CHAPTER 10: VIRTUAL MACHINE FORENSICS, LIVE ACQUISITIONS,
AND NETWORK FORENSICS
When intruders break into a network, they rarely leave a trail behind. - CORRECT ANSWER-
False
Network forensics is a fast, easy process. - CORRECT ANSWER-False
Virtual machines are now common for both personal and business use - CORRECT ANSWER-
True
Virtual machines (VMs) help offset hardware costs for companies. - CORRECT ANSWER-True
Type 2 hypervisors cannot be used on laptops. - CORRECT ANSWER-False
____ can help you determine whether a network is truly under attack or a user has
inadvertently installed an untested patch or custom program. - CORRECT ANSWER-Network
forensics
____ hide the most valuable data at the innermost part of the network. - CORRECT ANSWER-
Layered network defence strategies
The software that runs virtual machines is called a ____. - CORRECT ANSWER-hypervisor
____ hypervisors are typically, but not exclusively, loaded on servers or workstations with a
lot of RAM and storage. - CORRECT ANSWER-Type 1
Intel ____ has responded to the need for security and performance by producing different
CPU designs. - CORRECT ANSWER-Virtualization Technology (VT)
A common way of examining network traffic is by running the ____ program. - CORRECT
ANSWER-Tcpdump
, Mandiant ____ lists all open network sockets, including those hidden by rootkits. - CORRECT
ANSWER-Memoryze
____ determines how long a piece of information lasts on a system. - CORRECT ANSWER-
Order of volatility
____ is a layered network defense strategy developed by the National Security Agency
(NSA). - CORRECT ANSWER-Defense of Depth
____ is a tool for viewing network traffic graphically. - CORRECT ANSWER-Etherape
____ can be programmed to examine TCP headers to fin the SYN flag. - CORRECT ANSWER-
tethereal
____ is a good tool for extracting information from large Libpcap files. - CORRECT ANSWER-
tcpslice
____ are devices or software placed on a network to monitor traffic. - CORRECT ANSWER-
Packet analyzers
Most packet analyzers operate on layer 2 or ____ of the OSI model. - CORRECT ANSWER-3
Most packet analyzer tools can read anything captured in ____ format. - CORRECT ANSWER-
Pcap
In a(n) ____ attack, the attacker keeps asking your server to establish a connection. -
CORRECT ANSWER-SYN flood
____ was designed as an easy-to-use interface for inspecting and analyzing large tcpdump
files. - CORRECT ANSWER-Netdude
AND NETWORK FORENSICS
When intruders break into a network, they rarely leave a trail behind. - CORRECT ANSWER-
False
Network forensics is a fast, easy process. - CORRECT ANSWER-False
Virtual machines are now common for both personal and business use - CORRECT ANSWER-
True
Virtual machines (VMs) help offset hardware costs for companies. - CORRECT ANSWER-True
Type 2 hypervisors cannot be used on laptops. - CORRECT ANSWER-False
____ can help you determine whether a network is truly under attack or a user has
inadvertently installed an untested patch or custom program. - CORRECT ANSWER-Network
forensics
____ hide the most valuable data at the innermost part of the network. - CORRECT ANSWER-
Layered network defence strategies
The software that runs virtual machines is called a ____. - CORRECT ANSWER-hypervisor
____ hypervisors are typically, but not exclusively, loaded on servers or workstations with a
lot of RAM and storage. - CORRECT ANSWER-Type 1
Intel ____ has responded to the need for security and performance by producing different
CPU designs. - CORRECT ANSWER-Virtualization Technology (VT)
A common way of examining network traffic is by running the ____ program. - CORRECT
ANSWER-Tcpdump
, Mandiant ____ lists all open network sockets, including those hidden by rootkits. - CORRECT
ANSWER-Memoryze
____ determines how long a piece of information lasts on a system. - CORRECT ANSWER-
Order of volatility
____ is a layered network defense strategy developed by the National Security Agency
(NSA). - CORRECT ANSWER-Defense of Depth
____ is a tool for viewing network traffic graphically. - CORRECT ANSWER-Etherape
____ can be programmed to examine TCP headers to fin the SYN flag. - CORRECT ANSWER-
tethereal
____ is a good tool for extracting information from large Libpcap files. - CORRECT ANSWER-
tcpslice
____ are devices or software placed on a network to monitor traffic. - CORRECT ANSWER-
Packet analyzers
Most packet analyzers operate on layer 2 or ____ of the OSI model. - CORRECT ANSWER-3
Most packet analyzer tools can read anything captured in ____ format. - CORRECT ANSWER-
Pcap
In a(n) ____ attack, the attacker keeps asking your server to establish a connection. -
CORRECT ANSWER-SYN flood
____ was designed as an easy-to-use interface for inspecting and analyzing large tcpdump
files. - CORRECT ANSWER-Netdude
