackers, mistakes
Q15: Layered network defense strategy
A: sets up layers of protection to hide the most valuable data at the innermost part of the
network.
Q16: DiD
A: Defense in Depth
Modes of Protection: People, Technology, and Operations
Q17: Testing __________ is as important as testing servers.
A: networks
Q18: You need to be up to date on the latest methods intruders use
to infiltrate networks as well as
A: methods internal employees use to sabotage networks.
Q19: Modes of Protection - People
A: Policies and Procedures
Training and Awareness
Systems Security Administration
Physical Security
Personnel Security
Facilities Countermeasures
* Hire Good People - Train and Reward them Well. Penalize Unauthorized Behavior.
Q20: People is composed of
