Question 1

?Match the following terms with the correct definitions below:?
-?Intrusion prevention and monitoring systems that track what attackers do on honeypots.
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Honeywalls are intrusion prevention and monitoring systems that track what attackers do on honeypots.

Question 2

?Match the following terms with the correct definitions below:?
-Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Zero day attacks are launched before the vulnerability is known to the vendor or a patch has been developed, exploiting the security hole during this unknown period.

Question 3

?Match the following terms with the correct definitions below:?
-Computers used without the owners' knowledge in a DDoS attack.?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Zombies are computers that have been compromised by hackers or malware and are used to perform malicious tasks, including DDoS attacks, without the knowledge of their owners.

Question 4

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.​
A)smurf​
B)​SYN flood
C)spoof
D)ghost

Accepted Answer

A SYN flood attack involves overwhelming a server with connection requests, without completing the connection handshake process. This can lead to a denial of service, as legitimate requests cannot be processed due to the overload of half-open connections.

Question 5

The ___________________ utility can be used to view network traffic graphically.​

Accepted Answer

The answer of The ___________________ utility can be used to...

Question 6

The ​tcpdump and Wireshark utilities both use what well known packet capture format?
A)​Netcap
B)​Pcap
C)Packetd
D)RAW

Accepted Answer

Both tcpdump and Wireshark use the PCAP (Packet Capture) format, which is widely recognized and supported by other network analysis tools.

Question 7

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.​

Accepted Answer

The answer of The ___________________ utility from Sysinternals shows what...

Question 8

?The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.
A)?netstat
B)?ls
C)ifconfig
D)tcpdump

Accepted Answer

The tcpdump command line program is specifically designed to capture and analyze network traffic in real time. It provides extensive records of network activity while it is running, and can produce hundreds or even thousands of records depending on the level of network traffic being captured. Netstat, ls, and ifconfig are all command line programs, but they are not used for network traffic analysis.

Question 9

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.​

Accepted Answer

The answer of The ________________ software lists all open network...

Question 10

?Match the following terms with the correct definitions below:?
-The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Network forensics is the process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur. This involves capturing, recording, and analyzing network packets to detect intrusion attempts, understand the tactics of attackers, and gather evidence.

Question 11

?Match the following terms with the correct definitions below:?
-A computer or network set up to lure an attacker.?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

A honeypot is a security mechanism set up to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. It acts as a decoy, luring cyber attackers away from legitimate targets by presenting a vulnerable system or network component.

Question 12

?Match the following terms with the correct definitions below:?
-A virtual machine interface that's loaded on top of an existing OS.?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

A Type 2 hypervisor runs on a host operating system to create and manage virtual machines, contrasting with a Type 1 hypervisor, which runs directly on the hardware.

Question 13

At what layers of the OSI model do most packet analyzers function?​
A)​Layer 1 or 2
B)​Layer 2 or 3
C)Layer 3 or 4
D)Layer 4 or 5

Accepted Answer

Most packet analyzers function at Layer 2 or 3 of the OSI model, where they can capture and analyze network traffic at the data link (Layer 2) and network (Layer 3) layers. Some advanced packet analyzers may also be able to operate at higher layers.

Question 14

?Match the following terms with the correct definitions below:?
-?A type of DoS attack in which other online machines are used, without the owner's knowledge, to launch an attack.
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

A distributed denial-of-service (DDoS) attack involves using multiple compromised systems, often referred to as "zombies," to flood a target with traffic, overwhelming it and causing a denial of service.

Question 15

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.​

Accepted Answer

The answer of __________________ help offset hardware costs for companies...

Question 16

?Match the following terms with the correct definitions below:?
-?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Defense in depth (DiD) is a layered network defense strategy that focuses on three modes of protection: people, technology, and operations.

Question 17

?Match the following terms with the correct definitions below:?
-?A virtual machine interface that loads on physical hardware and contains its own OS.
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

A Type 1 hypervisor runs directly on the physical hardware (bare metal) and can manage multiple operating systems, making it the correct match for the definition provided.

Question 18

Updating security patches, antivirus software, and OSs fall into the ________________ category of the defense in depth strategy.​

Accepted Answer

The answer of Updating security patches, antivirus software, and OSs...

Question 19

?Match the following terms with the correct definitions below:?
-An approach to network hardening that sets up several network layers to place the most valuable data at the innermost part of the network?
A)?defense in depth (DiD)
B)distributed denial-of-service (DDoS) attacks
C)?honeypot
D)honeywalls?
E)?layered network defense strategy
F)network forensics?
G)?type 1 hypervisor
H)type 2 hypervisor?
I)?zero day attacks
J)zombies

Accepted Answer

Layered network defense strategy is an approach to network hardening that sets up several network layers to place the most valuable data at the innermost part of the network.

Question 20

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?​
A)​12.04
B)​13.11
C)14.04
D)14.11

Accepted Answer

The answer of The SANS Investigative Forensics Toolkit (SIFT) appliance...

Quiz 10: Virtual Machine and Cloud Forensics

?Match the following terms with the correct definitions below:? -?Intrusion prevention and monitoring systems that track what attackers do on honeypots.

?Match the following terms with the correct definitions below:? -Attacks launched before vendors or network administrators have discovered vulnerabilities and patches for them have been released.?

?Match the following terms with the correct definitions below:? -Computers used without the owners' knowledge in a DDoS attack.?

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.

The ___________________ utility can be used to view network traffic graphically.

The tcpdump and Wireshark utilities both use what well known packet capture format?

The ___________________ utility from Sysinternals shows what files, Registry keys, and DLLs are loaded at a specific time.

?The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.

The ________________ software lists all open network sockets, including those hidden by rootkits, and also works on both 32-bit and 64-bit systems.

?Match the following terms with the correct definitions below:? -The process of collecting and analyzing raw network data and systematically tracking network traffic to determine how security incidents occur.?

?Match the following terms with the correct definitions below:? -A computer or network set up to lure an attacker.?

?Match the following terms with the correct definitions below:? -A virtual machine interface that's loaded on top of an existing OS.?

At what layers of the OSI model do most packet analyzers function?

?Match the following terms with the correct definitions below:? -?A type of DoS attack in which other online machines are used, without the owner's knowledge, to launch an attack.

__________________ help offset hardware costs for companies and are handy when you want to run legacy or uncommon OSs and software along with the other software on your computer.

?Match the following terms with the correct definitions below:? -?The NSA's approach to implementing a layered network defense strategy. It focuses on three modes of protection: people, technology, and operations.

?Match the following terms with the correct definitions below:? -?A virtual machine interface that loads on physical hardware and contains its own OS.

Updating security patches, antivirus software, and OSs fall into the ________________ category of the defense in depth strategy.

?Match the following terms with the correct definitions below:? -An approach to network hardening that sets up several network layers to place the most valuable data at the innermost part of the network?

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?