Filters
Question type
Study Flashcards

?Match the following terms with the correct definitions below:? -?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.


A) ?defense in depth (DiD)
B) distributed denial-of-service (DDoS) attacks
C) ?honeypot
D) honeywalls?
E) ?layered network defense strategy
F) network forensics?
G) ?type 1 hypervisor
H) type 2 hypervisor?
I) ?zero day attacks
J) zombies

K) A) and E)
L) E) and G)

Correct Answer

verifed

verified

At what layers of the OSI model do most packet analyzers function?​


A) ​Layer 1 or 2
B) ​Layer 2 or 3
C) Layer 3 or 4
D) Layer 4 or 5

E) B) and C)
F) None of the above

Correct Answer

verifed

verified

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?​


A) ​12.04
B) ​13.11
C) 14.04
D) 14.11

E) A) and B)
F) B) and C)

Correct Answer

verifed

verified

​Define network forensics, and explain how network forensics can be used.

Correct Answer

verifed

verified

Network forensics is the process of collecting and analyzing raw network data and tracking network traffic systematically to ascertain how an attack was carried out or how an event occurred on a network. Being able to spot variations in network traffic can help you track intrusions, so knowing a network's typical patterns is important. Network forensics can also help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.​

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.​


A) smurf​
B) ​SYN flood
C) spoof
D) ghost

E) A) and C)
F) B) and D)

Correct Answer

verifed

verified

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.​


A) ​2
B) ​4
C) 6
D) 8

E) A) and B)
F) B) and D)

Correct Answer

verifed

verified

The ​tcpdump and Wireshark utilities both use what well known packet capture format?


A) ​Netcap
B) ​Pcap
C) Packetd
D) RAW

E) None of the above
F) B) and C)

Correct Answer

verifed

verified

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?​


A) ​tcpdump
B) ​Argus
C) Ngrep
D) Tcpslice

E) B) and C)
F) All of the above

Correct Answer

verifed

verified

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.​

A) True
B) False

Correct Answer

verifed

verified

False

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.​


A) ​Kali Linux
B) ​Ubuntu
C) OSForensics
D) Sleuth Kit

E) A) and D)
F) A) and B)

Correct Answer

verifed

verified

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?​


A) ​KVM
B) ​Parallels
C) Microsoft Virtual PC
D) VirtualBox

E) B) and D)
F) A) and D)

Correct Answer

verifed

verified

?Match the following terms with the correct definitions below:? -Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?


A) ?defense in depth (DiD)
B) distributed denial-of-service (DDoS) attacks
C) ?honeypot
D) honeywalls?
E) ?layered network defense strategy
F) network forensics?
G) ?type 1 hypervisor
H) type 2 hypervisor?
I) ?zero day attacks
J) zombies

K) B) and J)
L) A) and I)

Correct Answer

verifed

verified

I

Select below the option that is not a common type 1 hypervisor:​


A) ​VMware vSphere
B) ​Microsoft Hyper-V
C) Citirix XenServer
D) Oracle VirtualBox

E) A) and B)
F) All of the above

Correct Answer

verifed

verified

Why are live acquisitions becoming a necessity, and why don't live acquisitions follow typical forensics procedures?​

Correct Answer

verifed

verified

Live acquisitions, which are performed b...

View Answer

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.​

Correct Answer

verifed

verified

Describe the standard procedure for performing network forensics.​

Correct Answer

verifed

verified

The standard procedure for performing a ...

View Answer

Describe the defense in depth (DiD) strategy, and outline each of the three modes of protection.​

Correct Answer

verifed

verified

The defense in depth (DiD) strategy, dev...

View Answer

?Match the following terms with the correct definitions below:? -The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?


A) ?defense in depth (DiD)
B) distributed denial-of-service (DDoS) attacks
C) ?honeypot
D) honeywalls?
E) ?layered network defense strategy
F) network forensics?
G) ?type 1 hypervisor
H) type 2 hypervisor?
I) ?zero day attacks
J) zombies

K) A) and B)
L) E) and G)

Correct Answer

verifed

verified

What is the biggest problem with live acquisitions?​

Correct Answer

verifed

verified

The problem investigators face with live...

View Answer

What is the difference between a type 1 and a type 2 hypervisor?​

Correct Answer

verifed

verified

A type 1 hypervisor runs on "bare metal,...

View Answer

Showing 1 - 20 of 50

Related Exams

Exam 1

Understanding the Digital Forensics Profession and Investigations

50 Questions

Exam 2

The Investigators Office and Laboratory

50 Questions

Exam 3

Data Acquisition

50 Questions

Exam 4

Processing Crime and Incident Scenes

50 Questions

Exam 5

Working With Windows and Cli Systems

50 Questions

Exam 6

Current Computer Forensics Tools

50 Questions

Exam 7

Macintosh and Linux Boot Processes and File Systems

48 Questions

Exam 8

Recovering Graphics Files

49 Questions

Exam 9

Computer Forensics Analysis and Validation

50 Questions

Exam 11

Live Acquisitions and Network Forensics

50 Questions

Exam 12

Email Investigations

50 Questions

Exam 13

Cell Phone and Mobile Device Forensics

49 Questions

Exam 14

Report Writing for High Tech Investigations

50 Questions

Exam 15

Expert Testimony in High Tech Investigations

50 Questions

Exam 16

Ethics for the Investigator and Expert Witness

50 Questions

Show Answer