Question 1

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.​

Accepted Answer

A) True 
 B)False  False

Question 2

​Define network forensics, and explain how network forensics can be used.

Accepted Answer

Network forensics is the process of collecting and analyzing raw network data and tracking network traffic systematically to ascertain how an attack was carried out or how an event occurred on a network. Being able to spot variations in network traffic can help you track intrusions, so knowing a network's typical patterns is important. Network forensics can also help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.​

Question 3

?Match the following terms with the correct definitions below:?
-Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies I

Question 4

At what layers of the OSI model do most packet analyzers function?​

Accepted Answer

A) ​Layer 1 or 2 
B) ​Layer 2 or 3 
C) Layer 3 or 4 
D) Layer 4 or 5 
A) ​Layer 1 or 2 
B) ​Layer 2 or 3 
C) Layer 3 or 4 
D) Layer 4 or 5

Question 5

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?​

Accepted Answer

A) ​KVM 
B) ​Parallels 
C) Microsoft Virtual PC 
D) VirtualBox 
A) ​KVM 
B) ​Parallels 
C) Microsoft Virtual PC 
D) VirtualBox

Question 6

The ​tcpdump and Wireshark utilities both use what well known packet capture format?

Accepted Answer

A) ​Netcap 
B) ​Pcap 
C) Packetd 
D) RAW 
A) ​Netcap 
B) ​Pcap 
C) Packetd 
D) RAW

Question 7

Why are live acquisitions becoming a necessity, and why don't live acquisitions follow typical forensics procedures?​

Accepted Answer

Live acquisitions, which are performed b

Question 8

?Match the following terms with the correct definitions below:?
-The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 9

What is the biggest problem with live acquisitions?​

Accepted Answer

The problem investigators face with live

Question 10

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.​

Accepted Answer

The answer of The ___________________ utility from Sysinternals shows what...

Question 11

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.​

Accepted Answer

A) ​2 
B) ​4 
C) 6 
D) 8 
A) ​2 
B) ​4 
C) 6 
D) 8

Question 12

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?​

Accepted Answer

A) ​tcpdump 
B) ​Argus 
C) Ngrep 
D) Tcpslice 
A) ​tcpdump 
B) ​Argus 
C) Ngrep 
D) Tcpslice

Question 13

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.​

Accepted Answer

A) ​Kali Linux 
B) ​Ubuntu 
C) OSForensics 
D) Sleuth Kit 
A) ​Kali Linux 
B) ​Ubuntu 
C) OSForensics 
D) Sleuth Kit

Question 14

?Match the following terms with the correct definitions below:?
-?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 15

Describe the defense in depth (DiD) strategy, and outline each of the three modes of protection.​

Accepted Answer

The defense in depth (DiD) strategy, dev

Question 16

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.​

Accepted Answer

A) smurf​ 
B) ​SYN flood 
C) spoof 
D) ghost 
A) smurf​ 
B) ​SYN flood 
C) spoof 
D) ghost

Question 17

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?​

Accepted Answer

A) ​12.04 
B) ​13.11 
C) 14.04 
D) 14.11 
A) ​12.04 
B) ​13.11 
C) 14.04 
D) 14.11

Question 18

What is the difference between a type 1 and a type 2 hypervisor?​

Accepted Answer

A type 1 hypervisor runs on "bare metal,

Question 19

Select below the option that is not a common type 1 hypervisor:​

Accepted Answer

A) ​VMware vSphere 
B) ​Microsoft Hyper-V 
C) Citirix XenServer 
D) Oracle VirtualBox 
A) ​VMware vSphere 
B) ​Microsoft Hyper-V 
C) Citirix XenServer 
D) Oracle VirtualBox

Question 20

Describe the standard procedure for performing network forensics.​

Accepted Answer

The standard procedure for performing a

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.

Define network forensics, and explain how network forensics can be used.

?Match the following terms with the correct definitions below:? -Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?

At what layers of the OSI model do most packet analyzers function?

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?

The tcpdump and Wireshark utilities both use what well known packet capture format?

Why are live acquisitions becoming a necessity, and why don't live acquisitions follow typical forensics procedures?

?Match the following terms with the correct definitions below:? -The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?

What is the biggest problem with live acquisitions?

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.

?Match the following terms with the correct definitions below:? -?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.

Describe the defense in depth (DiD) strategy, and outline each of the three modes of protection.

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?

What is the difference between a type 1 and a type 2 hypervisor?

Select below the option that is not a common type 1 hypervisor:

Describe the standard procedure for performing network forensics.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 10: Virtual Machine and Cloud Forensics