Deck 11: Virtual Machines, Network Forensics, and Live Acquisitions

Question 1

Network forensics is a fast, easy process.

Answer 1

False

Question 2

____ is a popular network intrusion detection system that performs packet capture and analysis in real time.

A) Ethereal
B) Snort
C) Tcpdump
D) john

Answer 2

B

Question 3

____ hide the most valuable data at the innermost part of the network.

A) Layered network defense strategies
B) Firewalls
C) Protocols
D) NAT

Answer 3

A

Question 4

A common way of examining network traffic is by running the ____ program.

A) Netdump
B) Slackdump
C) Coredump
D) Tcpdump

Question 5

When intruders break into a network, they rarely leave a trail behind.

Question 6

Ngrep cannot be used to examine e-mail headers or IRC chats.

Question 7

Helix operates in two modes:Windows Live (GUI or command line) and ____.

A) command Windows
B) remote GUI
C) command Linux
D) bootable Linux

Question 8

____ is a Sysinternals command that shows all Registry data in real time on a Windows computer.

A) PsReg
B) RegExplorer
C) RegMon
D) RegHandle

Question 9

____ can be used to create a bootable forensic CD and perform a live acquisition.

A) Helix
B) DTDD
C) Inquisitor
D) Neon

Question 10

Most packet sniffers operate on layer 2 or ____ of the OSI model.

A) 1
B) 3
C) 5
D) 7

Question 11

____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.

A) Broadcast forensics
B) Network forensics
C) Computer forensics
D) Traffic forensics

Question 12

____ forensics is the systematic tracking of incoming and outgoing traffic on your network.

A) Network
B) Computer
C) Criminal
D) Server

Question 13

____ is the U.S. DoD computer forensics lab's version of the dd command that comes with Knoppix-STD.

A) chntpw
B) john
C) memfetch
D) dcfldd

Question 14

____ are devices and/or software placed on a network to monitor traffic.

A) Packet sniffers
B) Bridges
C) Hubs
D) Honeypots

Question 15

With the Knoppix STD tools on a portable CD, you can examine almost any network system.

Question 16

The Knoppix STD tool ____ enables you to reset passwords on a Windows computer, including the administrator password

A) chntpw
B) john
C) oinkmaster
D) memfetch

Question 17

PsList from PsTools allows you to list detailed information about processes.

Question 18

Most packet sniffer tools can read anything captured in ____ format.

A) SYN
B) DOPI
C) PCAP
D) AIATP

Question 19

____ is a suite of tools created by Sysinternals.

A) EnCase
B) PsTools
C) R-Tools
D) Knoppix

Question 20

The PSTools ____ kills processes by name or process ID.

A) PsExec
B) PsList
C) PsKill
D) PsShutdown

Question 21

The ____ Project was developed to make information widely available in an attempt to thwart Internet and network hackers.

A) Honeynet
B) Honeypot
C) Honeywall
D) Honeyweb

Question 22

____________________ is a layered network defense strategy developed by the National Security Agency (NSA).

Question 23

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
a network analysis tool

Question 24

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
type of malware

Question 25

The term ____________________ means how long a piece of information lasts on a system.

Question 26

____ is a good tool for extracting information from large Libpcap files.

A) Nmap
B) Tcpslice
C) Pcap
D) TCPcap

Question 27

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
displays who's logged on locally

Question 28

In a(n) ____ attack, the attacker keeps asking your server to establish a connection.

A) SYN flood
B) ACK flood
C) brute-force attack
D) PCAP attack

Question 29

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
usually refers to network forensics

Question 30

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
a bootable Linux CD intended for computer and network forensics

Question 31

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
an audit control program that detects anomalies in traffic and sends an alert automatically

Question 32

The PSTools ____________________ tool allows you to suspend processes.

Question 33

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
helps manage snort rules so that you can specify what items to ignore as regular traffic and what items should raise alarms

Question 34

A ____ is a computer set up to look like any other machine on your network, but it lures the attacker to it.

A) honeywall
B) honeypot
C) honeynet
D) honeyhost

Question 35

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
shuts down and optionally restarts a computer

Question 36

____________________ logs record traffic in and out of a network.

Question 37

Match each item with a statement below
a.Cyberforensics
f.Trojan horse
b.Ethereal
g.Knoppix
c.Tripwire
h.PsShutdown
d.PsGetSid
i.oinkmaster
e.PsLoggedOn
displays the security identifier (SID) of a computer or user

Question 38

____ is the text version of Ethereal, a packet sniffer tool.

A) Tcpdump
B) Ethertext
C) Etherape
D) Tethereal

Question 39

Machines used on a DDoS are known as ____ simply because they have unwittingly become part of the attack.

A) ISPs
B) soldiers
C) zombies
D) pawns

Question 40

The U.K. Honeynet Project has created the ____________________. It contains the honeywall and honeypot on a bootable memory stick.

Question 41

What is the general procedure for a live acquisition?

Question 42

When are live acquisitions useful?

Question 43

Explain The Auditor tool.

Question 44

Why is testing networks as important as testing servers?

Question 45

What are some of the tools included with the PSTools suite?

Question 46

How should you proceed if your network forensic investigation involves other companies?

Question 47

What are some of the tools included with Knoppix STD?

Question 48

What is Knoppix-STD?

Question 49

Describe some of the Windows tools available at Sysinternals.

Question 50

Detail a standard procedure for network forensics investigations.