Back to Subject
View Notes

Unit 4 - Practice Quiz

INT250

1 Which directory in the Linux file system is a virtual file system containing volatile information about running processes and system resources?

A. /etc
B. /home
C. /proc
D. /var

2 Which Linux command is primarily used to list open files and the processes that opened them, crucial for analyzing volatile data?

A. ls
B. lsof
C. grep
D. chmod

3 In Linux forensics, what does the 'w' command display?

A. Network interface configuration
B. A list of logged-in users and what they are doing
C. The wireless network strength
D. Write permissions of the current directory

4 Which of the following data is considered Non-volatile in a Linux system?

A. ARP cache
B. Running process list
C. System logs stored in /var/log
D. RAM contents

5 What is the primary purpose of the Linux Swap space in the context of forensics?

A. To store user passwords permanently
B. To act as an extension of RAM, potentially containing volatile memory artifacts
C. To keep network logs
D. To store the master boot record

6 Which command-line utility is commonly used to create a bit-stream image of a Linux partition?

A. cp
B. dd
C. mv
D. tar

7 What is an Inode in the context of Linux file systems?

A. A networking protocol
B. A data structure storing metadata about a file (size, owner, permissions)
C. The name of the root user
D. An input node for peripherals

8 When analyzing a Linux file system image, what does a dot (.) at the beginning of a filename indicate?

A. The file is an executable
B. The file is hidden
C. The file is corrupted
D. The file is a directory

9 Which file system is the default journaling file system for many modern Linux distributions?

A. NTFS
B. FAT32
C. ext4
D. HFS+

10 Which file in Linux contains encrypted user passwords?

A. /etc/passwd
B. /etc/shadow
C. /etc/group
D. /var/www

11 Which tool is a Loadable Kernel Module (LKM) often used to acquire volatile memory from Linux systems?

A. LiME
B. Wireshark
C. Autopsy
D. Nmap

12 Why is Memory Forensics critical in investigating advanced malware?

A. Malware always deletes itself from the disk immediately
B. Malware may reside only in RAM (fileless) or encrypt its disk components
C. RAM is easier to copy than a hard drive
D. Memory forensics is faster than disk forensics

13 Which framework is the industry standard for analyzing volatile memory dumps?

A. Metasploit
B. Volatility
C. John the Ripper
D. Snort

14 In the context of Volatility, what is a 'profile'?

A. The user account of the investigator
B. A specification of the operating system version and kernel data structures
C. The hardware configuration of the suspect machine
D. A list of suspect IP addresses

15 Which command in the Volatility framework is used to list running processes from a memory dump?

A. linux_pslist
B. linux_ls
C. linux_netstat
D. linux_mount

16 What artifact can often be recovered from memory that allows an investigator to decrypt encrypted volumes?

A. The Master Boot Record
B. Encryption Keys
C. The BIOS password
D. The MAC address

17 What is Network Forensics?

A. Restoring deleted emails
B. Monitoring and analyzing computer network traffic for information gathering, legal evidence, or intrusion detection
C. Cracking Wi-Fi passwords
D. Repairing broken routers

18 Which mode must a network interface card (NIC) be in to capture all traffic on a network segment, not just traffic addressed to it?

A. Protected mode
B. Promiscuous mode
C. Safe mode
D. Private mode

19 In the 'Catch-it-as-you-can' network forensics strategy, what is the main challenge?

A. It misses data frequently
B. It requires large amounts of storage to keep all captured data
C. It is illegal in most countries
D. It cannot capture encrypted traffic

20 Which of the following is a standard format for saving captured network packets?

A. DOCX
B. PCAP
C. JPEG
D. PDF

21 What is 'Forensic Readiness' regarding network logging?

A. The ability to maximize an organization's potential to use digital evidence while minimizing the cost of an investigation
B. Buying the most expensive forensic software
C. Having a lawyer on speed dial
D. Deleting logs every 24 hours to save space

22 Which Linux log file typically records authentication information, such as failed login attempts?

A. /var/log/dmesg
B. /var/log/auth.log
C. /var/log/kern.log
D. /var/log/boot.log

23 What is the standard port for the Syslog protocol?

A. 80
B. 22
C. 514
D. 443

24 Which protocol is crucial for ensuring that timestamps across different network devices are consistent for correlation?

A. HTTP
B. FTP
C. NTP
D. SMTP

25 What does the term 'Log Rotation' refer to?

A. Spinning the hard drive physically
B. Sending logs to different servers in a round-robin fashion
C. The process of archiving old log files and creating new ones to prevent file systems from filling up
D. Encrypting logs using a rotating cipher

26 Which syslog severity level indicates the system is unusable?

A. Info (6)
B. Warning (4)
C. Emergency (0)
D. Debug (7)

27 What is 'Event Correlation' in the context of network forensics?

A. Copying events from one log to another
B. Relating distinct events from multiple sources to identify a pattern or security incident
C. Deleting duplicate events
D. Backing up events to the cloud

28 In event correlation, what is 'Normalization'?

A. Making all users use the same password
B. Converting data from different formats into a common format for analysis
C. Reducing the severity of all alerts
D. Ignoring outliers in data

29 What is a SIEM system used for?

A. System Information and Email Management
B. Security Information and Event Management
C. Simple Internet Evidence Monitor
D. Secure Internal External Messaging

30 What is an Indicator of Compromise (IoC)?

A. A software license key
B. A piece of forensic data that identifies potentially malicious activity on a system or network
C. A type of network cable
D. A password policy

31 Which of the following is a common Network IoC?

A. A fragmented hard drive
B. High CPU usage on a local machine
C. Beaconing traffic to a known malicious IP address
D. A blue screen of death

32 What is 'Beaconing' in network traffic analysis?

A. Sending a distress signal to the administrator
B. Malware sending regular communications to a Command and Control (C2) server
C. A router broadcasting its SSID
D. The blinking light on a network card

33 What does a sudden spike in outbound traffic likely indicate?

A. A system update
B. Data Exfiltration
C. A failed login attempt
D. Incoming email

34 Which User-Agent string anomaly might indicate a non-browser tool or malware?

A. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
B. Chrome/91.0.4472.124
C. Python-urllib/3.8
D. Safari/537.36

35 What is a Domain Generation Algorithm (DGA) used for by malware?

A. To encrypt the hard drive
B. To periodically generate a large number of domain names for C2 communication to evade blacklisting
C. To generate secure passwords
D. To speed up DNS resolution

36 Which tool is primarily used for deep packet analysis and visual inspection of traffic?

A. Wireshark
B. Netcat
C. Ping
D. Traceroute

37 Which command-line packet analyzer is standard on most Unix-like systems?

A. Photoshop
B. Tcpdump
C. Excel
D. Outlook

38 What Wireshark display filter would show only traffic associated with IP address 192.168.1.5?

A. ip.addr == 192.168.1.5
B. show 192.168.1.5
C. ip = 192.168.1.5
D. filter.ip(192.168.1.5)

39 In a TCP packet, which flag initiates a connection?

A. RST
B. FIN
C. SYN
D. ACK

40 What traffic pattern is characteristic of a SYN Flood DoS attack?

A. Many connection requests (SYN) without completing the handshake (ACK)
B. Many FIN packets sent at once
C. Large UDP packets
D. Slow HTTP requests

41 How does Deep Packet Inspection (DPI) differ from stateful inspection?

A. It only looks at the header
B. It examines the data part (payload) of the packet as well as the header
C. It is faster but less secure
D. It only works on wireless networks

42 Which of the following creates a significant challenge for network traffic investigation?

A. IPv4 addressing
B. End-to-End Encryption (TLS/SSL)
C. Ethernet cables
D. DHCP

43 What is the function of the command grep in Linux forensics?

A. To restart the system
B. To search text or logs for specific patterns or strings
C. To capture packets
D. To format a disk

44 Which directory contains configuration files in Linux, useful for establishing the baseline state of a system?

A. /bin
B. /dev
C. /etc
D. /tmp

45 In network forensics, what is the 'fast-flux' technique?

A. A way to speed up internet download speeds
B. A DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts
C. Rapidly plugging and unplugging network cables
D. Using fiber optics instead of copper

46 Which log file would you check to investigate potential USB device insertions on a Linux system?

A. /var/log/apache2/access.log
B. /var/log/kern.log
C. /var/log/mail.log
D. /var/log/dpkg.log

47 What is the primary benefit of 'Centralized Logging'?

A. It is cheaper than local logging
B. It prevents an attacker from deleting logs locally to cover their tracks
C. It uses less bandwidth
D. It requires no configuration

48 Which command displays the history of commands executed by the current user?

A. past
B. history
C. mem
D. trace

49 What does a 'Keep-Alive' signal usually suggest in a forensic analysis of malware?

A. The computer battery is low
B. The malware is maintaining an active connection to the C2 server to receive commands
C. The network cable is unplugged
D. The firewall is blocking traffic

50 When analyzing a disk image, which hashing algorithm is commonly used to verify the integrity of the image?

A. AES
B. RSA
C. SHA-256
D. DES