Deck 10: Virtual Machine and Cloud Forensics

Question 1

Select the file below that is used in VirtualBox to create a virtual machine:​

A)​.vdi
B)​.vbox
C).r0
D).ova

Answer 1

D

Question 2

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?​

A)​tcpdump
B)​Argus
C)Ngrep
D)Tcpslice

Answer 2

C

Question 3

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?​

A)​KVM
B)​Parallels
C)Microsoft Virtual PC
D)VirtualBox

Answer 3

D

Question 4

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?​

A)​.nvram
B)​.vmem
C) .​vmpage
D).vmx

Question 5

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.​

A)​2
B)​4
C)6
D)8

Question 6

Forensics tools can't directly mount VMs as external drives.​

Question 7

What processor instruction set is required in order to utilize virtualization software?​

A)​AMD-VT
B)​Intel VirtualBit
C)Virtual Machine Extensions (VMX)
D)Virtual Hardware Extensions (VHX)

Question 8

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.​

A)​Kali Linux
B)​Ubuntu
C)OSForensics
D)Sleuth Kit

Question 9

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

A)​Tcpdstat
B)​Tcpslice
C)Ngrep
D)tcpdump

Question 10

What Windows Registry key contains associations for file extensions?​

A)​HKEY_CLASSES_ROOT
B)​HKEY_USERS
C)HKEY_LOCAL_MACHINE
D)HKEY_CURRENT_CONFIG

Question 11

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM​ to display a virtual machine's network adapters?

A)​Show-NetworkAdapters
B)​Query-ipconfig
C)Get-VMNetworkAdapter
D)Dump-Netconfig

Question 12

Select below the program within the PsTools suite that allows you to run processes remotely:​

A)​PsService
B)​PsPasswd
C)PsRemote
D)PsExec

Question 13

Select below the option that is not a common type 1 hypervisor:​

A)​VMware vSphere
B)​Microsoft Hyper-V
C)Citirix XenServer
D)Oracle VirtualBox

Question 14

The __________ disk image file format is associated with the VirtualBox hypervisor.​

A).​vmdk
B)​.hda
C).vhd
D).vdi

Question 15

The __________________ is the version of Pcap available for Linux based operating systems.​

A)​Winpcap
B)​Libpcap
C)Tcpcap
D)Netcap

Question 16

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.​

Question 17

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?​

A)​People
B)​Technology
C)Operations
D)Management

Question 18

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.​

Question 19

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.​

Question 20

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

Question 21

?Match the following terms with the correct definitions below:?

-?Intrusion prevention and monitoring systems that track what attackers do on honeypots.

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 22

?Match the following terms with the correct definitions below:?

-Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 23

?Match the following terms with the correct definitions below:?

-Computers used without the owners' knowledge in a DDoS attack.?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 24

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.​

A)smurf​
B)​SYN flood
C)spoof
D)ghost

Question 25

The ___________________ utility can be used to view network traffic graphically.​

Question 26

The ​tcpdump and Wireshark utilities both use what well known packet capture format?

A)​Netcap
B)​Pcap
C)Packetd
D)RAW

Question 27

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.​

Question 28

?The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.

A)?netstat
B)?ls
C)ifconfig
D)tcpdump

Question 29

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.​

Question 30

?Match the following terms with the correct definitions below:?

-The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 31

?Match the following terms with the correct definitions below:?

-A computer or network set up to lure an attacker.?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 32

?Match the following terms with the correct definitions below:?

-A virtual machine interface that's loaded on top of an existing OS.?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 33

At what layers of the OSI model do most packet analyzers function?​

A)​Layer 1 or 2
B)​Layer 2 or 3
C)Layer 3 or 4
D)Layer 4 or 5

Question 34

?Match the following terms with the correct definitions below:?

-?A type of DoS attack in which other online machines are used, without the owner's knowledge, to launch an attack.

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 35

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.​

Question 36

?Match the following terms with the correct definitions below:?

-?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 37

?Match the following terms with the correct definitions below:?

-?A virtual machine interface that loads on physical hardware and contains its own OS.

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 38

Updating security patches, antivirus software, and OSs fall into the ________________ category of the defense in depth strategy.​

Question 39

?Match the following terms with the correct definitions below:?

-An approach to network hardening that sets up several network layers to place the most valuable data at the innermost part of the network?

A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Question 40

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?​

A)​12.04
B)​13.11
C)14.04
D)14.11

Question 41

Describe a zero day attack.​

Question 42

What is a packet analyzer, and how is it used?​

Question 43

​Define network forensics, and explain how network forensics can be used.

Question 44

What is a VM snapshot, and why is a live acquisition typically required for VMs?​

Question 45

Describe the defense in depth (DiD) strategy, and outline each of the three modes of protection.​

Question 46

What is the biggest problem with live acquisitions?​

Question 47

Explain the need for using established procedures for acquiring data after an attack or intrusion incident, and list some resources that address these needs.​

Question 48

Describe the standard procedure for performing network forensics.​

Question 49

Why are live acquisitions becoming a necessity, and why don't live acquisitions follow typical forensics procedures?​

Question 50

What is the difference between a type 1 and a type 2 hypervisor?​