CySA+ Chapter 9: Preparing the Incident Response
questions with verified answers
/etc Ans✓✓✓This is the primary system configuration directory, which
contains a subdirectory for most installed applications
/home/$USER Ans✓✓✓Here, $USER is a variable name that you
should replace with the name of the given user. All user data and
configuration data is kept here
/var/log Ans✓✓✓All well-behaved Linux applications will keep their
log files in plaintext files in this directory, making it a gold mine for
analysts.
A junior analyst has two files and needs to verify they are exact
duplicates. To do this, the analyst konws to first create hashes from the
two files and then compare them. Which of the following tools from the
forensic kit is best tool to use?
A. dd
B. sha1sum
C. eventviewer
D. BitLocker Ans✓✓✓B. Sah1sum. The sha1sum will calculate and
check a SHA-1 hash value. The hash value is also known as a message
digest. The analyst will use sha1sum to calculate and compare message
digests of these two files
, Acquisition Ans✓✓✓IS the preserrvation of evidence in a legally
admissible manner.
Analysis Ans✓✓✓takes place in a controlled environment and without
unduly tainting the evidence.
As part fo the forensic analysis process, what critical activity often
includes a graphical representation of process and operating system
events? Ans✓✓✓Timeline Analysis
Chain of Custody Ans✓✓✓Is a history that shows how evidence was
collected, transported, and preserved at every stage of the process.
Should follow evidence through its entire life cycle, begining with
identification and ending with its destruction, permanent archiving, or
return to the owner.
Command line input:
dd if=/dev/sda of=/dev/sdc bs=2048 conv=noerror,sync status=progress
How many bits of data are read and written at a time? Ans✓✓✓16384:
The bs argument indicates the number of bytes transferring during the
process. Because there are 8 bits in a byte, you can multiply the 2048 by
8 to get 16384 bits.
Command line input:
dd if=/dev/sda of=/dev/sdc bs=2048 conv=noerror,sync status=progress
questions with verified answers
/etc Ans✓✓✓This is the primary system configuration directory, which
contains a subdirectory for most installed applications
/home/$USER Ans✓✓✓Here, $USER is a variable name that you
should replace with the name of the given user. All user data and
configuration data is kept here
/var/log Ans✓✓✓All well-behaved Linux applications will keep their
log files in plaintext files in this directory, making it a gold mine for
analysts.
A junior analyst has two files and needs to verify they are exact
duplicates. To do this, the analyst konws to first create hashes from the
two files and then compare them. Which of the following tools from the
forensic kit is best tool to use?
A. dd
B. sha1sum
C. eventviewer
D. BitLocker Ans✓✓✓B. Sah1sum. The sha1sum will calculate and
check a SHA-1 hash value. The hash value is also known as a message
digest. The analyst will use sha1sum to calculate and compare message
digests of these two files
, Acquisition Ans✓✓✓IS the preserrvation of evidence in a legally
admissible manner.
Analysis Ans✓✓✓takes place in a controlled environment and without
unduly tainting the evidence.
As part fo the forensic analysis process, what critical activity often
includes a graphical representation of process and operating system
events? Ans✓✓✓Timeline Analysis
Chain of Custody Ans✓✓✓Is a history that shows how evidence was
collected, transported, and preserved at every stage of the process.
Should follow evidence through its entire life cycle, begining with
identification and ending with its destruction, permanent archiving, or
return to the owner.
Command line input:
dd if=/dev/sda of=/dev/sdc bs=2048 conv=noerror,sync status=progress
How many bits of data are read and written at a time? Ans✓✓✓16384:
The bs argument indicates the number of bytes transferring during the
process. Because there are 8 bits in a byte, you can multiply the 2048 by
8 to get 16384 bits.
Command line input:
dd if=/dev/sda of=/dev/sdc bs=2048 conv=noerror,sync status=progress
