Digital Forensics and Incident Response
questions with accurate answers
"vol.py -f Imageinfo" is the command for identifying profiles within a
memory artifact when using Volatility.
True or False Ans✓✓✓True
A proxy acts as an intermediary between a client requesting a resource
and the server providing that resource.
True or False Ans✓✓✓True
After you enter a website, a pop-up appears saying your computer files
were infected and offering to fix the problem for a small fee. Which of
the following attacks did you encounter?
1-Worm
2-Scareware
3-Evil Twin
4-MITM Ans✓✓✓2-Scareware
Anomaly Detection systems are vulnerable to creating false-positive
alerts.
True or False Ans✓✓✓True
Bob, a security analyst, received notifications from a program called
code.exe and wants to examine its process. Which of the following can
help him examine the process?
,1-Process dump
2-DLL dump
3-Memory dump
4-All of the above Ans✓✓✓1-Process dump
Browser cache artifacts include:
1-Cookies
2-Browsed URLS
3-User Accounts
4-All of the above Ans✓✓✓1-Cookies
Browser Caches contain browsed URLs only
True or False Ans✓✓✓False
Command line data can be found in memory analysis.
True or False Ans✓✓✓True
David wants to test company software and analyze its behavior in real
time. Which of the following methods should he use?
1-Dynamic analysis
2-Static analysis
3-Sandbox analysis
4-MTTR Ans✓✓✓1-Dynamic analysis
,Debugging malware is a slow and tedious process.
True or False Ans✓✓✓True
DNS Cache is erased when the browser history is erased.
True or False Ans✓✓✓False
DRP is defined as outlining response strategies for unplanned events.
True or False Ans✓✓✓True
Dynamic Linked Library's (DLL) purpose is to create reusable and
shared code for various programs?
True or False Ans✓✓✓True
Errors can occur in PowerForensics when parsing drives larger than 2
TB.
True or False Ans✓✓✓True
Hashing can be used to verify the integrity of a drive copy.
True or False Ans✓✓✓True
It is not possible to do a drive capture over the network.
True or False Ans✓✓✓False
, It is NOT possible to find URLs during Memory Analysis.
True or False Ans✓✓✓False
It is possible to obtain a memory dump after a system has been shut
down.
True or False Ans✓✓✓True
John opened an executable file and noticed unusual activity, such as files
that opened on their own. For further investigation, he wanted to check
if any new network connections were established. Which of the
following tools can check network connections?
1-Net framework
2-Telnet
3-FakeNet-ng
4-Netstat Ans✓✓✓4-Netstat
John was tasked to investigate a network attack in accordance with the
network forensics investigation flow process. What should be John's first
step?
1-Filter by IOCs and gathered data.
2-Check for malware signatures.
3-Analyze the protocol data.
4-Identify traffic abnormalities.
5-Identify key stations. Ans✓✓✓2-Check for malware signatures
questions with accurate answers
"vol.py -f Imageinfo" is the command for identifying profiles within a
memory artifact when using Volatility.
True or False Ans✓✓✓True
A proxy acts as an intermediary between a client requesting a resource
and the server providing that resource.
True or False Ans✓✓✓True
After you enter a website, a pop-up appears saying your computer files
were infected and offering to fix the problem for a small fee. Which of
the following attacks did you encounter?
1-Worm
2-Scareware
3-Evil Twin
4-MITM Ans✓✓✓2-Scareware
Anomaly Detection systems are vulnerable to creating false-positive
alerts.
True or False Ans✓✓✓True
Bob, a security analyst, received notifications from a program called
code.exe and wants to examine its process. Which of the following can
help him examine the process?
,1-Process dump
2-DLL dump
3-Memory dump
4-All of the above Ans✓✓✓1-Process dump
Browser cache artifacts include:
1-Cookies
2-Browsed URLS
3-User Accounts
4-All of the above Ans✓✓✓1-Cookies
Browser Caches contain browsed URLs only
True or False Ans✓✓✓False
Command line data can be found in memory analysis.
True or False Ans✓✓✓True
David wants to test company software and analyze its behavior in real
time. Which of the following methods should he use?
1-Dynamic analysis
2-Static analysis
3-Sandbox analysis
4-MTTR Ans✓✓✓1-Dynamic analysis
,Debugging malware is a slow and tedious process.
True or False Ans✓✓✓True
DNS Cache is erased when the browser history is erased.
True or False Ans✓✓✓False
DRP is defined as outlining response strategies for unplanned events.
True or False Ans✓✓✓True
Dynamic Linked Library's (DLL) purpose is to create reusable and
shared code for various programs?
True or False Ans✓✓✓True
Errors can occur in PowerForensics when parsing drives larger than 2
TB.
True or False Ans✓✓✓True
Hashing can be used to verify the integrity of a drive copy.
True or False Ans✓✓✓True
It is not possible to do a drive capture over the network.
True or False Ans✓✓✓False
, It is NOT possible to find URLs during Memory Analysis.
True or False Ans✓✓✓False
It is possible to obtain a memory dump after a system has been shut
down.
True or False Ans✓✓✓True
John opened an executable file and noticed unusual activity, such as files
that opened on their own. For further investigation, he wanted to check
if any new network connections were established. Which of the
following tools can check network connections?
1-Net framework
2-Telnet
3-FakeNet-ng
4-Netstat Ans✓✓✓4-Netstat
John was tasked to investigate a network attack in accordance with the
network forensics investigation flow process. What should be John's first
step?
1-Filter by IOCs and gathered data.
2-Check for malware signatures.
3-Analyze the protocol data.
4-Identify traffic abnormalities.
5-Identify key stations. Ans✓✓✓2-Check for malware signatures
