DFIR - Digital Forensics Incident Training questions
with accurate answers
A pop-up appears saying your computer files were infected, and offering
to fix the problem for free.. what of the following attacks did you
encounter? Ans✓✓✓Scareware
Because Linux presents everything as a file, it makes it easier to:
Ans✓✓✓Analyze
cold site Ans✓✓✓Cheapest backup option does not always have the
necessary equipment to enable the resumption of normal operation
Connscan Ans✓✓✓Scans for identifiable TCP connections in older
versions of Windows
Conscan should be used as a complimentary plugin with
Ans✓✓✓Sockets
Data Carving is a forensics technique that involves what?
Ans✓✓✓Reassembling files from pieces of raw data, when no file
system metadata is available
Hot site Ans✓✓✓A backup that is running continuously and ready for
imediate switchover
How are vulvectomies tracked? Ans✓✓✓By a CVE number
, How is a file hidden using steganography? Ans✓✓✓By hiding a file
within another file
NetScan Ans✓✓✓Can be used in more recent versions of Windows
Non Repudiation provides: Ans✓✓✓Provides proof of the origin &
integrity of data
Sockets Ans✓✓✓Scans for all our sockets
Static Binaries Ans✓✓✓use a minimal footprint on the system as they
are not dependent on libraries pre-install on the Linux OS. & Doesn't
require other files to run
To investigate a network attack in accordance with the network forensics
investigation flow process, what should be the first step?
Ans✓✓✓Check for malware signatures
To test company software and analyze its behavior in real-time, which of
the following should be used? Ans✓✓✓Dynamic analysis
UBA, User behavior analytics knows what "normal " is for each user?
Ans✓✓✓True
with accurate answers
A pop-up appears saying your computer files were infected, and offering
to fix the problem for free.. what of the following attacks did you
encounter? Ans✓✓✓Scareware
Because Linux presents everything as a file, it makes it easier to:
Ans✓✓✓Analyze
cold site Ans✓✓✓Cheapest backup option does not always have the
necessary equipment to enable the resumption of normal operation
Connscan Ans✓✓✓Scans for identifiable TCP connections in older
versions of Windows
Conscan should be used as a complimentary plugin with
Ans✓✓✓Sockets
Data Carving is a forensics technique that involves what?
Ans✓✓✓Reassembling files from pieces of raw data, when no file
system metadata is available
Hot site Ans✓✓✓A backup that is running continuously and ready for
imediate switchover
How are vulvectomies tracked? Ans✓✓✓By a CVE number
, How is a file hidden using steganography? Ans✓✓✓By hiding a file
within another file
NetScan Ans✓✓✓Can be used in more recent versions of Windows
Non Repudiation provides: Ans✓✓✓Provides proof of the origin &
integrity of data
Sockets Ans✓✓✓Scans for all our sockets
Static Binaries Ans✓✓✓use a minimal footprint on the system as they
are not dependent on libraries pre-install on the Linux OS. & Doesn't
require other files to run
To investigate a network attack in accordance with the network forensics
investigation flow process, what should be the first step?
Ans✓✓✓Check for malware signatures
To test company software and analyze its behavior in real-time, which of
the following should be used? Ans✓✓✓Dynamic analysis
UBA, User behavior analytics knows what "normal " is for each user?
Ans✓✓✓True
