Question 1

What Windows Registry key contains associations for file extensions?​

Accepted Answer

A) ​HKEY_CLASSES_ROOT 
B) ​HKEY_USERS 
C) HKEY_LOCAL_MACHINE 
D) HKEY_CURRENT_CONFIG 
A) ​HKEY_CLASSES_ROOT 
B) ​HKEY_USERS 
C) HKEY_LOCAL_MACHINE 
D) HKEY_CURRENT_CONFIG

Question 2

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

Accepted Answer

A) True 
 B)False

Question 3

?Match the following terms with the correct definitions below:?
-A computer or network set up to lure an attacker.?

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 4

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.​

Accepted Answer

The answer of __________________ help offset hardware costs for companies...

Question 5

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?​

Accepted Answer

A) ​People 
B) ​Technology 
C) Operations 
D) Management 
A) ​People 
B) ​Technology 
C) Operations 
D) Management

Question 6

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.​

Accepted Answer

The answer of The ________________ software lists all open network...

Question 7

Select the file below that is used in VirtualBox to create a virtual machine:​

Accepted Answer

A) ​.vdi 
B) ​.vbox 
C) .r0 
D) .ova 
A) ​.vdi 
B) ​.vbox 
C) .r0 
D) .ova

Question 8

The __________________ is the version of Pcap available for Linux based operating systems.​

Accepted Answer

A) ​Winpcap 
B) ​Libpcap 
C) Tcpcap 
D) Netcap 
A) ​Winpcap 
B) ​Libpcap 
C) Tcpcap 
D) Netcap

Question 9

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.​

Accepted Answer

A) True 
 B)False

Question 10

Describe a zero day attack.​

Accepted Answer

In a typical zero day attack, attackers

Question 11

?Match the following terms with the correct definitions below:?
-A virtual machine interface that's loaded on top of an existing OS.?

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 12

What processor instruction set is required in order to utilize virtualization software?​

Accepted Answer

A) ​AMD-VT 
B) ​Intel VirtualBit 
C) Virtual Machine Extensions (VMX) 
D) Virtual Hardware Extensions (VHX) 
A) ​AMD-VT 
B) ​Intel VirtualBit 
C) Virtual Machine Extensions (VMX) 
D) Virtual Hardware Extensions (VHX)

Question 13

The __________ disk image file format is associated with the VirtualBox hypervisor.​

Accepted Answer

A) .​vmdk 
B) ​.hda 
C) .vhd 
D) .vdi 
A) .​vmdk 
B) ​.hda 
C) .vhd 
D) .vdi

Question 14

Forensics tools can't directly mount VMs as external drives.​

Accepted Answer

A) True 
 B)False

Question 15

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.​

Accepted Answer

A) True 
 B)False

Question 16

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM​ to display a virtual machine's network adapters?

Accepted Answer

A) ​Show-NetworkAdapters 
B) ​Query-ipconfig 
C) Get-VMNetworkAdapter 
D) Dump-Netconfig 
A) ​Show-NetworkAdapters 
B) ​Query-ipconfig 
C) Get-VMNetworkAdapter 
D) Dump-Netconfig

Question 17

Select below the program within the PsTools suite that allows you to run processes remotely:​

Accepted Answer

A) ​PsService 
B) ​PsPasswd 
C) PsRemote 
D) PsExec 
A) ​PsService 
B) ​PsPasswd 
C) PsRemote 
D) PsExec

Question 18

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

Accepted Answer

A) ​Tcpdstat 
B) ​Tcpslice 
C) Ngrep 
D) tcpdump 
A) ​Tcpdstat 
B) ​Tcpslice 
C) Ngrep 
D) tcpdump

Question 19

?Match the following terms with the correct definitions below:?
-Computers used without the owners' knowledge in a DDoS attack.?

Accepted Answer

A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies 
A) ?defense in depth (Di
D)  
B) distributed denial-of-service (DDoS) attacks 
C) ?honeypot 
D) honeywalls? 
E) ?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 20

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?​

Accepted Answer

A) ​.nvram 
B) ​.vmem 
C)  .​vmpage 
D) .vmx 
A) ​.nvram 
B) ​.vmem 
C)  .​vmpage 
D) .vmx

What Windows Registry key contains associations for file extensions?

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

?Match the following terms with the correct definitions below:? -A computer or network set up to lure an attacker.?

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.

Select the file below that is used in VirtualBox to create a virtual machine:

The __________________ is the version of Pcap available for Linux based operating systems.

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.

Describe a zero day attack.

?Match the following terms with the correct definitions below:? -A virtual machine interface that's loaded on top of an existing OS.?

What processor instruction set is required in order to utilize virtualization software?

The __________ disk image file format is associated with the VirtualBox hypervisor.

Forensics tools can't directly mount VMs as external drives.

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

?Match the following terms with the correct definitions below:? -Computers used without the owners' knowledge in a DDoS attack.?

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 10: Virtual Machine and Cloud Forensics

What Windows Registry key contains associations for file extensions?​

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

?Match the following terms with the correct definitions below:? -A computer or network set up to lure an attacker.?

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.​

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?​

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.​

Select the file below that is used in VirtualBox to create a virtual machine:​

The __________________ is the version of Pcap available for Linux based operating systems.​

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.​

Describe a zero day attack.​

?Match the following terms with the correct definitions below:? -A virtual machine interface that's loaded on top of an existing OS.?

What processor instruction set is required in order to utilize virtualization software?​

The __________ disk image file format is associated with the VirtualBox hypervisor.​

Forensics tools can't directly mount VMs as external drives.​

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.​

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM​ to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:​

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

?Match the following terms with the correct definitions below:? -Computers used without the owners' knowledge in a DDoS attack.?

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?​

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

What Windows Registry key contains associations for file extensions?

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.

Select the file below that is used in VirtualBox to create a virtual machine:

The __________________ is the version of Pcap available for Linux based operating systems.

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.

Describe a zero day attack.

What processor instruction set is required in order to utilize virtualization software?

The __________ disk image file format is associated with the VirtualBox hypervisor.

Forensics tools can't directly mount VMs as external drives.

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?