Question 1

Select the file below that is used in VirtualBox to create a virtual machine:​
A)​.vdi
B)​.vbox
C).r0
D).ova

Accepted Answer

The .ova file is used in VirtualBox to create a virtual machine. It is essentially a pre-packaged virtual machine with all the necessary settings and configurations already in place. It can be imported into VirtualBox with a few clicks, making it the easiest and most convenient way to create a virtual machine.

Question 2

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?​
A)​tcpdump
B)​Argus
C)Ngrep
D)Tcpslice

Accepted Answer

Ngrep is a utility that allows users to match patterns in network traffic and display the results, making it an excellent choice for examining email headers or chat logs, or even network communication between worms and viruses. Tcpdump, Argus, and Tcpslice are other network analysis tools, but they are not as well-suited for these specific tasks.

Question 3

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?​
A)​KVM
B)​Parallels
C)Microsoft Virtual PC
D)VirtualBox

Accepted Answer

VirtualBox is the only option listed that supports all Windows and Linux OSs as well as Macintosh and Solaris. It is also provided as shareware. KVM is a virtualization tool primarily for Linux systems, Parallels is mainly for Macintosh systems, and Microsoft Virtual PC only supports Windows operating systems.

Question 4

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?​
A)​.nvram
B)​.vmem
C) .​vmpage
D).vmx

Accepted Answer

The .vmem file type stores VM paging files that are used as RAM for a virtual machine in VMWare.

Question 5

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.​
A)​2
B)​4
C)6
D)8

Accepted Answer

VirtualBox supports six different types of virtual network adapters, including AMD and Intel Pro adapters.

Question 6

Forensics tools can't directly mount VMs as external drives.​

Accepted Answer

Forensic tools can directly mount VMs (Virtual Machines) as external drives, allowing for the examination of the file system and data within the VM without running the actual VM. This is useful for digital forensic investigations.

Question 7

What processor instruction set is required in order to utilize virtualization software?​
A)​AMD-VT
B)​Intel VirtualBit
C)Virtual Machine Extensions (VMX)
D)Virtual Hardware Extensions (VHX)

Accepted Answer

Virtual Machine Extensions (VMX) is the Intel processor instruction set required to utilize virtualization software. It allows the creation of multiple virtual machines on a single physical machine and enables efficient sharing of hardware resources. AMD-VT is the equivalent instruction set for AMD processors. VirtualBit and VHX are not actual processor instruction sets.

Question 8

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.​
A)​Kali Linux
B)​Ubuntu
C)OSForensics
D)Sleuth Kit

Accepted Answer

Kali Linux is a popular and comprehensive cybersecurity and penetration testing platform that comes pre-installed with over 300 tools, including password crackers, network sniffers, and freeware forensics tools. It is an updated version of BackTrack, another popular penetration testing platform. Therefore, Kali Linux is the best answer.

Question 9

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.
A)​Tcpdstat
B)​Tcpslice
C)Ngrep
D)tcpdump

Accepted Answer

Tcpslice is a good tool for extracting information from large Libpcap files by specifying the time frame you want to examine. Tcpdstat analyzes TCP connections and displays information such as connection setup and teardown times, data flow, and retransmissions. Ngrep is a network grep tool that allows you to search for patterns in network traffic. Tcpdump is a command-line packet analyzer that captures and displays network traffic.

Question 10

What Windows Registry key contains associations for file extensions?​
A)​HKEY_CLASSES_ROOT
B)​HKEY_USERS
C)HKEY_LOCAL_MACHINE
D)HKEY_CURRENT_CONFIG

Accepted Answer

The HKEY_CLASSES_ROOT key contains the current file, folder, and application associations for file extensions in Windows Registry.

Question 11

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM​ to display a virtual machine's network adapters?
A)​Show-NetworkAdapters
B)​Query-ipconfig
C)Get-VMNetworkAdapter
D)Dump-Netconfig

Accepted Answer

The correct cmdlet to use in conjunction with Get-VM to display a virtual machine's network adapters is Get-VMNetworkAdapter. Option A, Show-NetworkAdapters, is not a valid cmdlet. Option B, Query-ipconfig, is not a valid cmdlet and it is not used in conjunction with Get-VM. Option D, Dump-Netconfig, is not a valid cmdlet and it does not display virtual machine network adapters specifically.

Question 12

Select below the program within the PsTools suite that allows you to run processes remotely:​
A)​PsService
B)​PsPasswd
C)PsRemote
D)PsExec

Accepted Answer

PsExec is the command-line tool that allows running processes remotely. It is specifically designed for executing commands on remote systems. The other tools in the PsTools suite have different purposes and do not allow remote process execution.

Question 13

Select below the option that is not a common type 1 hypervisor:​
A)​VMware vSphere
B)​Microsoft Hyper-V
C)Citirix XenServer
D)Oracle VirtualBox

Accepted Answer

VMware vSphere, Microsoft Hyper-V, and Citrix XenServer are all common type 1 hypervisors used in enterprise environments. However, Oracle VirtualBox is not typically used in enterprise environments as it is designed more for personal or small-scale use. Therefore, D is the correct answer.

Question 14

The __________ disk image file format is associated with the VirtualBox hypervisor.​
A).​vmdk
B)​.hda
C).vhd
D).vdi

Accepted Answer

The VirtualBox hypervisor uses the .vdi disk image file format. A is associated with VMware, B is not a commonly used disk image format, and C is associated with Microsoft Virtual PC.

Question 15

The __________________ is the version of Pcap available for Linux based operating systems.​
A)​Winpcap
B)​Libpcap
C)Tcpcap
D)Netcap

Accepted Answer

Libpcap is the version of Pcap available for Linux based operating systems.

Question 16

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.​

Accepted Answer

The Honeynet Project was indeed developed with the aim of making information about Internet and network attackers available to the wider community. It does this by setting up networks with vulnerabilities and monitoring the activity of attackers who exploit them, with the goal of developing better ways to detect and respond to these types of attacks.

Question 17

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?​
A)​People
B)​Technology
C)Operations
D)Management

Accepted Answer

The NSA's defense in depth (DiD) strategy contains three modes of protection: People, Technology, and Operations. Management is not a mode of protection in the DiD strategy.

Question 18

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.​

Accepted Answer

Type 1 hypervisors run directly on the host's hardware and have access to all available resources, so their capability is limited only by the amount of available RAM, storage, and throughput.

Question 19

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.​

Accepted Answer

Type 2 hypervisors run on top of a host operating system rather than directly on the hardware, making them more common for testing environments, development, or educational purposes rather than requiring servers or workstations with a lot of RAM and storage.

Question 20

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

Accepted Answer

The Sysinternals Handle utility is designed to show which processes are holding handles to files, among other resources, thus it does show what processes are using files on the file system.

Quiz 10: Virtual Machine and Cloud Forensics

Select the file below that is used in VirtualBox to create a virtual machine:

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.

Forensics tools can't directly mount VMs as external drives.

What processor instruction set is required in order to utilize virtualization software?

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

What Windows Registry key contains associations for file extensions?

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:

Select below the option that is not a common type 1 hypervisor:

The __________ disk image file format is associated with the VirtualBox hypervisor.

The __________________ is the version of Pcap available for Linux based operating systems.

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

Quiz 10: Virtual Machine and Cloud Forensics

Select the file below that is used in VirtualBox to create a virtual machine:​

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?​

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?​

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?​

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.​

Forensics tools can't directly mount VMs as external drives.​

What processor instruction set is required in order to utilize virtualization software?​

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.​

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

What Windows Registry key contains associations for file extensions?​

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM​ to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:​

Select below the option that is not a common type 1 hypervisor:​

The __________ disk image file format is associated with the VirtualBox hypervisor.​

The __________________ is the version of Pcap available for Linux based operating systems.​

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.​

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?​

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.​

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.​

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

Select the file below that is used in VirtualBox to create a virtual machine:

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters.

Forensics tools can't directly mount VMs as external drives.

What processor instruction set is required in order to utilize virtualization software?

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.

What Windows Registry key contains associations for file extensions?

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?

Select below the program within the PsTools suite that allows you to run processes remotely:

Select below the option that is not a common type 1 hypervisor:

The __________ disk image file format is associated with the VirtualBox hypervisor.

The __________________ is the version of Pcap available for Linux based operating systems.

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.