DFIR Exam Prep questions with accurate
answers
A task can be set to run a malicious payload upon system boot. This type
of Persistence technique is called? Ans✓✓✓Scheduled task
Actions performed after an incident, including collecting data left behind
by an intrusion (artifacts), preserving the data for future use as evidence,
and studying what can be learned from the incident to improve
Cybersecurity against future events. Is all part of? Ans✓✓✓Post
incident activities
After you enter a website, a pop-up appears saying your computer files
were infected, and offering to fix the problem for a small fee. Which of
the following attacks did you encounter? Ans✓✓✓Scareware
Containment, eradication, and recovery steps in the NIST is defined as?
Ans✓✓✓Taking action to mitigate the incident.
Depending on the location of the capture, Wireshark can provide a tool
to transfer some objects such as files over the network. What Wireshark
feature is available to do this? Ans✓✓✓Export
Determining if an incident occurred, and what type of incident it was.
Ans✓✓✓Detection and analysis
, Hackers can encrypt static data to avoid detection. This type of
obfuscation is called? Ans✓✓✓Encryption
Hackers can hide crucial information in existing files. This type of
obfuscation is called? Ans✓✓✓Stegnography
Hackers can hide information in network traffic. This type of
obfuscation is called? Ans✓✓✓Tunneling
In Wireshark, filters are powerful tools that can be used to narrow
searches for a specific goal. For example, if you are looking only for
outbound HTTP traffic, you could use the following:
src host x.x.x.x & http
(where x.x.x.x is your IP address) Name the Wireshark Feature?
Ans✓✓✓Display Filter Expressions
John opened an executable file and noticed unusual activity, such as files
that opened on their own. For further investigation, he wanted to check
if any new network connections were established. Which of the
following tools can check network connections? Ans✓✓✓Netstat
John was tasked to investigate a network attack in accordance with the
network forensics investigation flow process. What should be John's first
step? Ans✓✓✓Check for malware signatures
answers
A task can be set to run a malicious payload upon system boot. This type
of Persistence technique is called? Ans✓✓✓Scheduled task
Actions performed after an incident, including collecting data left behind
by an intrusion (artifacts), preserving the data for future use as evidence,
and studying what can be learned from the incident to improve
Cybersecurity against future events. Is all part of? Ans✓✓✓Post
incident activities
After you enter a website, a pop-up appears saying your computer files
were infected, and offering to fix the problem for a small fee. Which of
the following attacks did you encounter? Ans✓✓✓Scareware
Containment, eradication, and recovery steps in the NIST is defined as?
Ans✓✓✓Taking action to mitigate the incident.
Depending on the location of the capture, Wireshark can provide a tool
to transfer some objects such as files over the network. What Wireshark
feature is available to do this? Ans✓✓✓Export
Determining if an incident occurred, and what type of incident it was.
Ans✓✓✓Detection and analysis
, Hackers can encrypt static data to avoid detection. This type of
obfuscation is called? Ans✓✓✓Encryption
Hackers can hide crucial information in existing files. This type of
obfuscation is called? Ans✓✓✓Stegnography
Hackers can hide information in network traffic. This type of
obfuscation is called? Ans✓✓✓Tunneling
In Wireshark, filters are powerful tools that can be used to narrow
searches for a specific goal. For example, if you are looking only for
outbound HTTP traffic, you could use the following:
src host x.x.x.x & http
(where x.x.x.x is your IP address) Name the Wireshark Feature?
Ans✓✓✓Display Filter Expressions
John opened an executable file and noticed unusual activity, such as files
that opened on their own. For further investigation, he wanted to check
if any new network connections were established. Which of the
following tools can check network connections? Ans✓✓✓Netstat
John was tasked to investigate a network attack in accordance with the
network forensics investigation flow process. What should be John's first
step? Ans✓✓✓Check for malware signatures
