Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
FE - DigiForen
Digital Forensics Essentials/IT0203
| Question | Answer |
|---|---|
| M1-2 | |
| Which of the following cybercrimes involves modifying data during transmission? | Data manipulation |
| Which of the following is an example of volatile data? | System time and open files |
| Which of the following is a type of cybercrime? | All of the above |
| What is a key responsibility of a forensic investigator regarding evidence? | Maintaining the chain of custody |
| What is the primary goal of computer forensics? | To detect and analyze digital evidence for legal use |
| What is an internal cyberattack? | An attack carried out by an insider with authorized access |
| What is the purpose of ACPO Principle 4? | To designate responsibility to the case officer |
| Why is forensic readiness important for organizations? | To minimize investigation costs and disruptions |
| Which of the following is NOT a type of digital evidence? | Physical devices |
| Digital evidence must meet which criterion to be admissible in court? | Be understandable, authentic, and complete |
| Which of the following is an example of non-volatile data? | Files stored on a hard drive |
| Which of the following is NOT an example of user-created files? | Log files |
| According to Locard's Exchange Principle, what happens when a crime is committed? | Some exchange of evidence occurs between the criminal and the environment |
| What does the best evidence rule state? | The original evidence must be submitted when possible |
| Which law outlines the admissibility of evidence in US courts? | Federal Rules of Evidence |
| Why is documenting the crime scene critical? | It creates a detailed record for analysis and presentation |
| Which document must be created during the investigation phase to ensure accuracy? | Incident timeline |
| When testifying as an expert witness, a forensic investigator should: | Present findings accurately and impartially |
| What is the main focus of the post-investigation phase? | Reporting findings to law enforcement |
| What is a primary role of a computer forensics lab? | Preserve and analyze digital evidence |
| What is the first phase of the Forensic Investigation Process? | Pre-investigation |
| Search and seizure require investigators to: | Securely handle all electronic devices |
| The forensic investigation report should include all of the following EXCEPT: | Opinions of the investigation team |
| Which of the following is an essential consideration when building an investigation team? | Specialized roles and responsibilities |
| Data analysis during the investigation phase focuses on: | Interpreting evidence to determine its relevance |
| Proper evidence preservation ensures: | Evidence is admissible in court |
| Evidence acquisition involves: | Capturing and cloning digital evidence from devices |
| A forensic lab must follow which set of guidelines for evidence handling? | Evidence integrity principles |
| Chain of custody refers to: | The process of securing evidence against tampering |
| The post-investigation phase is responsible for: | Summarizing findings into a detailed report |
| What does forensic evidence need to be considered "authentic"? | It must be supported by the original source details |
| What is the main benefit of forensic readiness? | Reduces investigation disruption |
| Which of the following is an objective of computer forensics? | Preserving evidence for prosecution |
| Search and seizure require forensic investigators to: | Execute search warrants and collect evidence |
| What is a critical factor when organizing gathered evidence for a report? | Categorizing information for clarity |
| What does the investigator’s role in court include? | Presenting evidence and findings objectively |
| During the pre-investigation phase, setting up a forensic lab ensures: | All of the above |
| The investigator’s role in court includes: | Presenting evidence and findings objectively |
| In the forensic investigation methodology, which of the following steps comes after the identification of evidence? | Evidence acquisition |
| According to the text, computer forensics is a subset of which field? | Digital Forensics |
| What is the first step in the computer forensics process? | Evidence acquisition |
| Digital evidence can be located in which of the following devices? | All of the above |
| Which principle states that all processes applied to evidence must be documented? | ACPO Principle 3 |
| What is the main use of the chain of custody in computer forensics? | Ensuring evidence is admissible in court |
| What is the purpose of the pre-investigation phase? | To plan and prepare for the forensic investigation |
| What is the most important quality of a forensic investigation report? | It must be concise, clear, and legally admissible |
| What is the importance of understanding hardware and software requirements in a forensic lab? | It ensures compatibility and efficiency during investigations |
| Evidence gathering should occur during which phase? | Investigation |
| What is the purpose of hashing during the investigation phase? | To verify the integrity of digital evidence |
| What is steganography? | Hiding information within other files or images |
| What is the difference between volatile and non-volatile data? | Volatile data is temporary, while non-volatile data is permanent |
| What is a common source of digital evidence? | All of the above |
| What is the role of a forensic investigator? | To identify, collect, and analyze evidence |
| What is the purpose of an investigation report? | To summarize findings and conclusions for legal proceedings |
| What is the role of metadata in digital evidence? | Tracks file creation and modification details |
| What is the main goal of the investigation phase? | To acquire, analyze, and document evidence |
| What is the primary objective of forensic readiness? | To reduce investigation time and costs |
| Which step ensures that evidence remains unaltered during acquisition? | Evidence preservation |
| Which of the following is NOT a requirement for a forensic investigation report? | Inclusion of all organizational data |
| Which rule ensures digital evidence is clear and understandable to the jury? | Understandable evidence |
| Evidence acquired during an investigation must: | Remain unchanged to ensure integrity |
| _______________________________________________________________________ | _______________________________________________________________________ |
| _______________________________________________________________________ | _______________________________________________________________________ |
| M3-4 | |
| What is a "superblock" in the context of Linux file systems? | Metadata containing information about the entire file system |
| What is the main advantage of SSDs over HDDs? | Faster data access speeds |
| What is the purpose of the GUID Partition Table (GPT)? | To organize and manage large-capacity disks |
| What happens during the booting process of an operating system? | The system kernel is loaded into memory |
| Which file system feature allows efficient recovery after a crash? | Journaling |
| Which partition style supports disks larger than 2TB? | GPT |
| Which of the following tools can analyze file systems? | The Sleuth Kit |
| What is the key difference between HFS+ and APFS in macOS? | APFS is optimized for SSDs |
| What does "slack space" refer to on a storage device? | Unused space in a storage cluster after data is written |
| Which Linux file system introduced journaling? | ext3 |
| What type of data acquisition is performed on a system that is turned off? | Static acquisition |
| Which of the following is NOT a type of data acquisition? | Metadata-only acquisition |
| Which of the following is an example of live data acquisition? | Capturing data from a network in real time |
| Which data acquisition method is most suitable for large storage devices? | Physical acquisition |
| Which step comes first in the data acquisition process? | Securing the scene |
| What does metadata in acquired data provide? | Details about the file’s creation, modification, and access times |
| What does a forensic investigator prioritize during the acquisition process? | Ensuring evidence is admissible in court |
| Which of the following is an example of static acquisition? | Imaging a powered-off laptop hard drive |
| What does the term "logical acquisition" refer to? | Copying only specific files or folders |
| Why is documentation critical during the data acquisition process? | To track all steps and tools used for evidence collection |
| What does the term "hash collision" refer to? | Two different pieces of data producing the same hash value |
| What does steganalysis aim to achieve? | Detecting and extracting hidden data from files |
| What is the main goal of anti-forensics? | To prevent forensic investigators from accessing or analyzing evidence |
| What is the purpose of anti-forensics countermeasures? | To assist forensic investigators in detecting and analyzing evidence tampering |
| Which tool is commonly used to detect timestamp manipulation? | ExifTool |
| Which countermeasure is used to detect manipulated timestamps? | Metadata verification |
| How does encryption act as an anti-forensics tool? | It protects data by making it unreadable without the encryption key |
| What does slack space contain? | Unused space in a storage cluster that may hold remnants of previous data |
| What is the primary focus of metadata analysis in anti-forensics countermeasures? | To identify inconsistencies in file properties |
| Why is recovering overwritten files particularly challenging? | Overwritten data cannot be recovered without specialized tools |
| What is the primary role of the Master Boot Record (MBR)? | To manage boot-up information and partition details |
| In a hard disk drive, what is the purpose of the read/write head? | To read and write data to/from the disk surface |
| What does the term "tracks" refer to in the context of hard disk drives? | Concentric circles on the disk surface used for storing data |
| Which operating system uses NTFS as its primary file system? | Windows |
| What is the significance of "logical block addressing (LBA)"? | It simplifies the storage addressing system |
| What is a disadvantage of live data acquisition? | It may alter the original data |
| Which file format is NOT commonly used for data acquisition? | NTFS |
| How does the dd tool assist in data acquisition? | By creating a bit-by-bit copy of storage media |
| Which of the following is a challenge in data acquisition? | Maintaining the integrity of volatile data |
| What is the role of a write blocker during data acquisition? | Preventing modifications to the original evidence |
| What is the primary objective of data acquisition in digital forensics? | Preserving the integrity of evidence during collection |
| What is the purpose of volatile data collection? | To capture live system data that may be lost upon shutdown |
| Which tool is commonly used for disk imaging in forensic investigations? | dd |
| Which anti-forensics technique is used to bypass file recovery tools? | Slack space wiping |
| Which of the following techniques can recover evidence after artifact wiping? | Slack space analysis |
| Which anti-forensics technique is aimed at hiding the true content of files? | Encryption |
| How can forensic investigators counter log wiping? | By recovering deleted logs from slack space |
| Which of the following is an example of artifact wiping? | Overwriting files with random data to prevent recovery |
| What is the purpose of log wiping in anti-forensics? | To erase traces of user activity from log files |
| What is the role of secure file deletion software? | To overwrite data to ensure it cannot be recovered |
| What is the primary function of a file system? | To organize and manage data on storage devices |
| What is an inode in Linux file systems? | A structure that stores metadata about files |
| How does a solid-state drive (SSD) store data? | Using NAND-based flash memory |
| Which file system is commonly used by Linux operating systems? | ext4 |
| What is the main purpose of the FAT32 file system? | To support older operating systems with a simpler structure |
| Which of the following data types is considered volatile? | Open network connections |
| What is the primary concern when capturing data from encrypted devices? | Acquiring data without damaging encryption keys |
| Which hashing algorithm is commonly used to verify data integrity? | MD5 |
| What does steganography involve? | Hiding information within other files, such as images or videos |
| What is an effective countermeasure for artifact wiping? | Metadata analysis |
| Which anti-forensics technique can prevent hash-based file analysis? | Hash collision generation |
| How does anti-forensics impact forensic readiness? | It complicates the process of collecting, preserving, and analyzing evidence |
| What feature distinguishes ext3 from ext2? | File journaling support |
| What is the purpose of an acquisition report? | To outline the steps and tools used during data collection |
| Which anti-forensics technique specifically targets forensic investigators' reliance on logs? | Log wiping |
| What is the primary challenge with detecting steganography? | It leaves no visible traces of hidden data |
| Which of the following is an effective countermeasure against data obfuscation? | Structure analysis and pattern recognition |
| What does the BIOS Parameter Block (BPB) do? | Contains essential file system information |
| What is a common disk interface used in modern hard drives? | Both SATA and NVMe |
| What does the AFF (Advanced Forensics Format) provide? | A standardized format for digital evidence storage |
| Why is hashing performed before and after acquisition? | To detect tampering during the transfer process |
| What is the purpose of the tool "Timestomp"? | To manipulate file metadata such as creation and modification dates |
| What does data obfuscation aim to achieve? | Making data harder to understand by altering its structure or format |
| How does file system tunneling interfere with forensic investigations? | It allows files to inherit timestamps from deleted files |
| What is the main purpose of sectors on a hard drive? | To define physical divisions on the disk for data storage |
| What is a key advantage of using AFF for data acquisition? | It compresses data for efficient storage |
| Which acquisition tool can capture data at the sector level? | dd |
| What is the purpose of hashing in the data acquisition process? | To verify the integrity of acquired data |
| What is a critical consideration when dealing with encrypted files in forensics? | Identifying the encryption key or password |
| How does a journaling file system improve reliability? | By tracking changes to files and storing them in a log |
| Which of the following is an essential feature of solid-state drives (SSDs)? | Low latency and faster read/write speeds |
| What does "journaling" in a file system ensure? | Recovery of data in case of system crashes |
| What does a "bit-stream image" include? | A complete copy of all sectors, including deleted and hidden data |
| What is the main objective of anti-forensics countermeasures? | To detect, recover, and analyze tampered or hidden evidence |
| Which file system is specific to macOS? | HFS+ |
| What is a "boot sector"? | A reserved area of disk for operating system files |
| What does "selective acquisition" focus on? | Collecting only relevant files or folders |
| What type of data structure is used in NTFS to store file metadata? | Master File Table (MFT) |
| _______________________________________________________________________ | _______________________________________________________________________ |
| _______________________________________________________________________ | _______________________________________________________________________ |
| M5-6 | |
| What is a Master File Table (MFT) in NTFS? | A database that contains information about every file and directory on the volume. |
| What is a significant challenge in Windows forensics? | Dealing with extensive amounts of data. |
| What type of information can be found in Event Logs? | User login attempts and system errors. |
| How can volatile memory be captured in Windows? | Using tools like Volatility or FTK Imager. |
| What is the purpose of metadata analysis in forensics? | To verify file integrity and examine usage patterns. |
| Which file contains information about deleted files in the Recycle Bin? | INFO2 |
| What is the main purpose of Pagefile in Windows forensics? | To act as virtual memory and store data that cannot fit in RAM. |
| What does the NTUSER.DAT file store? | User-specific settings and preferences. |
| What does volatile data collection focus on? | Capturing data that will be lost when the system is shut down. |
| What is the significance of Prefetch files in Windows forensics? | They store information about recently executed programs. |
| Which of the following is an advantage of using The Sleuth Kit? | Comprehensive analysis of disk and file system images. |
| Which command in Linux displays active processes in a hierarchical format? | pstree |
| What is the purpose of the /var/log directory in Linux? | To store system and application log files. |
| What is the role of Spotlight in macOS forensics? | Indexing and searching files, including deleted metadata. |
| Which tool is useful for parsing Spotlight databases on macOS? | SQLite Browser |
| What does the inode in Linux file systems store? | Metadata about a file, such as permissions and timestamps. |
| Which Linux command is used to analyze network routing tables? | ip route |
| What does the ifconfig command in Linux display? | Network interface configurations. |
| What is the significance of plists in macOS forensics? | They store application and user preference settings. |
| Where are user preferences typically stored on macOS? | /Library/Preferences |
| Which protocol is used to resolve domain names to IP addresses? | DNS |
| Which of the following best describes an Indicator of Compromise (IoC)? | Evidence found in network logs that points to malicious activity. |
| What is the significance of MAC addresses in network forensics? | They uniquely identify devices on a network. |
| Which technique is used to bypass network firewalls? | DNS tunneling |
| What is the main function of network forensics tools like Zeek (formerly Bro)? | Analyzing and monitoring network traffic for security threats. |
| What is the primary purpose of event correlation in network forensics? | Identifying patterns and relationships between network events. |
| What information can be obtained from network logs? | Details about IP addresses, protocols, and timestamps. |
| Which network protocol is used to transfer files securely? | SFTP |
| What is packet sniffing? | Capturing and analyzing network packets to monitor traffic. |
| What does "deep packet inspection" (DPI) analyze? | Both the packet headers and payloads for content analysis. |
| What is the purpose of the Windows Thumbcache? | To provide quick access to thumbnail previews of images and videos |
| What is the primary role of metadata in Windows files? | To store creation, modification, and access details of files |
| Which command is used to view active network connections in Windows? | netstat |
| Which command is used to capture memory in a Windows forensic investigation? | memdump |
| What is the primary use of the Windows Task Scheduler in forensics? | To identify scheduled tasks that may indicate malicious activity |
| Where are Windows Prefetch files located? | C:\Windows\Prefetch |
| What type of data is considered volatile in Windows forensics? | Data stored in RAM |
| How can a forensic investigator detect malicious activity in Mac logs? | By analyzing login attempts and application activity logs |
| Which Mac utility provides detailed insights into system performance and resource usage? | Activity Monitor |
| Which command in Linux retrieves the hostname of the system? | hostname |
| What is the purpose of plists in macOS forensics? | To analyze preferences and configurations for applications |
| Which Linux command is used to display open files by a process? | lsof |
| Which feature distinguishes APFS from HFS+? | Faster indexing and enhanced encryption |
| How can network forensic investigators identify malicious insider activity? | By analyzing unusual login times and file access patterns |
| What is the primary purpose of network traffic baselining? | To establish normal traffic patterns for detecting anomalies |
| What does the term "port scanning" refer to in network forensics? | Searching for open ports on a network to identify vulnerabilities |
| Which protocol is commonly used in email traffic? | IMAP |
| Which log file format is commonly used in network forensics? | PCAP |
| How can an IoC be identified from network traffic? | By detecting anomalies such as unusual traffic spikes |
| Which Registry hive stores information about the hardware profile? | HKEY_LOCAL_MACHINE |
| What is the main goal of Windows forensics? | To analyze and recover digital evidence from Windows systems |
| Which of the following tools can analyze browser artifacts? | SQLite Browser |
| Why is the Recycle Bin useful in forensic investigations? | It may contain deleted files that are still recoverable |
| What does the Pagefile.sys file primarily store? | Swapped data from RAM |
| What is the primary focus of Linux forensics? | Analyzing log files and recovering deleted data |
| What is the main role of the Linux grep command in forensics? | Searching for specific patterns in text files |
| Where are system logs stored on a Mac? | /Library/Logs |
| What is the purpose of journaling in file systems like HFS+? | To log changes for data recovery in case of a system crash |
| How does the Mac feature "Time Machine" assist forensic investigators? | By storing periodic backups of the system |
| What is a honeypot used for in network forensics? | To divert and monitor potential attackers |
| What is the purpose of intrusion detection systems (IDS) in network forensics? | Monitoring and alerting on malicious network activity |
| What is a common indicator of a Distributed Denial of Service (DDoS) attack? | A sudden spike in network traffic from multiple sources |
| What type of attack involves redirecting traffic to malicious websites? | DNS spoofing |
| Which of the following is a challenge in network forensics? | Analyzing large volumes of data in real time |
| Where are Windows Event Logs stored by default? | C:\Windows\System32\Config |
| What does the Windows Registry store? | Configuration settings and preferences for the operating system and applications |
| Which registry key contains startup applications? | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run |
| What is the primary focus of memory forensics in Linux? | Analyzing RAM data to detect malware and active processes |
| Which command in Linux displays the system's IP address? | ip addr |
| What is the importance of timestamp synchronization in network forensics? | To ensure accurate correlation of events across different devices |
| What is the role of firewalls in network forensics? | Monitoring and logging network activity for suspicious behavior |
| Which protocol is primarily used for secure web browsing? | HTTPS |
| How can browser artifacts, such as cookies and cache, aid in a forensic investigation? | By providing information about user online activity |
| How can deleted files be recovered in Linux forensics? | Analyzing slack space in the file system |
| Which tool is commonly used to analyze filesystem images in Linux? | The Sleuth Kit |
| What type of network traffic is commonly associated with DNS tunneling attacks? | Abnormally frequent DNS queries |
| Which of the following tools is used for investigating network-related compromises? | Wireshark |
| Which tool is commonly used for network traffic analysis? | Wireshark |
| What tool is commonly used for analyzing the Windows Registry? | Registry Viewer |
| Which file system is commonly used by macOS? | HFS+ |
| What is a key purpose of a SIEM system in network forensics? | Collecting, analyzing, and correlating log data from multiple sources |
| What is the function of Redline in Windows forensics? | To analyze memory and gather data from a running system |
| What is the purpose of Linux memory forensics? | To analyze live system data stored in memory |
| What does the command uptime display in Linux? | System uptime since the last boot |
| What is the primary goal of network forensics? | To monitor and analyze network traffic for evidence of cybercrimes |
| Which protocol is commonly targeted during man-in-the-middle attacks? | DNS |
| Which of the following can be recovered from a Windows memory dump? | Temporary data from running processes |
| _______________________________________________________________________ | _______________________________________________________________________ |
| _______________________________________________________________________ | _______________________________________________________________________ |
| M7-8 | |
| What is the primary goal of web application forensics? | To trace and analyze malicious activities targeting web applications |
| What is the first step in investigating a web attack? | Secure and preserve digital evidence |
| What is the benefit of analyzing error logs during a forensic investigation? | They highlight issues causing system failures |
| What does a web application firewall (WAF) primarily do? | Block unauthorized HTTP traffic to the application |
| Which tool can monitor logs for anomalies in real-time? | Splunk |
| What does a high volume of HTTP 404 errors in logs often indicate? | Missing files or resources |
| What is the purpose of the "sc-status" field in IIS logs? | It records the HTTP status code returned to the client |
| What is a session fixation attack? | An attack where a valid session ID is used maliciously |
| Which HTTP status code indicates a successful request? | 200 |
| What is the default log file for Apache web servers? | access.log |
| Which Tor relay is directly visible to the destination server? | Exit Relay |
| What type of logs might indicate Tor usage when analyzed? | Network traffic logs |
| What is the main goal of dark web forensics? | Investigate illegal activities on the dark web |
| What browser is commonly used to access the dark web? | Tor Browser |
| What is the first step in investigating Tor browser artifacts? | Collecting and analyzing RAM dumps |
| What is the primary purpose of the Tor browser? | Provide user anonymity through onion routing |
| What is a practical solution for handling dark web forensic challenges? | Use of SIEM tools |
| Which tool is used to capture RAM dumps during forensic investigations? | Belkasoft LIVE RAM Capturer |
| What is a .onion domain? | A domain used for websites on the dark web accessible via Tor |
| What type of information can be obtained from memory dumps? | Websites browsed and emails accessed |
| What does a softfail in the SPF record indicate? | The email server IP is not authorized to send on behalf of the domain |
| What should be done when analyzing the email body of a spoofed email? | Identify suspicious links and attachments |
| What information is included in email headers? | Subject, sender, and routing information |
| How can phishing attacks through emails be identified? | By analyzing sender email domains and links |
| Which step involves analyzing deleted emails? | Recovering deleted email messages |
| Which forensic step involves checking suspicious links in an email? | Analyzing the email body |
| What does the MIME format in emails support? | Multimedia attachments in emails |
| What is indicated if an email’s Message-ID has a local host domain? | The email is spoofed |
| How can investigators verify the authenticity of a suspicious email sender? | By analyzing the "Received-SPF" field |
| Where are email headers located in an email? | At the beginning of the email |
| At the beginning of the email | To match the malware against known databases |
| What information is often stored in event logs during malware analysis? | System modifications |
| How can runtime behavior help mitigate future malware threats? | By identifying vulnerabilities exploited by malware |
| Which forensic tool checks the integrity of files and folders? | FastSum |
| What registry keys are commonly targeted by malware for persistence? | AutoStart registry locations |
| What tool can be used for malware disassembly? | OllyDbg |
| What does static malware analysis focus on? | Analyzing the binary code without execution |
| Which of the following is a type of malware? | Worms, Trojans and Ransomware |
| What is the primary goal of malware forensics? | Identify, analyze, and contain malicious code |
| What is the primary objective of malware analysis? | To understand malware functionality and mitigate risks |
| Which encoding technique is often used to obfuscate malicious payloads in XSS attacks? | Base64 |
| How can Cross-Site Scripting (XSS) attacks be mitigated? | Validating and sanitizing user input |
| What kind of attack attempts to exploit directory traversal vulnerabilities? | Path Traversal |
| What is the primary purpose of preserving logs in forensic investigations? | To serve as evidence in legal proceedings |
| What is the main purpose of log rotation? | To manage storage by archiving old logs |
| What is the primary evidence source for identifying web application attacks? | Application server logs |
| What kind of information can be found in IIS logs? | Client IP address and HTTP method |
| What kind of attack often involves malicious scripts running on a user’s browser? | Cross-Site Scripting (XSS) |
| What is a major limitation when the Tor browser is uninstalled? | Limited number of artifacts remain |
| What forensic step follows capturing memory dumps? | Examining dumps for actionable artifacts |
| What challenge does encrypted communication on the dark web present? | Difficulty tracing physical locations |
| What is a Tor bridge node? | A node used to bypass restrictions |
| What layer of the web is used for activities requiring anonymity and is not indexed by search engines? | Dark Web |
| How does the exit relay in the Tor network affect investigations? | It makes the relay appear as the origin of traffic |
| What tool can verify if an email address is valid? | Email Dossier |
| What is the primary function of the Mail User Agent (MUA)? | To send and receive emails for end-users |
| What is the primary goal of email spamming? | To flood mailboxes with unsolicited emails |
| What is the purpose of a "Message-ID" field in an email? | To track the email’s routing path |
| What should investigators do to retrieve email headers in Microsoft Outlook? | Navigate to the "Properties" tab" |
| Why is analyzing email headers important in forensic investigations? | To identify sender and recipient information |
| What does the "To" field in an email header indicate? | The intended recipient(s) of the email |
| What tool is commonly used to capture live network traffic? | Wireshark |
| What is the main purpose of dynamic malware analysis? | To observe malware behavior in a controlled runtime environment |
| What technique can identify malicious remote IP addresses? | Scanning with online malware tools |
| What is the best way to monitor malware’s communication with external networks? | Using port monitoring tools like TCPView |
| How does malware commonly use DNS entries? | To redirect users to malicious servers |
| What kind of evidence does the "referrer" field in logs provide? | Source URL leading to the current request |
| What does the "c-ip" field in IIS logs represent? | Client IP address |
| What kind of attack uses unsanitized input to execute SQL queries? | SQL Injection |
| What does a suspicious "cmd.exe" entry in server logs indicate? | A potential command injection attack |
| What tool is commonly used to investigate network packet data? | Wireshark |
| What forensic challenge is posed by anonymous dark web hosting? | Lack of hosting records |
| Which network analysis command can reveal active Tor connections? | netstat -ano |
| Why is dark web investigation challenging? | High-level anonymity of users |
| What does "onion routing" refer to? | Layered encryption for anonymous communication |
| Which protocol is used to retrieve emails from a mail server? | IMAP |
| What is the main advantage of email forensics? | It helps identify fraudulent activities and attackers |
| What is email spoofing? | Forging email headers to hide the sender's identity |
| Which system component can be monitored to track malware-created processes? | All of the above |
| Why is it important to set up a controlled lab environment for malware analysis? | To isolate and study malware behavior safely |
| Why are virtual machines used in dynamic analysis? | To create a safe, isolated testing environment |
| What aspect of malware is studied during host integrity monitoring? | Changes to files, registry, and services |
| What does forensic imaging involve? | Creating an exact copy of digital evidence for analysis |
| What does an HTTP 403 status code mean? | Forbidden access |
| What is the most reliable indicator of Tor usage in logs? | Frequent 404 errors(wrong, answer should be:.onion domain access) |
| What protocol is used for anonymously hosting websites on the dark web? | Hidden Service Protocol |
| What file analysis tool extracts URLs and email IDs from memory dumps? | Bulk Extractor |
| What field provides the sender’s domain name in a DKIM signature? | "d=" field |
| Which protocol is commonly used to send emails? | SMTP |
| Which of the following is an example of email phishing? | Using spoofed emails to steal login credentials |
| What is the main challenge of analyzing malware with anti-analysis techniques? | Difficulty in reversing obfuscation and evasion tactics |
| What is a PE file in the context of malware analysis? | Portable Executable |
| What is a key focus of network behavior analysis in malware forensics? | Tracking IP addresses and DNS entries |
| What does an HTTP 500 status code indicate? | Server-side error |
| What is the significance of hashing log files? | Ensures data integrity |
| What is the role of the "State" file in Tor forensics? | To record the last execution date and time |
| What legal issue complicates dark web investigations? | Jurisdictional boundaries |
| What is the primary objective of email crime investigation? | To identify the criminal and their intent |
| What is a "mail storm"? | A sudden influx of spam caused by auto-replies or loops |
| Which static property helps identify packed or obfuscated malware? | Packer signatures |
| What is the purpose of monitoring ports during malware analysis? | To detect open connections used by malware |
| What does observing runtime behavior involve? | Watching malware interactions with system resources and the network |
| Which condition yields the most Tor artifacts during RAM analysis? | Browser is open |
| What is a common characteristic of phishing emails? | They create urgency to provoke action |
| What forensic tool can analyze email headers for evidence? | Paraben’s Electronic Evidence Examiner |
| What is "file fingerprinting" in static analysis? | Hashing files to identify changes |
| Which ports are commonly used by the Tor browser? | 9150 and 9151 |
| How is cyberstalking often conducted through email? | By using threatening or harassing messages |
| What does the "User-Agent" field in logs provide? | Details of the operating system and browser used by the client |
| What is the first step in investigating an email crime? | Seizing the suspect’s computer and email accounts |
| What is the first step in dynamic malware analysis preparation? | Generate hash values of system files |
| Which tool is used to monitor changes in file systems during dynamic analysis? | WhatChanged Portable |
| Which log analysis technique is used to identify patterns in large datasets? | Regex matching |
| How can deleted email messages from Microsoft Outlook be recovered? | Using Paraben’s E3 tool |
| What tool is used to monitor Windows startup programs? | Autoruns for Windows |
| Which of these tools can detect missing or invalid DLLs? | Dependency Walker |
| What registry key can store information about the Tor browser's installation path? | 1----Doesn't actually show the path but ok |
| Which directory typically contains the "State" file for Tor browser? | 2 |
Created by:
Jsean-Ed_DR