Chapter 13 - Performing Forensic Analysis and
Techniques for Incident Response questions with
accurate answers
How does Tcpdump differ from Wireshark? Ans✓✓✓Tcpdump is a
command-line packet capture utility commonly found on Linux and
Unix systems, useful for capturing and analyzing packet data.
Name three common types of file carving methods. Ans✓✓✓Header-
and footer-based carving, content-based carving, and file structure-based
carving.
Name two forensic investigation suites mentioned in the text.
Ans✓✓✓FTK (Forensic Toolkit) and EnCase.
What are computer forensic investigations used for? Ans✓✓✓To
determine what activities, changes, and actions have occurred on a
system, who or what performed them, and what data is stored there.
What are legal holds, and why are they important? Ans✓✓✓Legal
holds require organizations to preserve all potentially relevant data
related to pending or active litigation.
What are lessons learned in the context of incident response?
Ans✓✓✓Takeaways from the incident, including opportunities for
improvement, new controls or practices to implement, and process or
procedure changes.
, What are some common types of forensic software? Ans✓✓✓FTK,
EnCase, CAINE, Autopsy, and SIFT.
What are the challenges of container forensics? Ans✓✓✓Containers are
designed to be disposable, and their ephemeral nature means forensic
artifacts may be lost.
What are the challenges of performing forensic investigations on cloud
services? Ans✓✓✓Shared tenant models make it hard to get forensic
data, often requiring the cloud service provider to participate in the
investigation.
What are the drawbacks of live imaging of a system?
Ans✓✓✓Remnants from the imaging tool, changes to drive or memory
contents during imaging, and potential malware detection of the imaging
tool.
What are the four primary modes of data acquisition from mobile
devices? Ans✓✓✓Physical acquisition, logical acquisition, manual
access, and filesystem access.
What are the three major areas of focus in post-incident activity
according to the CySA+ exam objectives? Ans✓✓✓Forensic analysis,
root cause analysis, and lessons learned.
Techniques for Incident Response questions with
accurate answers
How does Tcpdump differ from Wireshark? Ans✓✓✓Tcpdump is a
command-line packet capture utility commonly found on Linux and
Unix systems, useful for capturing and analyzing packet data.
Name three common types of file carving methods. Ans✓✓✓Header-
and footer-based carving, content-based carving, and file structure-based
carving.
Name two forensic investigation suites mentioned in the text.
Ans✓✓✓FTK (Forensic Toolkit) and EnCase.
What are computer forensic investigations used for? Ans✓✓✓To
determine what activities, changes, and actions have occurred on a
system, who or what performed them, and what data is stored there.
What are legal holds, and why are they important? Ans✓✓✓Legal
holds require organizations to preserve all potentially relevant data
related to pending or active litigation.
What are lessons learned in the context of incident response?
Ans✓✓✓Takeaways from the incident, including opportunities for
improvement, new controls or practices to implement, and process or
procedure changes.
, What are some common types of forensic software? Ans✓✓✓FTK,
EnCase, CAINE, Autopsy, and SIFT.
What are the challenges of container forensics? Ans✓✓✓Containers are
designed to be disposable, and their ephemeral nature means forensic
artifacts may be lost.
What are the challenges of performing forensic investigations on cloud
services? Ans✓✓✓Shared tenant models make it hard to get forensic
data, often requiring the cloud service provider to participate in the
investigation.
What are the drawbacks of live imaging of a system?
Ans✓✓✓Remnants from the imaging tool, changes to drive or memory
contents during imaging, and potential malware detection of the imaging
tool.
What are the four primary modes of data acquisition from mobile
devices? Ans✓✓✓Physical acquisition, logical acquisition, manual
access, and filesystem access.
What are the three major areas of focus in post-incident activity
according to the CySA+ exam objectives? Ans✓✓✓Forensic analysis,
root cause analysis, and lessons learned.
